I am currently looking for a way to hook all incoming emails in a 365 tenant.

For the moment, we only found the solution to have 1 hook per mailbox and being notified of incoming email, but this produce a lot of complexity (having 4000 users induce having 4000 web hooks, etc). Also, to have a more optimized, we are trying to achieve a similar behavior as the usual “Exchange Transport Agent” that exists with onprem exchanges, but not with 365 version (cloud).

Is there a way through Graph or whatever to develop such an agent that can “intercept” incoming email and tampering them for example ? (adding a header for example)

Idea would be to intercept every incoming message to analyze them, and avoid having multiple hooks to all user mailboxes.

Thanks a lot for help,

NB: I do not want to change MX to add a relay, I want the email to stay where they are 🙂