EAC Overview & Navigation
MS-203 Exam Alignment
MS-203
Skill Area 1 — Plan and manage the Exchange Online infrastructure: navigate the Exchange Admin Center, understand the role of each left-navigation section, identify the dashboard cards and what they monitor, access the EAC via the Microsoft 365 Admin Center and via direct URL, and connect via Exchange Online PowerShell.
- Know the EAC URL: admin.exchange.microsoft.com (redirects to admin.cloud.microsoft/exchange)
- Identify which Exchange Online admin role is needed to access the EAC
- Understand every left-navigation section and which workloads it controls
- Read and interpret the EAC Home dashboard cards (Mail Flow, Mailboxes, Migration batches)
- Install and connect to Exchange Online via ExchangeOnlineManagement PowerShell module
🏛️ What is the Exchange Admin Center
💡 The EAC — Modern Web-Based Messaging Management
The Exchange Admin Center (EAC) is a modern, web-based management console for Exchange Online. It replaces the older Exchange Control Panel (ECP) and aligns with the overall Microsoft 365 admin experience. According to Microsoft Learn, the EAC is designed to provide actionable insights and includes built-in reports for mail flow, migration, and priority monitoring.
- Manage all recipient objects — mailboxes, groups, resources, contacts
- Configure mail flow — connectors, transport rules, accepted domains, message trace
- Administer Exchange Online Protection (EOP) — anti-spam, anti-malware
- Plan and monitor migration batches — cutover, staged, IMAP, hybrid
- Manage admin role groups and permissions (RBAC)
- Monitor mail flow reports and insights directly from the Home dashboard
Role-Based Access Control (RBAC) determines which features are available to you in the EAC. A Global Administrator or Exchange Administrator has full access. More scoped roles — such as Recipient Management — see only the sections relevant to their permissions.
🌐 Accessing the Exchange Admin Center
admin.exchange.microsoft.com → redirects to → admin.cloud.microsoft/exchange
Techcareers
+ Add card (6 more available)
What's new?
🌙 Dark mode
https://admin.exchange.microsoft.com
①
📋 EAC Left Navigation — Every Section Explained
The EAC left navigation is the primary way to move between functional areas. Every section in this course corresponds directly to a left-navigation item. The following table maps each navigation section to what it controls and which module in this course covers it.
| Left Nav Section | Sub-sections | What It Controls | Course Module |
|---|---|---|---|
| Home | Dashboard | Real-time mail flow cards, migration batch status, mailbox quick actions, training links | Module 1 ← You are here |
| Recipients | Mailboxes | User, shared, room, and equipment mailboxes — create, edit, permissions, forwarding | Module 2 |
| Recipients | Groups | M365 Groups, Distribution Groups, Mail-Enabled Security Groups, Dynamic Distribution Groups | Module 3 |
| Recipients | Resources | Room mailboxes and equipment mailboxes — calendar processing, booking policies | Module 3 |
| Recipients | Contacts | Mail contacts (external addresses) and mail users (external accounts with internal address) | Module 3 |
| Mail flow | Connectors, Rules, Accepted Domains, Remote Domains, Message Trace | Mail routing, accepted SMTP namespaces, partner routing, transport policy enforcement, message tracing | Module 4 |
| Roles | Admin roles | Exchange RBAC role groups — built-in and custom, role assignments, audit logging | Module 5 |
| Migration | Batches | Migration batches for cutover, staged, IMAP, hybrid, and cross-tenant migrations | Module 6 |
| Mobile | Mobile device mailbox policies, Device access rules | ActiveSync policy enforcement, device access control, remote wipe | Module 6 |
| Reports | Mail flow, spam, malware | Mail flow volume, TLS breakdown, top senders/recipients, spam and malware detection counts | Module 7 |
| Insights | Recommendations | AI-driven configuration recommendations based on detected mail flow patterns and anomalies | Module 7 |
| Public folders | Public folder mailboxes, folders | Public folder hierarchy, content mailboxes, client permissions | Module 7 |
| Organization | Sharing, Relationships, Address book policies | External calendar sharing, federated org relationships, address book segmentation, MailTips | Module 5 |
| Settings | Mail flow settings, User settings | Message size limits, OWA policies, CAS mailbox protocol settings, alert policies | Module 7 |
| Troubleshoot | Message trace, Queue viewer | Diagnose delivery failures, track messages hop-by-hop, review deferred messages in queues | Module 7 |
| Other features | Links to Defender, Purview | Shortcut links to EOP security settings in the Microsoft Defender portal and Purview compliance | Module 7 |
📊 Understanding the EAC Home Dashboard Cards
The EAC Home dashboard shows 6 default operational cards. You can add up to 6 more using the + Add card button in the top-right corner. Each card provides a real-time snapshot of a critical area of your Exchange Online environment.
| Dashboard Card | What It Shows | Key Action |
|---|---|---|
| Training & guides | Quick links to the Exchange admin center video tutorial (Microsoft Learn) and EAC documentation | Watch the training video to learn EAC navigation basics |
| Mail flow — Auto-forwarded messages | Count of messages automatically forwarded to external domains in the last 7 days. A count of 0 is the desired security state — a non-zero value warrants investigation for compromised accounts | Navigate to Mail Flow → Reports to investigate |
| Mailboxes | Four quick-action links: Manage email forwarding, Add a shared mailbox, Hide from address list, Edit a mailbox — the most commonly performed mailbox tasks | Click any link to jump directly to the relevant Recipients page |
| Mail flow — Inbound messages | Total inbound message count for the last 7 days with a TLS version breakdown bar chart (TLS 1.3 in blue, TLS 1.2 in lighter blue, NoTLS in amber). Click View report for the full 90-day report | Use to monitor TLS adoption and identify insecure inbound connections (NoTLS) |
| Exchange — Latest 5 batches | The status of the 5 most recent migration batches. Shows "No data available" when no migrations have been configured. During active migrations this card becomes a key monitoring surface | Navigate to Migration for full batch management |
| Try communication compliance | Information about Microsoft Purview Communication Compliance — covers Exchange mail flow, journaling, and DLP policies in one solution, with machine learning models for detecting inappropriate content | Link opens Microsoft Purview Compliance Portal |
⚠️ Auto-Forwarded Messages — Security Significance
The auto-forwarded messages card is one of the most security-relevant indicators on the EAC dashboard. Attackers who compromise a mailbox frequently set up inbox forwarding rules to silently send copies of all received email to an external address. A non-zero count here should prompt an immediate review of all mailboxes with forwarding configured, combined with a sign-in audit in Microsoft Entra ID. In Module 4 (Mail Flow) you will learn to create a transport rule that blocks external auto-forwarding organisation-wide as a preventive control.
🔐 Admin Roles Required to Access the EAC
Access to the Exchange Admin Center is controlled by Exchange Online RBAC role groups. The roles and their access levels are:
| Role | EAC Access Level | Typical Use |
|---|---|---|
| Global Administrator | Full access to all EAC sections | Break-glass admin accounts only — use scoped roles day-to-day |
| Exchange Administrator | Full access to all EAC sections | Senior messaging engineers and architects |
| Organization Management (EAC role group) | Full Exchange Online configuration | Assigned to primary Exchange admins via EAC Roles section |
| Recipient Management (EAC role group) | Mailboxes, Groups, Resources, Contacts sections only | Help desk Tier 2, HR-adjacent IT staff |
| View-Only Organization Management | Read-only across all EAC sections | Auditors, security reviewers who need to inspect but not change |
| Help Desk (EAC role group) | Limited recipient properties only | Tier 1 support for basic mailbox queries |
✅ Principle of Least Privilege
Never assign Global Administrator just to grant EAC access. Use the Exchange Administrator Entra ID role or the Organization Management EAC role group for full Exchange access, and Recipient Management for staff who only need to manage mailboxes and groups. Module 5 covers RBAC configuration in full.
⚡ Exchange Online PowerShell — Installing & Connecting
💡 ExchangeOnlineManagement Module
All Exchange Online administration tasks available in the EAC can also be performed via Exchange Online PowerShell using the ExchangeOnlineManagement module (version 3.x+). This is the official Microsoft-supported module for Exchange Online. It uses modern authentication (OAuth 2.0) and supports certificate-based authentication for unattended scripts.
# Step 1 — Install the ExchangeOnlineManagement module (run once) Install-Module ExchangeOnlineManagement -Scope CurrentUser # Step 2 — Connect to Exchange Online (modern auth — browser pop-up for MFA) Connect-ExchangeOnline -UserPrincipalName admin@contoso.com # Step 3 — Verify the connection and check your organisation Get-OrganizationConfig | Select-Object Name,DisplayName # Step 4 — List all Exchange Online admin role groups Get-RoleGroup | Select-Object Name | Sort-Object Name # Step 5 — Disconnect when finished Disconnect-ExchangeOnline -Confirm:$false
⚠️ Module Version — Always Use v3.x+
The ExchangeOnlineManagement module v3.x replaced the older -UseRPSSession and basic auth connection methods. Version 3 uses REST-based APIs which are faster and more secure. Run Get-Module ExchangeOnlineManagement -ListAvailable to check your installed version. Update with Update-Module ExchangeOnlineManagement.
🎓 Interview Q&A
Install-Module ExchangeOnlineManagement and connect with Connect-ExchangeOnline -UserPrincipalName admin@domain.com. Version 3 uses modern authentication (OAuth 2.0 with MFA support) via REST-based APIs. The older -UseRPSSession flag is no longer needed in v3.An administrator needs to access the Exchange Admin Center directly without going through the M365 Admin Center. Which URL should they navigate to?
An organisation's EAC Home dashboard shows the "Mail Flow — Auto-Forwarded Messages" card displaying 23 messages over the past 7 days. No migration or legitimate forwarding rules have been configured. What is the most appropriate first response?
A junior IT engineer needs to manage shared mailboxes and distribution groups in Exchange Online. They should not have access to Mail Flow, Roles, or Migration sections. Which Exchange Online role should be assigned?
An administrator installs the ExchangeOnlineManagement module and runs Connect-ExchangeOnline successfully. They then run Get-Mailbox but receive an error. What is the most likely cause?
An administrator navigating the EAC wants to configure a rule that rejects messages containing specific keywords before they are delivered. Which left-navigation section should they use?