The short version: every staff member's email signature gets written for them, on every email they send, without them having to think about it. You're the person who decides what those signatures look like. Welcome.

What staff see

The add-in runs inside Outlook on every new compose, reply and forward. The moment a staff member opens an email window, the right signature lands at the bottom. No copying and pasting, and nothing to fix when contact details change.

Their name, role, email and extension all come straight from M365, so nothing's hand-typed and nothing goes stale. If marketing updates the school address, the next email they send picks it up.

There's a Signature button in the Outlook ribbon if they want to change a few personal bits:

• Their role, if what M365 has is outdated.
• Their working days and hours, so people know when to expect a reply.
• The sign-off they prefer (Kind regards, Blessings, Yours in Christ, whatever feels right for them).
• A direct phone line, if they have one.
• Hide their extension if they'd rather not show it.

That's the lot. Most staff will set those once and never open the taskpane again.

The admin (this thing)

The sidebar on the left is the only navigation. You land on the Overview, which shows whether the API is up, when the last save happened and who made it, how much storage the config is using, and a health table for every brand. Click a brand to edit it, or a row in the Overview table, same thing. Global Settings holds the shared stuff.

Brands are completely independent of each other. Editing NCC can't accidentally change Gulf, and the save endpoint is per-brand by URL, so the system literally can't write to the wrong brand even if something tries.

What you can change on each brand

• Logo: drag a file in, or paste a URL. The image you set here is what shows at the bottom of every signature for that brand.
• Brand colours: Primary is the staff member's name and the website-bar links, Secondary is headings, role and contact prefixes. The live preview on the right updates as you type, so you can see exactly what staff will see.
• Who can use this brand: type Entra security groups in (the chip box), one per group. Staff in any of those groups can pick this brand from their dropdown. Anyone outside those groups can't.
• School details: college name, address, phone, email, website, CRICOS. The address is split into Street Address and PO Box, and shows in the signature as a single line joined with a pipe.
• Variants: special-event signatures for this brand. Each variant inherits everything from the parent brand except its logo. Think Christmas Concert, school musical, Open Day.

Saving

One Apply button per brand. It saves the brand's data and its access groups together, and every save is logged under Recent changes with your name on it, so there's always a record of who changed what. The next time staff open a new email in Outlook they'll see the new version. Nothing to restart or re-install.

Storage

Uploaded logos get stored inside the config itself, and every Outlook compose downloads that config before inserting a signature. Keeping it small keeps signatures fast, so the whole thing is capped at 900KB and each brand at 220KB. The Storage section on the Overview lists every upload with its size. Compress shrinks one in place (it tells you the before and after first), Remove drops it and falls back to the Logo URL.

Debug

If something's acting up, start there. It runs the same requests the add-in makes and checks the API, your sign-in, the save pipeline, and whether every brand's logo actually loads, then tells you what's wrong in plain terms. Copy report puts a text version on your clipboard for sending to me or IT.

Global Settings

Things that are the same across every brand:

• The list of sign-off options staff can pick from (Kind regards, Warm regards, Blessings, etc.).
• The list of title prefixes (Mr, Mrs, Dr, Rev).
• Inline labels (E:, P:, Ext:, CRICOS:).
• Which fields staff are allowed to edit from their taskpane.

Security groups

Access to each brand is controlled by Microsoft Entra security groups. Daniel sets these up in the admin centre, and staff get added to the one that matches their school.

Group	Sees
SG-NCCstaff	NCC + its variants
SG-GCCstaff	Gulf + its variants
SG-ELCstaff	NCC Early Learners + its variants
SG-SWIMMERSstaff	NCC Swimmers + its variants
SG-EmailSigAdmin	Everything (that's you)

Staff in more than one group get the union. Anyone who isn't in any of these groups falls back to NCC by default, so a brand-new hire still gets a working signature on day one while IT sets their group up.

You can edit which groups unlock which brand from each brand's editor under "Who can use this brand". The defaults above will be fine for most of NCC, but if a new school joins or a group gets renamed, this is where you update it.

Variants for special events

For when a school musical, Open Day, or another event wants its own logo on emails for a few weeks. You create the variant inside the parent brand's editor, give it a name (e.g. NCC Christmas Concert 2026) and a logo. Everything else (colours, address, contact info) comes from the parent brand automatically.

Staff who can already see the parent brand will see the variant appear as an option in their taskpane dropdown. When the event's over, just delete the variant.

Behind the scenes

For the curious. Skip this if you don't care.

• The Outlook add-in is a manifest XML that points at HTML and JavaScript files on Cloudflare Pages.
• Brand data and global settings live in Cloudflare KV. The admin POSTs there when you click Apply, and the add-in fetches from there on every compose.
• Staff name, email and job title come live from Microsoft Graph via Nested App Authentication. MSAL.js inside the taskpane swaps the Office SSO token for a Graph token through Microsoft's auth servers, so we don't need a backend or a client secret.
• The same signature template runs in three places (live preview here, taskpane, headless launch event) so the output is identical wherever the signature gets built.

If something looks wrong

First stop is the Debug page. Run the checks and it'll usually name the problem for you. Beyond that:

• A staff member can't find their school's signature. Most likely they're not in the matching SG yet. Drop them into the right group (or ask IT to) and tell them to close and reopen Outlook.
• An old logo's still showing. Click Remove uploaded logo on the brand, hit Apply, then re-upload the new one. The cached version usually clears on the next compose.
• Save failed: logo too large. The per-brand cap is 220KB. Hit Compress next to that logo in the Storage section on the Overview and it'll shrink it in place.
• A logo looks stretched. Open that brand and hit Apply once. The save stores the logo's real shape so Outlook stops guessing.
• Edit didn't show up in Outlook. Outlook caches signatures for a short bit. Close and reopen, or wait for the next compose.
• Outlook Classic doesn't auto-apply. Classic for Windows doesn't support the LaunchEvent we use. Staff on Classic can still open the taskpane manually and click Apply to insert the signature.

Who to ask for what

• Tech or bug: me (harrison.black@ncc.qld.edu.au).
• Logo or branding sign-off: Director of Marketing.
• Adding or moving someone in a security group: Daniel / IT.
• Adding a variant for an event: do it yourself in the brand's editor, no approval needed for short-lived event signatures.

---

Valuing what matters most, NCC Education Group.