Some LOBs (Line of Business Applications) suck at sending email and still don’t encrypt email with TLS. This can be overcome but routing the email to an SMTP relay inside the network and using that to encrypt the outbound email heading to Office 365 (or other provider).

https://support.office.com/en-gb/article/How-to-configure-IIS-for-relay-with-Office-365-eb57abd2-3859-4e79-b721-2ed1f0f579c9