DEV Community

Cover image for Exchange Online Administration — The Complete Guide for Modern IT Teams
Suvankar Chakraborty
Suvankar Chakraborty

Posted on

Exchange Online Administration — The Complete Guide for Modern IT Teams

#exchangeonline #m365admin #operations #microsoft365

The Email Platform Nobody Fully Understands

Ask any IT manager if they manage Exchange Online and the answer is almost always yes. Ask them to describe their mail flow architecture, explain how their transport rules interact with their anti-spam policies, walk through their hybrid coexistence configuration, or detail how their shared mailbox permissions are governed — and the confidence level drops sharply.

This is not a criticism. Exchange Online is genuinely complex. It is the evolution of a platform that has been running enterprise email since the 1990s, now delivered as a cloud service with a management interface that sits across two admin centres (the Exchange Admin Center and the Microsoft 365 admin center), a PowerShell module that is still the most powerful administration tool despite the improving GUI, and a mail flow architecture that interacts with Defender for Office 365, Microsoft Purview, Microsoft Teams, and the broader Microsoft 365 ecosystem in ways that are not always obvious.

This guide is the comprehensive Exchange Online administration reference I have been building in my head across 13+ years of enterprise Microsoft environments. It covers every major administrative domain — from the basics of mailbox types to the depths of mail flow, from hybrid coexistence to security hardening — in the level of detail that modern IT teams actually need.

Section 1: Exchange Online Fundamentals — What You Are Actually Managing

The Exchange Online architecture

Exchange Online is Microsoft's cloud-hosted email platform, part of the Microsoft 365 suite. Unlike on-premises Exchange, you do not manage the physical servers, the database availability groups, the storage, or the infrastructure. Microsoft manages all of that. What you manage is:

  • Mailboxes — user mailboxes, shared mailboxes, resource mailboxes, public folders
  • Recipients — distribution groups, Microsoft 365 groups, mail contacts, mail users
  • Mail flow — connectors, transport rules, accepted domains, remote domains
  • Security policies — anti-spam, anti-malware, anti-phishing, Safe Attachments, Safe Links
  • Organisation settings — sharing policies, calendar publishing, OAuth authentication
  • Compliance features — litigation hold, eDiscovery hold, retention policies (via Purview), audit logging
  • Hybrid configuration — coexistence with on-premises Exchange (if applicable)

The Exchange Admin Center (EAC)

The primary management interface for Exchange Online is the Exchange Admin Center, accessed at admin.exchange.microsoft.com. Microsoft redesigned the EAC in 2020-2021 with a modern interface. The new EAC is the current standard; the legacy Classic EAC (which was accessible via a separate URL) is decommissioned.

Key navigation areas:

  • Recipients — mailboxes, groups, contacts, rooms and equipment, migration
  • Mail flow — rules, connectors, remote domains, accepted domains, message trace
  • Reports — mail flow reports, email activity, mailbox usage, security reports
  • Insights — mail flow insights, auto-forwarding report, non-delivery report insights
  • Settings — mail flow settings, organisation settings, user roles, notifications

Many Exchange Online administrative tasks still require Exchange Online PowerShell, particularly for bulk operations, reporting, and settings not exposed in the GUI. The current PowerShell module is the Exchange Online Management module (EXO V3), which uses modern authentication. The legacy basic authentication modules are decommissioned.

# Install the Exchange Online Management module
Install-Module -Name ExchangeOnlineManagement -Force

# Connect with modern authentication
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com

# Verify connection
Get-OrganizationConfig | Select-Object DisplayName, DefaultAuthenticationPolicy
Enter fullscreen mode Exit fullscreen mode

Section 2: Mailbox Types — Understanding What You Are Provisioning

User mailboxes

The standard mailbox type, associated with a licensed user account in Entra ID. When you assign a Microsoft 365 licence that includes Exchange Online (any M365 plan), a user mailbox is automatically provisioned.

Key user mailbox settings to configure:

Mailbox size quota: Default Exchange Online quotas vary by licence:

  • Exchange Online Plan 1 (included in most M365 plans): 50GB mailbox, 50GB archive
  • Exchange Online Plan 2 (included in E3 and above): 100GB mailbox, unlimited archive (when auto-expanding archiving is enabled)

Check individual mailbox quotas:

Get-Mailbox -Identity user@yourdomain.com | 
    Select-Object DisplayName, ProhibitSendQuota, ProhibitSendReceiveQuota, IssueWarningQuota
Enter fullscreen mode Exit fullscreen mode

Litigation hold: Places a mailbox on hold, preserving all content regardless of user deletion or retention policy expiry. Required for legal proceedings.

# Enable litigation hold with a duration (days)
Set-Mailbox -Identity user@yourdomain.com -LitigationHoldEnabled $true -LitigationHoldDuration 2555

# Enable indefinite litigation hold
Set-Mailbox -Identity user@yourdomain.com -LitigationHoldEnabled $true
Enter fullscreen mode Exit fullscreen mode

Archive mailbox: The online archive provides additional mailbox storage and is the correct solution for managing mailbox size growth over time — not increasing primary mailbox quotas indefinitely.

# Enable archive for a specific mailbox
Enable-Mailbox -Identity user@yourdomain.com -Archive

# Enable archive for all mailboxes without one
Get-Mailbox -Filter {ArchiveStatus -eq "None"} | Enable-Mailbox -Archive
Enter fullscreen mode Exit fullscreen mode

Auto-expanding archiving: For Exchange Online Plan 2 mailboxes, enable auto-expanding archiving to allow the archive to grow beyond the initial 100GB allocation:

# Enable auto-expanding archive for the organisation
Set-OrganizationConfig -AutoExpandingArchiveEnabled $true

# Or enable for a specific mailbox
Enable-Mailbox -Identity user@yourdomain.com -AutoExpandingArchive
Enter fullscreen mode Exit fullscreen mode

Shared mailboxes

Shared mailboxes are mailboxes that multiple users can access. They do not require a licence when under 50GB. They are used for:

  • Departmental email addresses (finance@, support@, hr@)
  • Functional addresses (info@, sales@, noreply@)
  • Converted mailboxes for departed employees (to preserve access to the mailbox content)

Provisioning a shared mailbox:

# Create a new shared mailbox
New-Mailbox -Shared -Name "Finance Team" -DisplayName "Finance Team" `
    -Alias "finance" -PrimarySmtpAddress "finance@yourdomain.com"

# Grant Full Access permission to a user
Add-MailboxPermission -Identity "finance@yourdomain.com" `
    -User "user@yourdomain.com" -AccessRights FullAccess -AutoMapping $true

# Grant Send As permission (user can send as the shared mailbox address)
Add-RecipientPermission -Identity "finance@yourdomain.com" `
    -Trustee "user@yourdomain.com" -AccessRights SendAs

# Grant Send on Behalf permission
Set-Mailbox -Identity "finance@yourdomain.com" `
    -GrantSendOnBehalfTo "user@yourdomain.com"
Enter fullscreen mode Exit fullscreen mode

The difference between Full Access, Send As, and Send on Behalf:

  • Full Access: The user can open the mailbox, read and manage all content, but the "From" address on sent mail still shows the user's address unless combined with Send As
  • Send As: The user can send email that appears to come from the shared mailbox address — recipients see only the shared mailbox address
  • Send on Behalf: The user can send email on behalf of the shared mailbox — recipients see "UserName on behalf of SharedMailbox" in the From field

For most departmental shared mailbox scenarios, Full Access + Send As is the appropriate combination.

Automapping: When AutoMapping $true is set (the default), users with Full Access to a shared mailbox see it automatically appear in their Outlook profile without any configuration. This is convenient but can cause performance issues if a user has Full Access to many shared mailboxes. Set AutoMapping $false for service accounts or helpdesk staff who manage many shared mailboxes.

Shared mailbox size: When a shared mailbox exceeds 50GB, it requires an Exchange Online Plan 2 licence. Monitor shared mailbox sizes proactively:

Get-Mailbox -RecipientTypeDetails SharedMailbox | 
    Get-MailboxStatistics | 
    Select-Object DisplayName, TotalItemSize, ItemCount |
    Where-Object { $_.TotalItemSize -gt 45GB } |
    Sort-Object TotalItemSize -Descending
Enter fullscreen mode Exit fullscreen mode

Resource mailboxes — rooms and equipment

Resource mailboxes represent physical resources that can be booked through calendar invitations: meeting rooms, conference facilities, projectors, vehicles, pool laptops.

Room mailboxes have built-in calendar booking intelligence — they can automatically accept or decline meeting requests based on availability, booking policies, and delegate settings.

Provisioning a room mailbox:

# Create a room mailbox
New-Mailbox -Room -Name "Boardroom Delhi" -DisplayName "Boardroom Delhi" `
    -Alias "boardroom-delhi" -PrimarySmtpAddress "boardroom-delhi@yourdomain.com" `
    -ResourceCapacity 20

# Configure auto-accept and booking policy
Set-CalendarProcessing -Identity "boardroom-delhi@yourdomain.com" `
    -AutomateProcessing AutoAccept `
    -AddOrganizerToSubject $true `
    -DeleteComments $false `
    -DeleteSubject $false `
    -MaximumDurationInMinutes 480 `
    -BookingWindowInDays 180 `
    -AllowConflicts $false
Enter fullscreen mode Exit fullscreen mode

Key CalendarProcessing settings:

Setting Purpose
AutomateProcessing AutoAccept Room automatically accepts available slots
MaximumDurationInMinutes Maximum meeting duration allowed
BookingWindowInDays How far in advance the room can be booked
AllowConflicts Whether overlapping bookings are permitted
AllBookInPolicy Users allowed to book without delegate approval
RequestOutOfPolicy Users who can book outside normal policy (require approval)
ResourceDelegates Users who manage booking requests and policy exceptions

Distribution groups and Microsoft 365 groups

Distribution groups (DGs) are the legacy email grouping mechanism — a list of recipients that receive email sent to the group address. They have no SharePoint site, no Teams channel, no shared calendar or notebook. Pure email distribution.

Microsoft 365 groups are the modern equivalent — they have a group email address, a SharePoint site, a shared mailbox, a Teams channel (if Teams-connected), a shared calendar, and a OneNote notebook. Creating a Teams team creates a Microsoft 365 group automatically.

When to use each:

  • Distribution group: external-facing mailing lists, large broadcast groups (company-wide announcements), situations where the group is purely for email and governance overhead of M365 groups is not justified
  • Microsoft 365 group: any collaboration scenario where the team needs shared files, chat, and a calendar alongside email

Converting a distribution group to a Microsoft 365 group:

Microsoft supports upgrading distribution groups to Microsoft 365 groups through the EAC or PowerShell. Not all DLs are eligible — DLs with external members, non-user members, or nested DLs may need remediation before upgrade.

# Check eligibility for upgrade
Get-DistributionGroup -Identity "team@yourdomain.com" | 
    Upgrade-DistributionGroup -WhatIf

# Perform the upgrade
Upgrade-DistributionGroup -DLIdentities "team@yourdomain.com"
Enter fullscreen mode Exit fullscreen mode

Dynamic distribution groups (DDGs) are distribution groups where membership is defined by a query (filter) rather than a static list. Members are calculated dynamically at the time of each email send:

# Create a DDG for all India employees
New-DynamicDistributionGroup -Name "All India Employees" `
    -RecipientFilter {RecipientType -eq 'UserMailbox' AND Office -eq 'India'}
Enter fullscreen mode Exit fullscreen mode

Section 3: Mail Flow — The Heart of Exchange Online Administration

Mail flow — how messages move through your Exchange Online environment, the rules that govern them, the connectors that route them, and the security controls that filter them — is the most operationally critical area of Exchange Online administration. It is also the area most likely to cause production incidents when misconfigured.

Accepted and remote domains

Accepted domains are the email domains that Exchange Online accepts mail for. Navigate to EAC → Mail flow → Accepted domains to view them.

Three types:

  • Authoritative: Exchange Online is the authoritative mail server for this domain. Mail for addresses in this domain that don't match a mailbox generates an NDR.
  • Internal relay: Exchange Online accepts mail for this domain and relays it to another system (e.g., hybrid coexistence with on-premises Exchange)
  • External relay: Exchange Online accepts mail and relays it to an external system

Remote domains define how Exchange Online handles email sent to specific external domains — particularly automatic replies and forwarding behaviour.

Critical remote domain configuration — disable auto-forwarding:

# Disable auto-forwarding to all external domains (the default remote domain)
Set-RemoteDomain -Identity "Default" -AutoForwardEnabled $false

# Verify the setting
Get-RemoteDomain | Select-Object DomainName, AutoForwardEnabled
Enter fullscreen mode Exit fullscreen mode

This single configuration change prevents the most common Business Email Compromise persistence technique — an attacker who compromises a mailbox sets up an auto-forward rule to their external address, which then continues to deliver mail even after the compromised password is reset. Disabling auto-forwarding to external domains at the transport level blocks this technique entirely.

Transport rules (mail flow rules)

Transport rules are the most powerful and most dangerous configuration in Exchange Online. They evaluate every message in transit against a set of conditions and apply actions — modifying headers, redirecting mail, adding disclaimers, blocking messages, applying sensitivity labels.

Transport rules evaluate in priority order. The first matching rule wins unless the rule action is configured to continue processing subsequent rules.

Essential transport rules every Exchange Online organisation should have:

Rule 1: Block external auto-forwarding (belt-and-suspenders)

New-TransportRule -Name "Block External Auto-Forward" `
    -SentToScope NotInOrganization `
    -MessageTypeMatches AutoForward `
    -RejectMessageReasonText "Auto-forwarding to external addresses is not permitted by policy." `
    -RejectMessageEnhancedStatusCode "5.7.1" `
    -Priority 0
Enter fullscreen mode Exit fullscreen mode

Rule 2: External sender warning

New-TransportRule -Name "External Email Warning" `
    -FromScope NotInOrganization `
    -PrependSubject "[EXTERNAL] " `
    -SetHeaderName "X-External-Sender" `
    -SetHeaderValue "True"
Enter fullscreen mode Exit fullscreen mode

For a visual banner instead of subject prefix (requires HTML disclaimer):

New-TransportRule -Name "External Sender Warning Banner" `
    -FromScope NotInOrganization `
    -ApplyHtmlDisclaimerLocation Prepend `
    -ApplyHtmlDisclaimerText '<div style="background-color:#fff3cd;border:1px solid #ffc107;padding:8px;margin-bottom:8px;font-family:Arial,sans-serif;font-size:13px"><strong>⚠ External Email:</strong> This email originated from outside your organisation. Do not click links or open attachments unless you recognise the sender and know the content is safe.</div>' `
    -ApplyHtmlDisclaimerFallbackAction Wrap
Enter fullscreen mode Exit fullscreen mode

Rule 3: Block specific file attachments

New-TransportRule -Name "Block Dangerous Attachments" `
    -AttachmentNameMatchesPatterns "*.exe","*.vbs","*.ps1","*.bat","*.cmd","*.js","*.msi","*.reg" `
    -RejectMessageReasonText "Attachments with this file type are not permitted for security reasons." `
    -RejectMessageEnhancedStatusCode "5.7.1"
Enter fullscreen mode Exit fullscreen mode

Rule 4: Encrypt sensitive outbound mail

# Apply OME encryption to messages containing sensitive keywords going external
New-TransportRule -Name "Encrypt Sensitive Outbound" `
    -SentToScope NotInOrganization `
    -SubjectOrBodyMatchesPatterns "CONFIDENTIAL","STRICTLY PRIVATE","PERSONAL AND CONFIDENTIAL" `
    -ApplyRightsProtectionTemplate "Encrypt"
Enter fullscreen mode Exit fullscreen mode

Rule 5: Bypass spam filtering for specific trusted senders

New-TransportRule -Name "Bypass Spam Filter - Trusted Partner" `
    -SenderDomainIs "trustedpartner.com" `
    -SetSCL -1
Enter fullscreen mode Exit fullscreen mode

Managing transport rule priority:

# View all rules with priority
Get-TransportRule | Select-Object Name, Priority, State | Sort-Object Priority

# Change rule priority
Set-TransportRule -Identity "Block External Auto-Forward" -Priority 0
Enter fullscreen mode Exit fullscreen mode

Connectors — routing mail to and from external systems

Connectors define how Exchange Online routes mail to specific destinations — typically for:

  • Hybrid coexistence (routing between Exchange Online and on-premises Exchange)
  • Third-party email gateways (routing through Mimecast, Proofpoint, Barracuda)
  • Application mail relay (SMTP relay from line-of-business applications, printers, copiers)

Types of connectors:

  • Inbound connector: Defines how Exchange Online receives mail from an external system
  • Outbound connector: Defines how Exchange Online routes mail to an external system or enforces routing

SMTP relay for applications (the copier/application scenario):

Many organisations need a relay path for applications, multi-function printers, or monitoring systems that send email. There are three approaches:

Option 1: Direct send (no connector required)
The application sends directly to Exchange Online via the MX record. No authentication required, but the From address must be a valid mailbox in your tenant.

Option 2: SMTP relay with connector (recommended for high volume)

# Create an inbound connector for IP-based SMTP relay
New-InboundConnector -Name "Application SMTP Relay" `
    -ConnectorType OnPremises `
    -SenderDomains "yourdomain.com" `
    -SenderIPAddresses "10.0.1.50","10.0.1.51" `
    -RequireTls $true `
    -RestrictDomainsToCertificate $false `
    -CloudServicesMailEnabled $false
Enter fullscreen mode Exit fullscreen mode

Option 3: SMTP client submission (port 587, authenticated)
Use an Exchange Online mailbox with SMTP AUTH enabled as the relay account. Enable SMTP AUTH specifically for this mailbox (SMTP AUTH is globally disabled by default for security — enable only where needed):

# Enable SMTP AUTH for a specific relay mailbox
Set-CasMailbox -Identity "smtp-relay@yourdomain.com" -SmtpClientAuthenticationDisabled $false

# Verify
Get-CasMailbox -Identity "smtp-relay@yourdomain.com" | Select-Object SmtpClientAuthenticationDisabled
Enter fullscreen mode Exit fullscreen mode

Message trace — your most powerful mail flow diagnostic tool

When a user reports that an email did not arrive, or that an email they sent was not delivered, Message Trace is the first diagnostic tool to use.

Via EAC: Navigate to Mail flow → Message trace → Start a trace. Provides a user-friendly interface for recent messages (last 10 days at full detail, last 90 days at summary).

Via PowerShell (for automation or bulk analysis):

# Trace a specific message
Get-MessageTrace -SenderAddress sender@external.com `
    -RecipientAddress recipient@yourdomain.com `
    -StartDate (Get-Date).AddDays(-3) `
    -EndDate (Get-Date) |
    Select-Object Received, SenderAddress, RecipientAddress, Subject, Status, ToIP, FromIP

# Get detailed trace events for a specific message
Get-MessageTraceDetail -MessageTraceId "message-trace-guid" -RecipientAddress recipient@yourdomain.com
Enter fullscreen mode Exit fullscreen mode

Message trace status values and what they mean:

Status Meaning
Delivered Message delivered to recipient's mailbox
GettingStatus Trace still in progress
Failed Delivery failed — check EventDescription for NDR details
Pending Message queued for delivery
Expanded Message expanded to DL/group members
Quarantined Message held in quarantine — anti-spam or anti-malware
FilteredAsSpam Message classified as spam and junked/quarantined
Redirected Message redirected by a transport rule

Section 4: Email Security Configuration

Anti-spam policies

Exchange Online Protection (EOP) includes anti-spam filtering for all Exchange Online mailboxes. The default policy provides baseline protection. Create custom policies for specific user groups with different tolerance levels.

Understanding spam confidence levels (SCL):

  • SCL -1: Skip spam filtering (whitelist)
  • SCL 0-4: Not spam
  • SCL 5-6: Spam
  • SCL 7-9: High confidence spam

Configuring the default anti-spam policy:

# View the default inbound anti-spam policy
Get-HostedContentFilterPolicy -Identity "Default"

# Configure spam and high confidence spam actions
Set-HostedContentFilterPolicy -Identity "Default" `
    -SpamAction MoveToJmf `
    -HighConfidenceSpamAction Quarantine `
    -PhishSpamAction Quarantine `
    -HighConfidencePhishAction Quarantine `
    -BulkThreshold 6 `
    -MarkAsSpamBulkMail On `
    -EnableEndUserSpamNotifications $true `
    -EndUserSpamNotificationFrequency 3
Enter fullscreen mode Exit fullscreen mode

Anti-spam allow and block lists:

The most abused feature in anti-spam configuration is the allow list — IT administrators add senders or domains to the allow list to fix a spam filtering false positive and then never remove them. Allow list entries bypass spam filtering entirely, meaning a spoofed email from an allow-listed domain will reach the inbox regardless of other security controls.

Audit your allow lists regularly:

Get-HostedContentFilterPolicy | Select-Object Name, AllowedSenders, AllowedSenderDomains |
    Where-Object { $_.AllowedSenders -or $_.AllowedSenderDomains }
Enter fullscreen mode Exit fullscreen mode

The correct approach for legitimate senders being incorrectly filtered is to use transport rules to set SCL -1 based on specific verified conditions (IP address + sender domain + authentication pass) — not blanket domain allow-listing.

Anti-phishing policies

Anti-phishing policies in Exchange Online Protection protect against spoofing, impersonation, and other phishing techniques. If you have Defender for Office 365 (Plan 1 or Plan 2), you have additional anti-phishing capabilities including mailbox intelligence and priority account protection.

Configuring anti-phishing for Defender for Office 365:

# Create a strict anti-phishing policy for executives
New-AntiPhishPolicy -Name "Executive Protection" `
    -Enabled $true `
    -EnableTargetedUserProtection $true `
    -EnableOrganizationDomainsProtection $true `
    -EnableMailboxIntelligence $true `
    -EnableMailboxIntelligenceProtection $true `
    -TargetedUserProtectionAction Quarantine `
    -TargetedDomainProtectionAction Quarantine `
    -MailboxIntelligenceProtectionAction MoveToJmf `
    -EnableSpoofIntelligence $true `
    -AuthenticationFailAction MoveToJmf `
    -EnableFirstContactSafetyTips $true `
    -EnableSimilarUsersSafetyTips $true `
    -EnableSimilarDomainsSafetyTips $true `
    -EnableUnusualCharactersSafetyTips $true

# Add protected users (executives, finance, HR)
Set-AntiPhishPolicy -Identity "Executive Protection" `
    -TargetedUsersToProtect @(
        "CEO;ceo@yourdomain.com",
        "CFO;cfo@yourdomain.com",
        "CISO;ciso@yourdomain.com"
    )
Enter fullscreen mode Exit fullscreen mode

DMARC, DKIM, and SPF — the email authentication trio

Email authentication is the foundational control against domain spoofing. All three standards must be configured and working together for effective protection.

SPF — what it does: Publishes a DNS TXT record specifying which mail servers are authorised to send email from your domain. Receiving servers check this record when they receive email claiming to be from your domain.

Your SPF record for a Microsoft 365-only sending environment:

TXT record for yourdomain.com:
v=spf1 include:spf.protection.outlook.com -all
Enter fullscreen mode Exit fullscreen mode

If you send from additional services (Salesforce, Mailchimp, Zendesk), include their SPF mechanisms:

v=spf1 include:spf.protection.outlook.com include:_spf.salesforce.com include:servers.mcsv.net -all
Enter fullscreen mode Exit fullscreen mode

SPF limitations: SPF only checks the envelope sender (the return-path address used in the SMTP transaction), not the From header address that users see. This means SPF alone does not prevent display name spoofing or header-from spoofing.

DKIM — what it does: Adds a cryptographic signature to outgoing email. The signature is verified against a public key published in DNS. If the signature validates, the message has not been altered in transit and was sent by a server authorised to use the signing domain.

Enable DKIM for your domain:

# Check DKIM configuration
Get-DkimSigningConfig -Identity yourdomain.com

# Enable DKIM (after DNS CNAME records are published)
Set-DkimSigningConfig -Identity yourdomain.com -Enabled $true

# For new domains, you may need to create the config first
New-DkimSigningConfig -DomainName yourdomain.com -Enabled $false

# Get the CNAME records to publish in DNS
Get-DkimSigningConfig -Identity yourdomain.com | 
    Select-Object Selector1CNAME, Selector2CNAME
Enter fullscreen mode Exit fullscreen mode

Publish the two CNAME records provided in your DNS zone before enabling DKIM.

DMARC — what it does: Builds on SPF and DKIM to tell receiving mail servers what to do when messages fail authentication — quarantine them or reject them — and requests reporting back to you on authentication results.

DMARC requires SPF and DKIM to be configured first. Start with p=none (monitoring), then progress to p=quarantine, then p=reject as you gain confidence in your email sending sources.

Initial DMARC record (monitoring mode):
_dmarc.yourdomain.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; ruf=mailto:dmarc@yourdomain.com; pct=100"

Quarantine mode (after validating all sending sources):
_dmarc.yourdomain.com TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100; sp=quarantine"

Reject mode (final target):
_dmarc.yourdomain.com TXT "v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; pct=100; sp=reject"
Enter fullscreen mode Exit fullscreen mode

DMARC reporting: Use a DMARC analysis tool (dmarcian, EasyDMARC, Postmark DMARC) to parse DMARC aggregate reports (RUA). These reports show every server sending mail using your domain name and whether they pass SPF and DKIM — the essential data for safely moving from p=none to p=reject.

The typical progression timeline:

  • Week 1-2: Deploy SPF and DKIM. Enable DMARC p=none.
  • Weeks 3-8: Review DMARC reports. Identify all legitimate sending sources. Ensure all legitimate sources pass SPF or DKIM.
  • Week 9: Move to p=quarantine; pct=10 (quarantine 10% of failing mail to test impact)
  • Weeks 10-14: Increase quarantine percentage gradually — 25%, 50%, 100%
  • Week 15+: Move to p=reject when you are confident all legitimate mail authenticates

Section 5: Hybrid Coexistence — Exchange On-Premises + Exchange Online

Many organisations operate in a hybrid Exchange environment — some mailboxes in Exchange Online, some still on-premises. This is typically a migration transition state, though some organisations maintain hybrid indefinitely for specific reasons (data residency, latency-sensitive applications, compliance archiving).

Hybrid prerequisites

Exchange versions supported for hybrid: Exchange 2013 CU12+, Exchange 2016, Exchange 2019. Exchange 2010 was supported until October 2020.

The Hybrid Configuration Wizard (HCW): Microsoft provides the HCW as the supported tool for configuring Exchange hybrid. It automates the complex configuration of:

  • Hybrid connectors (inbound and outbound)
  • Organisation relationships for free/busy sharing
  • OAuth authentication between on-premises and Exchange Online
  • MRS Proxy configuration for mailbox migration
  • Edge Transport or HCW-recommended connector settings

Download the HCW from: EAC → Hybrid → Configure

What hybrid coexistence enables

Shared namespace: Users in both on-premises and Exchange Online share the same email domain. A user at user1@yourdomain.com may be on-premises; user2@yourdomain.com may be in Exchange Online. Mail between them is routed internally.

Free/busy sharing: On-premises and Exchange Online users can see each other's calendar availability when scheduling meetings.

Unified GAL: The Global Address List is synchronised between on-premises and Exchange Online via Entra Connect (Azure AD Connect), so both populations see each other as recipients.

Mailbox migration: MRS (Mailbox Replication Service) Proxy enables online mailbox moves — migrations from on-premises to Exchange Online without taking the mailbox offline.

Mailbox migrations — moving from on-premises to Exchange Online 

# Create a migration endpoint for Exchange on-premises
New-MigrationEndpoint -ExchangeRemoteMove -Name "OnPremExchange" `
    -RemoteServer mail.yourdomain.com `
    -Credentials (Get-Credential)

# Create a migration batch
New-MigrationBatch -Name "Wave1-Finance" `
    -SourceEndpoint "OnPremExchange" `
    -CSVData ([System.IO.File]::ReadAllBytes("C:\Migrations\wave1.csv")) `
    -TargetDeliveryDomain "yourtenant.mail.onmicrosoft.com" `
    -AutoStart

# Monitor migration batch progress
Get-MigrationBatch -Identity "Wave1-Finance" | Select-Object Status, TotalCount, SyncedCount, FailedCount

# Get per-user migration statistics
Get-MigrationUser -BatchId "Wave1-Finance" | Get-MigrationUserStatistics | 
    Select-Object Identity, Status, SyncedItemCount, SkippedItemCount, EstimatedTransferSize
Enter fullscreen mode Exit fullscreen mode

Section 6: Quarantine Management

Quarantine holds messages that match anti-spam, anti-malware, anti-phishing, or transport rule policies. Understanding quarantine is essential for both security management and helpdesk operations.

Quarantine policies

Quarantine policies define what end users can do with their quarantined messages — whether they can view, release, or request release. Navigate to EAC → Policies and rules → Threat policies → Quarantine policies.

Microsoft provides three built-in quarantine policy presets:

  • AdminOnlyAccessPolicy: Users cannot see or manage their quarantined messages. Only administrators can release.
  • DefaultFullAccessPolicy: Users can view and release their own quarantined messages without admin approval.
  • DefaultFullAccessWithNotificationPolicy: Same as above with end-user spam notification emails.

For phishing quarantine, AdminOnlyAccessPolicy is appropriate — phishing messages should require admin review before release. For spam quarantine, DefaultFullAccessWithNotificationPolicy reduces helpdesk volume by enabling self-service.

Managing quarantine via PowerShell 

# View all quarantined messages
Get-QuarantineMessage | Select-Object SenderAddress, RecipientAddress, Subject, QuarantineTypes, ReceivedTime

# View messages quarantined as phishing
Get-QuarantineMessage -QuarantineTypes Phish | 
    Select-Object SenderAddress, Subject, ReceivedTime

# Release a specific message
Release-QuarantineMessage -Identity "message-id" -User recipient@yourdomain.com

# Release all false-positive spam for a specific sender (use with caution)
Get-QuarantineMessage -SenderAddress legitimate@partner.com -QuarantineTypes Spam | 
    Release-QuarantineMessage -ReleaseToAll

# Delete a quarantined message
Delete-QuarantineMessage -Identity "message-id"
Enter fullscreen mode Exit fullscreen mode

Section 7: Mailbox Auditing and Compliance

Enabling and verifying mailbox auditing

Exchange Online mailbox auditing records who accessed a mailbox, what they did, and when. Essential for forensic investigation of email-related security incidents.

# Verify organisation-wide audit is enabled
Get-OrganizationConfig | Select-Object AuditDisabled

# Enable audit if disabled
Set-OrganizationConfig -AuditDisabled $false

# Check audit configuration for a specific mailbox
Get-Mailbox -Identity user@yourdomain.com | 
    Select-Object AuditEnabled, AuditOwner, AuditDelegate, AuditAdmin, AuditLogAgeLimit

# Configure audit actions explicitly for a mailbox
Set-Mailbox -Identity user@yourdomain.com `
    -AuditEnabled $true `
    -AuditOwner "MailItemsAccessed","MessageSend","SoftDelete","HardDelete","MoveToDeletedItems","FolderBind" `
    -AuditDelegate "MailItemsAccessed","MessageSend","SoftDelete","HardDelete","MoveToDeletedItems","FolderBind","SendAs","SendOnBehalf" `
    -AuditAdmin "MailItemsAccessed","MessageSend","SoftDelete","HardDelete","MoveToDeletedItems","Copy","FolderBind"
Enter fullscreen mode Exit fullscreen mode

MailItemsAccessed is the critical audit event for Business Email Compromise investigation. It records every time mail items are accessed — not just when they are deleted or moved. This audit action is available for E5 licences (Advanced Audit) and enables forensic reconstruction of exactly what an attacker read during a mailbox compromise.

Searching the audit log for email events 

# Connect to Security and Compliance PowerShell
Connect-IPPSSession -UserPrincipalName admin@yourdomain.com

# Search unified audit log for mailbox access events
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) `
    -EndDate (Get-Date) `
    -RecordType ExchangeItem `
    -UserIds compromised.user@yourdomain.com `
    -Operations "MailItemsAccessed" `
    -ResultSize 5000 |
    Select-Object CreationDate, UserIds, Operations, AuditData |
    Export-Csv -Path "MailboxAudit.csv" -NoTypeInformation

# Search for external forwarding rule creation
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-90) `
    -EndDate (Get-Date) `
    -RecordType ExchangeItem `
    -Operations "New-InboxRule","Set-InboxRule" `
    -ResultSize 5000 |
    Where-Object { $_.AuditData -match "ForwardTo|RedirectTo|ForwardAsAttachmentTo" }
Enter fullscreen mode Exit fullscreen mode

Section 8: Reporting and Monitoring

Mail flow reports

The Exchange Admin Center provides built-in reporting that is essential for operational monitoring:

Navigate to EAC → Reports → Mail flow:

  • Inbound messages report: Volume of inbound messages over time, broken down by verdict (clean, spam, malware, phishing)
  • Outbound messages report: Volume of outbound messages, NDR trends
  • Non-delivery report (NDR) insights: Common NDR codes and the senders/recipients experiencing them — essential for identifying mail flow issues before users report them
  • Mail flow map: Visual representation of your mail flow — where mail enters and exits your environment

Key PowerShell reporting queries for operations 

# Mailbox size report — identify mailboxes approaching quota
Get-Mailbox -ResultSize Unlimited | 
    Get-MailboxStatistics | 
    Select-Object DisplayName, 
        @{N='SizeGB';E={[math]::Round(($_.TotalItemSize.ToString().Split('(')[1].Split(' ')[0].Replace(',','') / 1GB),2)}},
        ItemCount, LastLogonTime |
    Sort-Object SizeGB -Descending |
    Export-Csv -Path "MailboxSizes.csv" -NoTypeInformation

# Find mailboxes that have never been logged into (possible orphaned accounts)
Get-Mailbox -ResultSize Unlimited | 
    Get-MailboxStatistics | 
    Where-Object { $_.LastLogonTime -eq $null } |
    Select-Object DisplayName, MailboxTypeDetail, WhenCreated

# Report all external forwarding rules configured by users
Get-Mailbox -ResultSize Unlimited | 
    ForEach-Object {
        Get-InboxRule -Mailbox $_.Identity | 
        Where-Object { $_.ForwardTo -or $_.RedirectTo -or $_.ForwardAsAttachmentTo }
    } | 
    Select-Object MailboxOwnerID, Name, ForwardTo, RedirectTo, Enabled |
    Export-Csv -Path "ExternalForwardingRules.csv" -NoTypeInformation

# Distribution group membership report
Get-DistributionGroup -ResultSize Unlimited | 
    ForEach-Object {
        $members = Get-DistributionGroupMember -Identity $_.Identity -ResultSize Unlimited
        [PSCustomObject]@{
            GroupName = $_.DisplayName
            Email = $_.PrimarySmtpAddress
            MemberCount = $members.Count
            Members = ($members | Select-Object -ExpandProperty PrimarySmtpAddress) -join ";"
        }
    } | Export-Csv -Path "DGMembership.csv" -NoTypeInformation
Enter fullscreen mode Exit fullscreen mode

Section 9: Exchange Online Best Practices Checklist

After covering all the administrative domains above, here is the operational best practices checklist that every Exchange Online administrator should work through:

Mail flow security:

  • ☐ Auto-forwarding to external domains disabled (Remote Domain + Transport Rule)
  • ☐ SPF records published for all sending domains with -all (hard fail)
  • ☐ DKIM enabled for all domains
  • ☐ DMARC at p=reject for all domains
  • ☐ External email warning banner/prefix on all inbound external mail
  • ☐ Dangerous attachment types blocked via transport rule

Anti-spam and anti-phishing:

  • ☐ High confidence spam and phishing set to Quarantine (not Junk folder)
  • ☐ C-suite and finance team set as protected users in anti-phishing policy
  • ☐ Spoof intelligence enabled and reviewed
  • ☐ Allow lists audited and minimised
  • ☐ Quarantine notification emails configured for end-user self-service (spam only)

Mailbox governance:

  • ☐ Mailbox auditing enabled organisation-wide (AuditDisabled = False)
  • ☐ MailItemsAccessed audit action enabled for sensitive/executive mailboxes (E5 required)
  • ☐ Shared mailbox permissions audited and documented
  • ☐ Shared mailboxes over 45GB licenced appropriately
  • ☐ Resource mailbox auto-accept and booking policy configured
  • ☐ Archive mailboxes enabled for users with growing mailbox sizes
  • ☐ Auto-expanding archive enabled for Exchange Online Plan 2 users
  • ☐ External forwarding rules report run and reviewed monthly

Compliance:

  • ☐ Unified Audit Log retention aligned to compliance requirements
  • ☐ Litigation hold configured for legally active individuals
  • ☐ Retention policies applied through Microsoft Purview (not legacy MRM)
  • ☐ eDiscovery case management process documented

Authentication:

  • ☐ Modern authentication enabled and basic authentication disabled
  • ☐ SMTP AUTH disabled globally, enabled only for specific relay accounts
  • ☐ Legacy authentication blocked via Conditional Access

Conclusion: Exchange Online Mastery Is an Operational Practice

Exchange Online is not a platform you configure once and walk away from. Mail flow threats evolve. DMARC policies require progression. Shared mailbox permissions accumulate. Forwarding rules appear. Quarantine requires regular attention. Audit logs require periodic review.

The IT managers who manage Exchange Online well are the ones who treat it as an operational practice — regular mailbox audits, monthly mail flow report reviews, quarterly forwarding rule scans, annual DMARC policy assessments, and continuous refinement of transport rules as new threat patterns emerge.

The platform is powerful, the tooling is comprehensive, and the PowerShell module is exceptionally capable. The gap between a well-managed Exchange Online environment and a poorly managed one is not technical knowledge — it is operational discipline: the discipline to run the reports, review the findings, act on the anomalies, and document the decisions.

Build that practice. Your mail platform will repay it.

Suvankar Chakraborty is a Principal Engineer with 15+ years of experience in Identity & Access Management, Microsoft 365, Intune/Endpoint Management, and IT Operations. Connect with him on LinkedIn for more technical content on IAM, Zero Trust, and enterprise IT operations.

Read next:

  • M365 Tenant Hardening — A Security Checklist for IT Managers
  • Microsoft 365 Licensing Explained — E3 vs E5 vs Business Premium
  • SharePoint Permissions — The Audit That Will Surprise You
  • Teams Governance — Why Most Enterprises Get It Wrong

Top comments (0)