Oh and interestingly I had to set a separate transport rule in M365 in order for M365 to follow our DMARC policy for internal emails. A bit weird, but there you go.