smimeConfig

S/MIME Settings. Tenant settings for signed and encrypted email using S/MIME certificates. The smimeConfig singleton lives under /exchange/v1.0/smimeConfig in the Encryption & rights category.

Fact	Value
Path	`/exchange/v1.0/smimeConfig`
Category	Encryption & rights
Tier	Tier 9, Hybrid and organization
Read role	`OrganizationConfig.Read.All` (Community)
Write role	`OrganizationConfig.ReadWrite.All` (Enterprise)
Backing cmdlets	Get-SmimeConfig, Set-SmimeConfig

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/smimeConfig`	Get the tenant S/MIME configuration singleton - OWA S/MIME toggles + the issuing-CA cert chain blob.	`OrganizationConfig.Read`	Community
PATCH	`/exchange/v1.0/smimeConfig`	PATCH /smimeConfig - update tenant S/MIME config singleton. Body keys map 1:1 to Set-SmimeConfig parameters. smimeCertificateIssuingCA is base64-encoded byte[]. Returns 200 + post-Set singleton.	`OrganizationConfig.ReadWrite`	Enterprise

GET /exchange/v1.0/smimeConfig

Get the tenant S/MIME configuration singleton - OWA S/MIME toggles + the issuing-CA cert chain blob.

Backing cmdlet: Get-SmimeConfig. Role: OrganizationConfig.Read (Community).

Get the S/MIME configuration

Returns the organization-wide S/MIME configuration as a tenant singleton, backed by the Get-SmimeConfig cmdlet. Controls S/MIME settings such as CRL/OCSP checking and the OWA S/MIME control behavior.

GET /exchange/v1.0/smimeConfig HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#smimeConfig",
  "Id": "Smime Configuration",
  "Identity": "Smime Configuration",
  "OWASMIMESettings": null,
  "SMIMECertificateIssuingCA": null,
  "SMIMECRLConnectivityRequired": null,
  "SMIMECRLDistributionPointMigrationList": null,
  "SMIMEEnableCRL": null,
  "SMIMEEnableOCSP": null
}

Notes: All policy fields read back null on tenants that have not customized S/MIME; values populate once Set-SmimeConfig is applied.

PATCH /exchange/v1.0/smimeConfig

PATCH /smimeConfig - update tenant S/MIME config singleton. Body keys map 1:1 to Set-SmimeConfig parameters. smimeCertificateIssuingCA is base64-encoded byte[]. Returns 200 + post-Set singleton.

Backing cmdlet: Set-SmimeConfig. Role: OrganizationConfig.ReadWrite (Enterprise).

Parameter	In	Type
`noSignOnReply`	body
`owaAllowUserChoiceOfSigningCertificate`	body
`owaAlwaysEncrypt`	body
`owaAlwaysSign`	body
`owabccEncryptedEmailForking`	body
`owaCheckCRLOnSend`	body
`owaClearSign`	body
`owaCopyRecipientHeaders`	body
`owacrlConnectionTimeout`	body
`owacrlRetrievalTimeout`	body
`owaDisableCRLCheck`	body
`owadlExpansionTimeout`	body
`owaEncryptionAlgorithms`	body
`owaEncryptTemporaryBuffers`	body
`owaForceSMIMEClientUpgrade`	body
`owaIncludeCertificateChainAndRootCertificate`	body
`owaIncludeCertificateChainWithoutRootCertificate`	body
`owaIncludeSMIMECapabilitiesInMessage`	body
`owaOnlyUseSmartCard`	body
`owaSenderCertificateAttributesToDisplay`	body
`owaSignedEmailCertificateInclusion`	body
`owaSigningAlgorithms`	body
`owaTripleWrapSignedEncryptedMail`	body
`owaUseKeyIdentifier`	body
`owaUseSecondaryProxiesWhenFindingCertificates`	body
`smimeCertificateIssuingCA`	body
`dryRun`	query	bool (switch)

Update the tenant S/MIME configuration singleton

Updates the tenant-wide S/MIME configuration via Set-SmimeConfig. This is a singleton resource (no key); body keys map 1:1 to Set-SmimeConfig parameters and the post-Set singleton is returned.

PATCH /exchange/v1.0/smimeConfig HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "owaAlwaysSign": true,
  "owaAlwaysEncrypt": false,
  "owaCheckCRLOnSend": true
}

HTTP/1.1 200 OK
Content-Type: application/json; odata.metadata=minimal

{
  "Identity": "SmimeConfig",
  "OWAAlwaysSign": true,
  "OWAAlwaysEncrypt": false,
  "OWACheckCRLOnSend": true
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/smimeConfig

?dryRun=true previews of any write stay on Community.