Create a feature to journal emails to a Cloud Archiver - example Barracuda Archiver.
The link show how to setup a connector in M365 - but Smartermail needs to have a way to have another gateway for emails.
The event feature doesn't work as all emails are going out the primary gateway which is forwarded to an email filtering application.
This is our Campus article for Journaling in M365:
Barracuda - manually-configure-journaling
Journaling in M365 revolves around the mail server creating a copy of every message for every user and group and sending it to the Cloud Archiver (BCAS) journaling address. M365 even has the ability to exempt messages for "mas.barracudanetworks.com" from being sent to ESS, and can send the messages directly to us via our MX records.
If the mail server could send messages directly to "mas.barracudanetworks.com" rather than the SmartHost for ESS listed as the Gateway, then messages for BCAS wouldn't be getting deferred in ESS.