Phased rollout for larger organizations

Route a pilot group through Gateway first, watch the audit trail and warn bounces for a week, then widen the routing rule in Google or Microsoft to everyone. DNS, the relay credential and the policy do not change between phases, and there is no downtime at any step.

Before you start

Owner or Admin in PXCMail, plus a Google Workspace or Microsoft 365 admin.
Console → Domains & connection shows every DNS check green.
The industry policy template reviewed under Console → Policy, with test mode on for any custom rules.
Five to ten pilot users across roles, including whoever sends the most attachments.
A short note to pilots explaining what a warn bounce looks like.

Steps

Create a group such as pxcmail-pilot: Google Admin console → Groups, or Microsoft 365 admin center → Teams & groups.
Scope the outbound route to that group. Google: Apps → Google Workspace → Gmail → Routing, limited to the group or organizational unit. Microsoft: Exchange admin center → Mail flow → Rules, condition “sender is a member of”, action “use the connector”. The Google and Microsoft guides show the screens.
Run for a week. Each morning open Console → Audit trail filtered by pilot senders, then Console → Quarantine & holds, then any warn bounces pilots report.
Tune: add recipient-domain exceptions, adjust custom patterns, take a rule out of test mode once its matches look right. Every change is versioned.
Expand by changing the rule scope to everyone, or office by office if you prefer waves.
For several tenants, add each under Console → Domains & connection → Add connection, or create separate organizations under a partner view.

Verify

During the pilot the audit trail shows only pilot senders. After expansion it shows everyone, and Console home shows a recent “Last message” time for every connection.

Troubleshooting

A pilot user’s mail never appears in the audit trail. Cause: group membership or the route has not propagated. Fix: confirm membership, wait, send again. Internal mail never appears because it never leaves your provider.
Non-pilot users appear in the audit trail. Cause: the rule is scoped to a parent group or everyone. Fix: narrow it to the pilot group.
Many warn bounces on day one. Cause: no exceptions for recipients you write to daily (a hospital, a payer, a court). Fix: add recipient-domain exceptions; keep warn rules in test mode until tuned.
The second tenant shows a red relay. Cause: each connection has its own ingress credential. Fix: Console → Domains & connection → open that connection and copy its credential into that tenant’s connector.
Bulk notifications from practice software are held. Cause: a hold rule on large sends. Fix: exempt that sender address.

Example

Pacific Behavioral runs group therapy across three offices and, after a merger, two Microsoft 365 tenants. The practice manager pilots the intake coordinator, two clinicians and billing in the main tenant. In week one the audit trail shows hospital referrals delivered over TLS, three locked deliveries of treatment summaries, and a few warn bounces from a rule that flagged appointment reminders. She exempts the reminder sender, takes the Part 2 redisclosure rule out of test mode, and widens the transport rule to the whole tenant. The second tenant is added as its own connection the following week.

FAQ

Is there any downtime when we expand?

No. Messages already in flight finish on the old path.

Can the whole pilot run in test mode?

Yes. Test mode records what each rule would have done without acting. Most organizations keep the encrypt rule live so the pilot produces real locked deliveries to review.

Does a phased rollout work for Hosted?

Hosted moves mailboxes, so use the migration guide instead; the pilot idea still applies to the first batch of mailboxes.

Different offices use different domains. One organization or several?

One organization if one person owns compliance for all offices. Separate organizations if each office has its own agreement and Security Officer.

Still stuck? A human answers within 15 minutes on chat, 1 hour by email during business hours (24/7 for outages).