Exchange Online Administration: Complete Practical Course — Matching the Exchange Admin Center & MS-203 Certification Modules
The guide is structured around the actual EAC Home dashboard — including the Training & Guides panel, Mail Flow widgets (auto-forwarded messages, inbound message counts and TLS breakdowns), Mailboxes quick-action panel, Migration batch status, and the Communication Compliance panel — all explored in depth below.
🗺️ Course Module Map
This guide follows the exact left-navigation order of the Exchange Admin Center. Complete each module in sequence for the strongest learning outcome and exam readiness.
Exchange Admin Center Overview
Navigating the EAC dashboard, cards, dark mode, and the Training & Guides panel
Recipients
Mailboxes, Groups, Resources, and Contacts — creation, management, and PowerShell
Mail Flow
Connectors, Transport Rules, Accepted Domains, Remote Domains, Message Trace
Roles (RBAC)
Admin role groups, permissions, delegated administration, and audit logging
Migration
Cutover, Staged, IMAP, Hybrid migrations — batch management and monitoring
Mobile Device Access
ActiveSync policies, device access rules, quarantine, and remote wipe
Reports & Insights
Mail flow reports, spam/malware reports, auto-forward and inbound message analytics
Public Folders
Public folder mailboxes, hierarchy, permissions, and migration paths
Organization
Sharing policies, organization relationships, address book policies, OABs
Settings
User settings, MailTips, message size limits, OWA policies, protocol controls
Troubleshoot
Message Trace deep-dive, Queue Viewer, Remote Connectivity Analyzer, Audit Log
MS-203 Certification Alignment
Exam domains, skill weightings, scenario tips, and certification pathway
📊 Module 1: Exchange Admin Center Overview
The Exchange Admin Center (EAC) is the web-based management console for Exchange Online, accessible at admin.exchange.microsoft.com. It provides a modern, card-based Home dashboard that gives real-time operational visibility across your messaging environment.
Home Dashboard Cards
The EAC Home Dashboard displays live operational cards. The default card layout includes:
| Dashboard Card | What It Shows | Where to Go Deeper |
|---|---|---|
| Training & Guides | Links to the Exchange admin center video tutorial and EAC documentation on Microsoft Learn | Microsoft Learn / EAC Docs |
| Mail Flow — Auto-Forwarded Messages | Count of messages automatically forwarded out of the org (last 7 days). A value of 0 is the desired secure state. | Mail Flow → Rules → Reports |
| Mailboxes | Quick-action links: Manage email forwarding, Add a shared mailbox, Hide from address list, Edit a mailbox | Recipients → Mailboxes |
| Mail Flow — Inbound Messages | Count of inbound messages with TLS version breakdown (TLS 1.3, TLS 1.2, NoTLS) and a View report link | Reports → Mail Flow |
| Exchange — Latest 5 Batches | Status of the 5 most recent migration batches. Shows “No data available” when no migrations are in progress. | Migration |
| Communication Compliance | Promote safe communications — covers DLP, journaling, and ML-based policy enforcement | Microsoft Purview Compliance Portal |
💡 Customising the Dashboard
The EAC Home supports additional cards beyond the defaults. Click + Add card (6 more available) in the top-right corner to pin additional operational views. Toggle Dark mode from the same area. Click What’s new? to see the latest EAC feature updates from Microsoft — this is especially useful for keeping up with changes that appear on the MS-203 exam.
EAC Left Navigation — Complete Menu Structure
👤 Recipients
📧 Mail Flow
🔑 Roles
🔄 Migration
📱 Mobile
📊 Reports
💡 Insights
📁 Public Folders
🏢 Organization
⚙️ Settings
🔧 Troubleshoot
🔗 Other Features
🌐 Microsoft 365 Admin Center
⚠️ EAC vs Microsoft 365 Admin Center
Some Exchange Online settings are managed from the Microsoft 365 Admin Center (admin.microsoft.com) rather than the EAC — particularly user creation, licensing, and global tenant settings. The EAC link at the bottom of the left navigation is a shortcut to jump between the two portals. Always use the EAC for messaging-specific configuration.
👤 Module 2: Recipients
The Recipients section is the core of Exchange Online object management. It contains four sub-sections: Mailboxes, Groups, Resources, and Contacts.
2.1 Mailboxes
Mailboxes are the primary recipient object in Exchange Online. Each licensed Microsoft 365 user receives a user mailbox automatically. The EAC Mailbox quick-action panel on the dashboard exposes the most common mailbox administration tasks for fast access.
| Mailbox Type | Description | License Required |
|---|---|---|
| User Mailbox | Standard mailbox assigned to a licensed M365 user | Yes — Exchange Online Plan 1/2 or M365 Business/Enterprise |
| Shared Mailbox | Mailbox shared by multiple users; no per-user license needed (up to 50 GB) | No (up to 50 GB); Exchange Online Plan 2 for archive above 50 GB |
| Room Mailbox | Represents a physical meeting room; used for calendar-based room booking | No — free resource account |
| Equipment Mailbox | Represents schedulable equipment (projector, company vehicle, AV equipment) | No — free resource account |
| Linked Mailbox | Mailbox linked to an on-premises Active Directory account in a Hybrid deployment | Exchange Online license required |
Create a Shared Mailbox & Grant Permissions
Add a shared mailbox then grant Full Access and Send As to a delegate — directly matching the EAC quick-action “Add a shared mailbox”.
Connect-ExchangeOnline # Create shared mailbox New-Mailbox -Shared -Name "IT Support" -DisplayName "IT Support" -Alias "itsupport" -PrimarySmtpAddress "itsupport@contoso.com" # Grant Full Access (auto-mapping adds it to Outlook automatically) Add-MailboxPermission -Identity "itsupport@contoso.com" -User "user@contoso.com" -AccessRights FullAccess -InheritanceType All -AutoMapping $true # Grant Send As Add-RecipientPermission -Identity "itsupport@contoso.com" -Trustee "user@contoso.com" -AccessRights SendAs -Confirm:$false # Verify permissions Get-MailboxPermission -Identity "itsupport@contoso.com" | Where-Object {$_.IsInherited -eq $false}
Manage Email Forwarding
As shown directly on the EAC dashboard’s Mailbox quick-action panel, Manage email forwarding is one of the most frequently performed tasks. Forwarding can be set to keep a copy in the original mailbox or forward-only.
Set Mailbox Forwarding & Audit All Forwarding
Configure SMTP forwarding for a user and report on all mailboxes with forwarding enabled organisation-wide.
Connect-ExchangeOnline # Set forwarding — keep a copy in the original mailbox Set-Mailbox -Identity user@contoso.com -ForwardingSmtpAddress external@partner.com -DeliverToMailboxAndForward $true # Forward-only (no copy retained in source mailbox) Set-Mailbox -Identity user@contoso.com -ForwardingSmtpAddress external@partner.com -DeliverToMailboxAndForward $false # Audit ALL mailboxes with forwarding configured org-wide Get-Mailbox -ResultSize Unlimited | Where-Object {$_.ForwardingSmtpAddress -ne $null -or $_.ForwardingAddress -ne $null} | Select-Object DisplayName,PrimarySmtpAddress,ForwardingSmtpAddress,ForwardingAddress,DeliverToMailboxAndForward | Export-Csv -Path "ForwardingAudit.csv" -NoTypeInformation
⚠️ Auto-Forward Monitoring via EAC Dashboard
The EAC Home dashboard card “Mail Flow — Auto-Forwarded Messages” shows a 7-day rolling count of messages automatically forwarded outside the organisation. A count of 0 is the desired secure state. An unexpected spike may indicate a compromised account with inbox rules set up for data exfiltration. Complement this with a transport rule that blocks external auto-forwarding — covered in Module 3.
2.2 Groups
| Group Type | Use Case | Mail-Enabled | Managed Via |
|---|---|---|---|
| Microsoft 365 Group | Collaboration group with a shared inbox, Teams, SharePoint, and Planner workspace | Yes | M365 Admin Center / EAC |
| Distribution Group | Sends email to all members; no collaboration workspace | Yes | EAC / PowerShell |
| Mail-Enabled Security Group | Controls resource access AND distributes email to members | Yes | EAC / PowerShell |
| Dynamic Distribution Group | Membership auto-calculated by LDAP filter or attribute conditions | Yes | EAC / PowerShell |
Create a Dynamic Distribution Group
Dynamically target all users in a department — membership is always current without manual updates.
Connect-ExchangeOnline # Create Dynamic Distribution Group scoped to Sales department New-DynamicDistributionGroup -Name "All Sales" -Alias "AllSales" -PrimarySmtpAddress "allsales@contoso.com" -IncludedRecipients MailboxUsers -ConditionalDepartment "Sales" # Preview membership before the first send $ddg = Get-DynamicDistributionGroup "All Sales" Get-Recipient -RecipientPreviewFilter $ddg.RecipientFilter | Select-Object DisplayName,PrimarySmtpAddress,Department
2.3 Resources — Room & Equipment Mailboxes
Resource mailboxes enable automated room and equipment booking through Exchange Online’s calendar processing engine. They can auto-accept or auto-decline requests based on availability and policy.
Create a Room Mailbox & Configure Auto-Accept
Set up a meeting room that automatically accepts bookings when available and rejects conflicts.
Connect-ExchangeOnline # Create room mailbox New-Mailbox -Room -Name "Boardroom A" -DisplayName "Boardroom A" -Alias "boardrooma" -PrimarySmtpAddress "boardrooma@contoso.com" # Configure calendar processing — auto-accept, 8hr max, capacity 20 Set-CalendarProcessing -Identity "boardrooma@contoso.com" -AutomateProcessing AutoAccept -AddOrganizerToSubject $true -DeleteComments $false -MaximumDurationInMinutes 480 -AllowConflicts $false Set-Mailbox -Identity "boardrooma@contoso.com" -ResourceCapacity 20 # Verify calendar processing settings Get-CalendarProcessing -Identity "boardrooma@contoso.com" | Select-Object AutomateProcessing,MaximumDurationInMinutes,AllowConflicts
📧 Module 3: Mail Flow
Mail Flow is the most operationally critical section of Exchange Online. It governs how messages enter, transit, and exit your organisation. The EAC Mail Flow section contains Connectors, Rules, Accepted Domains, Remote Domains, and Message Trace.
3.1 Accepted Domains
Accepted domains define which SMTP address spaces Exchange Online will receive mail for. Getting this wrong causes mail flow failures. There are three domain types:
| Domain Type | Description | When to Use |
|---|---|---|
| Authoritative | Exchange Online is the final destination — no fallback routing | Your primary and all alias domains where all mailboxes are in Exchange Online |
| Internal Relay | Accepts mail and routes to another system if no mailbox match is found | Hybrid coexistence — some mailboxes still on-premises |
| External Relay | Accepts mail and forwards to an external SMTP server unconditionally | Third-party downstream mail systems or subsidiary mail servers |
3.2 Connectors
Connectors define trusted mail flow paths between Exchange Online and external systems. There are two directions: Inbound (traffic arriving into Exchange Online from a partner or on-premises server) and Outbound (traffic leaving Exchange Online to a partner or relay).
💡 Key Connector Use Cases
- Hybrid mail flow with an Exchange Server on-premises (created automatically by the Hybrid Configuration Wizard)
- Routing all outbound mail through a third-party email security gateway (Mimecast, Proofpoint, etc.)
- Enforcing mutual TLS (MTLS) for specific partner domains
- Authenticating inbound messages from a trusted relay server by IP address to prevent 550 5.7.68 rejections
Audit All Connectors & Verify TLS Enforcement
List every inbound and outbound connector and confirm TLS settings are correctly configured.
Connect-ExchangeOnline # List all inbound connectors Get-InboundConnector | Format-List Name,Enabled,SenderIPAddresses,RequireTls,TlsSenderCertificateName,ConnectorType,ConnectorSource # List all outbound connectors Get-OutboundConnector | Format-List Name,Enabled,SmartHosts,TlsSettings,UseMxRecord,RecipientDomains,ConnectorType
3.3 Mail Flow Rules (Transport Rules)
Transport rules inspect message properties in real time during mail flow and apply actions automatically. They are the primary enforcement mechanism for organisational messaging policies.
| Common Rule Scenario | Condition | Action |
|---|---|---|
| Block external auto-forwarding | Message type = Auto-Forward + Sent to scope = External | Reject with policy NDR |
| Add HTML disclaimer to outbound | Sender is internal + Recipient is external | Append disclaimer |
| Encrypt messages with sensitive data | Message contains sensitive info type (SSN, credit card, passport) | Apply RMS / OME encryption template |
| Reduce SCL for trusted relay | Message header: Resent-From contains @sourcedomain.com | Set SCL = 1 |
| Prevent reply-all storms on large groups | Recipient count exceeds 5000 | Reject with guidance message |
| Route sensitive mail via specific connector | Sender is member of Finance group | Redirect to partner connector (SmartHost) |
Block External Auto-Forwarding — Critical Security Rule
Prevent all users from auto-forwarding email to external addresses. This directly addresses the auto-forwarded message count shown on the EAC dashboard.
Connect-ExchangeOnline # Block external auto-forwarding — set Priority 0 (highest) New-TransportRule -Name "Block External Auto-Forward" -MessageTypeMatches AutoForward -SentToScope NotInOrganization -RejectMessageReasonText "External email auto-forwarding is not permitted by company policy. Contact IT support if you require mail routing assistance." -Enabled $true -Priority 0 # Verify the rule is active Get-TransportRule "Block External Auto-Forward" | Select-Object Name,State,Priority,Mode
3.4 Message Trace
Message Trace is the most powerful day-to-day troubleshooting tool in Exchange Online. It tracks the complete journey of any message — delivery hops, filtering decisions, quarantine actions, and failure reasons.
Run a Message Trace & Get Detailed Results
Trace messages for a specific sender over the past 48 hours and drill into the per-message detail events.
Connect-ExchangeOnline # Message trace — last 48 hours by sender Get-MessageTrace -SenderAddress sender@contoso.com -StartDate (Get-Date).AddHours(-48) -EndDate (Get-Date) | Select-Object Received,SenderAddress,RecipientAddress,Subject,Status,ToIP,FromIP | Format-Table -AutoSize # Drill into hop-by-hop detail for a specific message Get-MessageTraceDetail -MessageTraceId "<MessageTraceId>" -RecipientAddress recipient@contoso.com | Select-Object Date,Event,Action,Detail | Format-Table -AutoSize
💡 Message Trace Retention
Standard message trace (via the EAC UI or PowerShell Get-MessageTrace) covers the last 10 days. For messages older than 10 days (up to 90 days), use the Extended Message Trace feature in the EAC under Mail Flow → Message Trace → Start a trace. Extended traces are delivered as reports asynchronously.
🔑 Module 4: Roles — Role-Based Access Control (RBAC)
Exchange Online uses Role-Based Access Control to define what administrators and users can do across the messaging environment. RBAC is managed through Admin Role Groups in the EAC Roles section.
Built-in Exchange Online Admin Role Groups
| Role Group | Permissions Scope | Typical Assignee |
|---|---|---|
| Organization Management | Full control over all Exchange Online configuration | Global Admins / Exchange Admins |
| Recipient Management | Create and manage mailboxes, groups, and contacts | Help Desk Tier 2, Messaging Engineers |
| Help Desk | View and modify limited user properties (password reset scope, limited CAS settings) | Tier 1 Support Staff |
| View-Only Organization Management | Read-only access to all Exchange Online objects and settings | Auditors, Compliance Officers, Managers |
| Compliance Management | Manage compliance features: eDiscovery, holds, retention, audit logging | Legal/Compliance Officers |
| Records Management | Create and manage retention tags and MRM policies | Records Managers |
| Discovery Management | Run mailbox searches and place litigation holds | Legal/eDiscovery Officers |
| Mail Flow Administrator | Manage transport rules, connectors, accepted domains | Messaging Engineers |
| Security Administrator | Manage security policies: anti-spam, anti-malware, Safe Links, Safe Attachments | Security Engineers |
Create a Custom Scoped Role Group
Build a least-privilege role group for your help desk team with only recipient management capabilities.
Connect-ExchangeOnline # Create custom role group with only required roles New-RoleGroup -Name "HelpDesk-Recipients" -Roles "Mail Recipients","Mail Enabled Public Folders","Message Tracking","User Options" -Description "Help desk team — recipient management and message tracking only" # Add member Add-RoleGroupMember -Identity "HelpDesk-Recipients" -Member "helpdesk@contoso.com" # Verify Get-RoleGroup "HelpDesk-Recipients" | Select-Object Name,Roles Get-RoleGroupMember "HelpDesk-Recipients" | Select-Object Name,RecipientType
🔄 Module 5: Migration
The EAC Migration section tracks all migration batches. As visible in a live environment where no migrations are running, the dashboard card shows “Latest 5 batches — No data available”. During an active migration project, this panel becomes the primary monitoring surface.
Exchange Online Migration Types Comparison
| Migration Type | Use Case | Batch Support | Hybrid Required | Limit |
|---|---|---|---|---|
| Cutover | Migrate all mailboxes at once from Exchange 2010+; DNS cutover on completion | Single batch | No | < 2,000 mailboxes |
| Staged | Migrate in waves from Exchange 2003/2007 with AD sync | Multiple batches | No | No hard limit |
| IMAP | Migrate email only from any IMAP server (Gmail, IBM Notes, Zimbra, etc.) | Multiple batches | No | 500,000 items per mailbox |
| Hybrid (MRS) | Bidirectional mailbox moves between Exchange on-premises and Exchange Online | Multiple batches | Yes | No hard limit |
| Cross-Tenant | Move mailboxes between two different Microsoft 365 tenants | Multiple batches | No (trust relationship) | No hard limit |
| Google Workspace | Migrate from Google Workspace using Microsoft Migration Manager | Multiple batches | No | No hard limit |
Create & Monitor a Hybrid Migration Batch
Move on-premises mailboxes to Exchange Online in a controlled wave and track per-user progress.
Connect-ExchangeOnline # Create migration batch from CSV — auto-start sync New-MigrationBatch -Name "Batch-Wave1" -SourceEndpoint "HybridEndpoint" -CSVData ([System.IO.File]::ReadAllBytes("C:\migration\wave1.csv")) -TargetDeliveryDomain "contoso.mail.onmicrosoft.com" -AutoStart # Monitor all migration batches Get-MigrationBatch | Select-Object Identity,Status,TotalCount,SyncedCount,FinalizedCount,FailedCount # Per-user migration stats for a specific batch Get-MigrationUser -BatchId "Batch-Wave1" | Select-Object Identity,Status,BytesTransferred,PercentComplete,Error # Trigger final sync and complete the batch Complete-MigrationBatch -Identity "Batch-Wave1"
📱 Module 6: Mobile Device Access
The EAC Mobile section manages how mobile devices connect to Exchange Online via the Exchange ActiveSync (EAS) protocol. This covers policy enforcement, device access control, quarantine management, and remote wipe capabilities.
| Feature | Description | PowerShell Cmdlet |
|---|---|---|
| Mobile Device Mailbox Policies | Define PIN requirements, encryption, wipe rules, and allowed apps for ActiveSync devices | New-MobileDeviceMailboxPolicy |
| Device Access Rules | Allow or block specific device types, OS versions, or device families from connecting | New-ActiveSyncDeviceAccessRule |
| Quarantined Devices | New unknown devices are quarantined pending admin approval; reduces shadow IT risk | Set-CASMailbox -ActiveSyncAllowedDeviceIDs |
| Remote Wipe | Wipe corporate data (or full device) from a lost or stolen device over ActiveSync | Clear-MobileDevice |
Create a Mobile Device Policy & Issue Remote Wipe
Enforce PIN, encryption, and auto-wipe on failed attempts — then issue an emergency remote wipe.
Connect-ExchangeOnline # Create mobile device mailbox policy New-MobileDeviceMailboxPolicy -Name "Corporate-MDM-Policy" -PasswordEnabled $true -MinPasswordLength 6 -AlphanumericPasswordRequired $true -MaxInactivityTimeLock 5 -DeviceEncryptionEnabled $true -AllowSimplePassword $false -MaxDevicePasswordFailedAttempts 10 -DevicePasswordExpiration 90 # Assign to mailbox Set-CASMailbox -Identity user@contoso.com -ActiveSyncMailboxPolicy "Corporate-MDM-Policy" # View all connected devices for a user Get-MobileDeviceStatistics -Mailbox user@contoso.com | Select-Object DeviceFriendlyName,DeviceOS,DeviceId,LastSyncAttemptTime,Status # Issue remote wipe on lost device Clear-MobileDevice -Identity "user@contoso.com\DeviceId" -Confirm:$false
📊 Module 7: Reports & Insights
The Reports section provides operational visibility into Exchange Online. The dashboard summary cards (as seen in the live EAC environment) pull their data from the same underlying reporting engine as the full report views.
Key Mail Flow Reports
| Report | What It Shows | Data Retention |
|---|---|---|
| Inbound Messages | Total inbound message volume with TLS version breakdown (TLS 1.3, TLS 1.2, NoTLS) | 90 days |
| Outbound Messages | Total outbound volume and delivery success rate by day | 90 days |
| Auto-Forwarded Messages | Messages automatically forwarded outside the org — tracks exfiltration risk | 90 days |
| Top Senders and Recipients | Highest-volume mailboxes by message count — helps identify volume anomalies | 90 days |
| Spam Detections | Messages identified and actioned as spam by Exchange Online Protection | 90 days |
| Malware Detections | Messages with malware attachments blocked by EOP | 90 days |
| Queued Messages | Real-time view of messages delayed in Microsoft datacenters (connector or downstream issues) | Real-time |
| Non-Delivery Reports (NDR) | Failed delivery messages with error codes — helps diagnose systemic delivery failures | 90 days |
💡 Dashboard Cards vs Full Reports
The EAC Home dashboard shows 7-day rolling summary cards (e.g., “12 inbound messages” and “0 auto-forwarded messages”). For deeper analysis with custom date ranges, per-domain breakdowns, and CSV export, navigate to Reports → Mail Flow and click View report to open the full report in the Microsoft Defender portal (security.microsoft.com). The Insights section additionally surfaces AI-driven recommendations based on detected mail flow anomalies.
📁 Module 8: Public Folders
Public Folders are a shared content repository within Exchange Online — widely used in organisations migrating from on-premises Exchange environments. In Exchange Online, all public folder data is stored within special Public Folder Mailboxes.
Public Folder Architecture
| Component | Description | Limit |
|---|---|---|
| Primary (Hierarchy) Mailbox | Stores and serves the master public folder hierarchy (folder tree). Only one per org can write to the hierarchy. | 1 per organisation |
| Secondary (Content) Mailboxes | Store public folder content. Users are load-balanced across these automatically. | Up to 1,000 mailboxes |
| Total Public Folder Storage | Sum capacity of all public folder mailboxes combined | 100 TB per organisation |
| Single Public Folder Size | Maximum size of any individual public folder | 25 GB |
Create a Public Folder Mailbox, Public Folder & Set Permissions
Build the initial public folder infrastructure and configure client permissions for internal and external access.
Connect-ExchangeOnline # Create the primary public folder mailbox New-Mailbox -PublicFolder -Name "PrimaryPFMailbox" # Create a public folder at the root New-PublicFolder -Name "Company Announcements" -Path \ # Set default read permission for all users Add-PublicFolderClientPermission -Identity "\Company Announcements" -User Default -AccessRights Reviewer # Grant editor access to specific content manager Add-PublicFolderClientPermission -Identity "\Company Announcements" -User editor@contoso.com -AccessRights Editor # Mail-enable the folder Enable-MailPublicFolder -Identity "\Company Announcements" Set-MailPublicFolder -Identity "\Company Announcements" -PrimarySmtpAddress "announcements@contoso.com"
🏢 Module 9: Organization
The Organization section manages cross-tenant collaboration, address book segmentation, and federated calendar sharing — features that are heavily tested in the MS-203 exam.
| Feature | Description | Use Case |
|---|---|---|
| Sharing Policies | Control free/busy and calendar detail sharing with external users and organisations | External calendar visibility for partners and customers |
| Organization Relationships | Federated sharing with other Microsoft 365 or Exchange on-premises organisations | Multi-tenant companies, merger/acquisition scenarios |
| Address Book Policies (ABP) | Segment the Global Address List for different user groups | Subsidiaries, multi-tenant orgs sharing a single Exchange Online tenant |
| Offline Address Book (OAB) | Offline copy of address lists for Outlook Cached Exchange Mode | Users with intermittent connectivity needing local address lookups |
| MailTips | Informational banners shown to senders in Outlook (large audience, OOO, restricted recipient) | Reduce accidental replies-all and policy-blocked sends |
Create an Organization Relationship for Calendar Sharing
Enable free/busy calendar sharing between your M365 org and a partner organisation with limited details visible.
Connect-ExchangeOnline # Create federated org relationship with limited free/busy details New-OrganizationRelationship -Name "Contoso-Partner-Sharing" -DomainNames "partner.com" -FreeBusyAccessEnabled $true -FreeBusyAccessLevel LimitedDetails -MailTipsAccessEnabled $true -DeliveryReportEnabled $true # Verify Get-OrganizationRelationship | Select-Object Name,DomainNames,FreeBusyAccessEnabled,FreeBusyAccessLevel,MailTipsAccessEnabled
⚙️ Module 10: Settings
The Settings section controls organisation-wide defaults and user-facing feature availability for Exchange Online.
| Setting Area | What You Configure | Default Value |
|---|---|---|
| Mail Flow → Message Size Limits | Maximum send/receive message size per connector or organisation | 35 MB (max 150 MB) |
| Mail Flow → Delivery Reports | Allow/deny users from requesting delivery and read receipts | Enabled |
| User Settings → Outlook on the Web Policies | Control OWA features: themes, public computer session timeout, S/MIME, attachments | Default OWA policy |
| User Settings → Email Apps (CAS) | Enable/disable IMAP, POP3, EAS, MAPI, OWA per mailbox or policy | All enabled |
| Notifications → Alert Policies | Configure threshold-based alerts for anomalous activity (unusual inbox rules, forwarding, volume spikes) | Several built-in alerts |
Disable Legacy Authentication Protocols Organisation-Wide
Disable POP3 and IMAP for all mailboxes to reduce attack surface — a recommended security baseline.
Connect-ExchangeOnline # Disable POP3 and IMAP for all existing mailboxes Get-CASMailbox -ResultSize Unlimited | Set-CASMailbox -POPEnabled $false -IMAPEnabled $false # Disable for all future mailboxes via plan Get-CASMailboxPlan | Set-CASMailboxPlan -POPEnabled $false -IMAPEnabled $false # Verify a specific mailbox protocol settings Get-CASMailbox -Identity user@contoso.com | Select-Object DisplayName,POPEnabled,IMAPEnabled,ActiveSyncEnabled,MAPIEnabled,OWAEnabled
🔧 Module 11: Troubleshoot
The Troubleshoot section in EAC provides integrated tools for diagnosing mail flow, connectivity, and configuration issues. This is a core operational skill area for any Exchange Online administrator.
| Tool | Access Point | Primary Use Case |
|---|---|---|
| Message Trace (Standard) | EAC → Mail Flow → Message Trace | Last 10 days — track delivery, NDRs, quarantine, rule actions |
| Extended Message Trace | EAC → Mail Flow → Message Trace → Start a trace | 10–90 days — async report for historical investigation |
| Remote Connectivity Analyzer | testconnectivity.microsoft.com | Test Autodiscover, EAS, SMTP, MRS Proxy, IMAP, POP — from outside the org |
| Queue Viewer | EAC → Mail Flow → Queues (or Troubleshoot) | View and retry messages delayed in Exchange Online queues |
| Admin Audit Log | Microsoft Purview Compliance Portal → Audit | Track all Exchange Online admin configuration changes |
| Accepted Domain Validator | EAC → Mail Flow → Accepted Domains | Confirm MX record and domain ownership verification status |
Search Admin Audit Log for Exchange Changes
Identify all Exchange Online configuration changes made by administrators in the last 30 days.
Connect-ExchangeOnline # All admin changes — last 30 days Search-AdminAuditLog -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) -ResultSize 250 | Select-Object Caller,CmdletName,RunDate,Succeeded | Sort-Object RunDate -Descending | Format-Table -AutoSize # Filter by specific admin account Search-AdminAuditLog -UserIds admin@contoso.com -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) | Select-Object CmdletName,CmdletParameters,RunDate,Succeeded # Find who created transport rules Search-AdminAuditLog -Cmdlets New-TransportRule -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) | Select-Object Caller,CmdletName,RunDate,ObjectModified
🎓 Module 12: MS-203 Certification Alignment
The MS-203: Microsoft 365 Messaging Administrator Associate certification validates your ability to deploy, configure, manage, troubleshoot, and monitor Exchange Online. This entire course guide maps to the MS-203 exam skill areas.
MS-203 Exam Domain Weightings & Course Coverage
Plan and Manage the Exchange Online Infrastructure
Accepted domains, DNS records, connectors, hybrid configuration, Exchange Online Protection — Modules 1, 3, 5
Manage Mail Flow and Spam/Malware Policies
Transport rules, EOP anti-spam/anti-malware policies, quarantine management, safe senders — Modules 3, 7
Manage Recipient Objects and Resources
Mailboxes, groups, contacts, resources, public folder management — Modules 2, 8
Plan and Implement Messaging Security
SPF, DKIM, DMARC, ARC, message encryption (OME/Purview), S/MIME, IRM policies — Module 3 + Defender for Office 365
Manage Organisational Settings and Role-Based Permissions
RBAC role groups, sharing policies, organisation relationships, admin audit logging — Modules 4, 9, 10, 11
✅ MS-203 Exam Study Tips
- Practice every module’s PowerShell commands in a Microsoft 365 Developer Tenant (free 90-day sandbox at developer.microsoft.com/microsoft-365/dev-program)
- Focus heavily on Mail Flow — connectors, transport rules, accepted domains, and message trace are the most heavily tested areas
- Understand the precise differences between Cutover, Staged, IMAP, and Hybrid migrations — the exam tests scenario recognition
- Know all built-in RBAC role group names and their permission scopes — Recipient Management vs Help Desk vs Compliance Management are commonly confused
- Study SPF, DKIM, DMARC, and ARC in depth — email authentication is a guaranteed multi-question domain on the exam
- Understand the difference between a Shared Mailbox and a User Mailbox with Full Access — licensing and feature implications are exam topics
- Review the official MS-203 Study Guide on Microsoft Learn alongside each module here
💡 Best Practices Summary
- Manage Exchange Online via PowerShell for bulk operations — the EAC is best for single-object inspection and quick targeted tasks
- Monitor the EAC Dashboard auto-forwarded messages card weekly — a non-zero count outside an expected migration warrants immediate investigation
- Use dedicated shared mailboxes for team inboxes rather than granting personal mailbox access — eliminates single-point-of-failure and licensing ambiguity
- Scope all transport rules as narrowly as possible using the most specific available condition — overly broad rules cause unexpected delivery side-effects
- Monitor migration batch status daily during active cutover windows — address FailedCount users before declaring any batch complete
- Regularly audit RBAC role group membership — remove inactive admins and over-privileged service accounts quarterly
- Keep inbound connector IP address lists current — stale relay IPs cause NDRs and complete mail flow disruptions without warning
- Disable legacy authentication protocols (POP3, IMAP) organisation-wide unless explicitly required — reduces account compromise attack surface significantly
- Use Microsoft Intune MDM/MAM policies for modern devices alongside or instead of legacy ActiveSync device mailbox policies
📚 References & Further Reading
- 🔗 Exchange Online Documentation — Microsoft Learn
- 🔗 Exchange Online PowerShell Module — Microsoft Learn
- 🔗 MS-203: Microsoft 365 Messaging Administrator Certification — Microsoft Learn
- 🔗 Mail Flow Best Practices in Exchange Online — Microsoft Learn
- 🔗 Manage User Mailboxes in Exchange Online — Microsoft Learn
- 🔗 Microsoft Remote Connectivity Analyzer — testconnectivity.microsoft.com
- 🔗 Exchange Admin Center (EAC) — admin.exchange.microsoft.com