transport.db:

hotmail.com relay:[relay.server.tld]:587 # and other domains

main.cf:

transport_maps = hash:/etc/postfix/transport smtp_sasl_password_maps = hash:/etc/postfix/relay_passwd

relay_passwd.db: # if necessary / not authenticated by IP relay.server.tld user:pass

The relay can/should rewrite the Return-Path to pass SPF. It's no problem for DMARC as the DKIM signature added by the initial server still authenticates it.

It requires manually adding domains of custom 365 installations to the list - at this size I do this manually, but should probably be automated "on bounce" or maybe even by a smart rule based on the MX record.

In Exim4 it's also possible to conditionally rewrite based on for example the recipient domain.