Before you begin
- The Atlas Ink add-on on your subscription (it is available standalone or on every Atlas AVD plan, billed at one unit per active signature user per month, always $1 per unit)
- An Atlas administrator account, or an Atlas Ink role (Administrator, Editor or Reviewer) granted from the Users tab in Atlas Ink
- A Global Administrator of your Microsoft 365 tenant, to grant admin consent to the Atlas app the first time
- A commercial-cloud (Azure Commercial) tenant: sovereign clouds (GCC / GCC High) are not supported at launch
How Atlas Ink works
Atlas Ink is signature management as policy: you define a signature centrally, target it precisely, and let Atlas keep every mailbox consistent. It resolves each user's assignment, fills the template's merge tokens from that person's Entra ID profile, and writes the result to their mailbox as their own Outlook signature. Because Atlas sets the compose signature on the mailbox rather than stamping messages in transit, by default there is no transport rule and no interception. Your mail path is untouched. The one exception is optional server-side stamping, which an admin must turn on explicitly and which is not available in GCC or GCC High: it creates one mail-flow rule, and a mail-enabled group of the users it applies to, in your own Exchange Online to cover clients that don't read the mailbox signature. Even then, no mail ever flows through Atlas.
Two ways to get Atlas Ink
Atlas Ink is one product with two deployment paths, and the same signatures, pricing, and mailbox behavior apply to both:
- Standalone: run Atlas Ink on the free Community plan with prepaid units, no paid Atlas AVD plan required. Deploy Atlas into your own Azure subscription from your setup link (your App Service, your database, your keys), then prepay units for your signature users. After the short first-run setup wizard, you land in Atlas Ink.
- Added to Atlas AVD: Atlas Ink can be added to any Atlas AVD plan, from Community through Atlas AVD, as a per-subscription add-on with no purchase or activation fee. You manage it from the same Atlas AVD console you already use for host pools and users.
Open Atlas Ink
Atlas Ink is on as soon as your subscription includes the add-on; there is no separate switch to turn it on. Open Ink in the Atlas Operations section of the left sidebar. The page opens with usage tiles (Coverage, Active signatures, Templates, Pending and Failed) and six tabs: Templates, Assignments, Banners, Rollout, Analytics and, for Atlas Ink administrators, Users. On a fresh tenant, the Atlas Ink setup guide walks you through your first template, assignment and rollout; you can reopen it any time from the page header.
The setup wizard's Premium step, and tenant settings afterwards, can opt a tenant out of Atlas Ink. If a tenant has been opted out, Atlas Ink shows "Atlas Ink is not enabled" there. If your subscription doesn't include the add-on, the page explains how to add it.
Give colleagues access (optional)
Signatures are often owned by marketing or communications rather than IT. On the Users tab, click Add user to grant someone an Atlas Ink role; the role is their only access to the Atlas console.
- Administrator: full access, including approving templates and managing Atlas Ink users.
- Editor: authors templates, submits them for approval, assigns them and pushes signatures. Cannot approve.
- Reviewer: approves, rejects or unpublishes templates submitted for approval, and views everything else. Cannot author or push.
Connect Exchange (one-time admin consent)
Atlas Ink pushes signatures through the main Atlas app registration, which needs the Exchange.ManageAsApp permission (the standard Atlas setup script and the setup wizard's permissions step include it). Before Atlas can push to any mailbox, a Global Administrator of your tenant grants admin consent. The Rollout tab shows the current state; when consent is missing it offers an Open app registration button, and Recheck confirms the change. After consenting, assign the Exchange Recipient Administrator role to the Atlas service principal in that tenant so it can write signature settings.
Turn off Outlook roaming signatures
Outlook roaming signatures must be turned off in your tenant, or Exchange silently ignores every signature Atlas pushes. An Exchange administrator runs this once in Exchange Online PowerShell. The Rollout tab flags this and shows the same command; use Recheck after running it. For the full walkthrough, including how to check the current value first, see Turn Off Outlook Roaming Signatures for Atlas Ink.
Connect-ExchangeOnline
Set-OrganizationConfig -PostponeRoamingSignaturesUntilLater $trueStep 1: Author and publish a signature template
On the Templates tab, click New signature. Start from one of the ready-made designs or build your own, give it a name, and drop in merge tokens (full name, job title, department, email, mobile and office phone, company, office location, address fields, manager name and email, and a headshot); Atlas fills each one from the user's Entra ID profile at push time. The live preview renders the template with your own profile, or choose Preview as to see it as any colleague. Keep it Active (available to assign) and save it.
- A saved template is ready to assign and push as soon as it is Active (available to assign); turn Active off to keep a template out of new assignments.
- Each edit is kept in the template's version history, so you can roll back.
Design the signature once, centrally: logo, brand colors, and legal footer live in the template, while the per-person details come from the directory. Condition blocks can show a section only for some users or vary wording by language, so one template adapts to everyone. When someone changes role, their next push picks up the new title automatically.
Step 2: Assign the template
On the Assignments tab, choose New assignment, pick an active template, and choose who it applies to:
- Tenant: every user in the tenant (a company-wide default).
- Group: a Microsoft 365 / Entra group. Search for it by name and pick it from the list.
- User: a single person, found by name or email.
The most specific assignment wins (user over group over tenant), and priority breaks ties, so a company-wide default, a sales-team variant, and an executive exception coexist cleanly.
Step 3: Push signatures to mailboxes
On the Rollout tab, click Provision users and enter the users to enroll, one email address or UPN per line (up to 500 per run), then click Push signatures. Atlas resolves each user's effective assignment, including nested group memberships, fills the tokens from their Entra ID profile, and writes the finished signature to their mailbox. The Per-user rollout table then shows each user's status: Applied, Pending, Failed (with the reason), Drifted or Removed.
Keep signatures on brand (drift enforcement)
By default a managed signature is enforced: a daily check compares each mailbox against what Atlas pushed and re-applies it if the user edited or cleared it (the mailbox shows Drifted until the re-apply lands). Turn on Notify on signature drift if you also want a notification naming each mailbox that drifts. To let someone manage their own signature, turn off the Eligible switch on their row: Atlas releases the mailbox, stops re-applying and billing it, and the user is free to set their own. Flipping the switch never touches the mailbox contents.
Banners and analytics
The Banners tab adds a marketing banner (an image and a click destination) below the signature of everyone it is assigned to, using the same tenant, group and user targeting. Give it start and end dates to run it as a campaign that goes live and expires on its own. The Analytics tab shows coverage and drift over time, coverage by template, and each campaign's reach and clicks.
What you pay
Atlas Ink is billed in units, per active user, per month: one distinct user with a managed signature applied to their mailbox during a calendar month is one unit, always $1. Atlas Ink and the End User Portal are metered independently, so a user active in both in the same month is two units. Users with no applied signature that month cost nothing, however many templates exist, and users you have released stop accruing new months. Units are prepaid and billed via Stripe, purchased in-product through the plan selection. There is no separate Azure Marketplace meter, so usage never lands on your Azure invoice.
There is no extra tier to buy or upgrade: Atlas Ink is available on every Atlas AVD plan as an add-on with no purchase or activation fee, and standalone customers run it on the free Community plan with prepaid units. Either way, you are billed only for the users who actually carry a managed signature.
Trying Atlas Ink on a trial
Atlas Ink usage is free during your trial: no active-signature users are billed until the trial converts, so you can author templates and roll signatures out to real mailboxes at no charge. Every trial starts from the Atlas AVD offer and runs 30 days with full access, Atlas Ink included; when it ends, keep Ink by choosing any paid plan or by staying on the free Community plan with prepaid units.
Signatures rolled out during a trial stay on the mailboxes when the trial ends, whether or not it converts. Atlas never removes them on its own. If you don't want to keep them, remove them from Atlas Ink before the trial ends, or remove them in Microsoft 365 afterwards.
Cancelling or offboarding: what happens to signatures
A managed signature lives on the mailbox itself, not in Atlas. When a deployment loses Atlas Ink entitlement, Atlas stops pushing, updating, and enforcing signatures, but it never removes them on its own: every signature Atlas applied stays in place until an admin removes it. The same is true however entitlement ends:
- Paid subscription cancelled or lapsed: signatures stay in place.
- Trial that does not convert to a paid subscription: signatures stay in place.
- Atlas Ink add-on removed while the subscription stays active: signatures stay in place.
To clear signatures when you leave, remove them from Atlas Ink while your entitlement is still active; Atlas restores each mailbox to the signature it had before. After the subscription ends the Atlas console is locked, so remove any remaining signatures, and any mail flow rules you set up for Atlas Ink, directly in Microsoft 365.
The one invariant: Atlas removes only what it added
Whenever Atlas removes a signature, it only ever removes the signature it pushed. It snapshots each mailbox's own signature before its first push and puts that original back on removal; a signature a user set for themselves is never deleted or altered, and a mailbox Atlas never captured an original for is left untouched rather than blanked.