📧 Exchange Online Course · Module 2 of 7
Mailbox Management
MS-203 Exam Alignment
MS-203
Skill Area 3 — Manage recipient objects and resources: create and manage user mailboxes and shared mailboxes, configure mailbox permissions, manage email forwarding, manage mailbox size quotas, and hide recipients from the address list.
- Know all mailbox types and their licensing requirements (especially the shared mailbox 50 GB rule)
- Understand the difference between Full Access, Send As, and Send on Behalf permissions
- Configure email forwarding with and without keeping a local copy
- Convert a user mailbox to a shared mailbox and understand the license implications
- Manage litigation hold and recoverable items on mailboxes
Exam Tip: MS-203 loves permission-scenario questions — "A user must send email that appears to come directly from the shared mailbox address" (= Send As, not Send on Behalf). Learn the exact behavioural difference between the three permission types; it is almost guaranteed to appear.
Mailboxes are the core recipient object in Exchange Online. The EAC Recipients → Mailboxes page is where administrators spend most of their day — creating shared mailboxes, granting permissions, configuring forwarding, and troubleshooting access. The EAC Home dashboard even surfaces the four most common mailbox tasks as quick actions: Manage email forwarding, Add a shared mailbox, Hide from address list, and Edit a mailbox. This module covers all of them in depth — portal steps and PowerShell for every task.
📦 Mailbox Types in Exchange Online
Exchange Online supports several mailbox types, each with different licensing and behaviour:
| Mailbox Type | Purpose | License Required | Sign-In Enabled |
|---|---|---|---|
| User Mailbox | Primary mailbox for a licensed person — email, calendar, contacts, tasks | Yes — Exchange Online Plan 1 (50 GB) or Plan 2 (100 GB) | Yes |
| Shared Mailbox | Team inbox accessed by multiple delegates (e.g. support@, info@) | No, up to 50 GB. Exchange Online Plan 2 license required for >50 GB or In-Place Archive or litigation hold | No (account is disabled by design) |
| Room Mailbox | Represents a bookable meeting room — calendar-based scheduling | No — free resource account | No |
| Equipment Mailbox | Represents bookable equipment — vehicle, projector, AV kit | No — free resource account | No |
| Linked Mailbox | Mailbox associated with an account in a separate trusted forest (hybrid scenarios) | Yes | Via linked account |
⚠️ The Shared Mailbox 50 GB Rule — MS-203 Favourite
Per Microsoft's licensing documentation, a shared mailbox does not require a license as long as it stays under 50 GB and does not use an In-Place Archive or litigation hold. To exceed 50 GB (up to 100 GB), apply litigation hold, or enable archiving, the shared mailbox must be assigned an Exchange Online Plan 2 license (or Plan 1 + Exchange Online Archiving). This exact scenario appears frequently on MS-203.
➕ Creating a Shared Mailbox — Portal Walkthrough
EAC › Recipients › Mailboxes › + Add a shared mailbox
🏠 Home
👤 Recipients
Mailboxes
Groups
Resources
Contacts
📧 Mail flow
🔑 Roles
🔄 Migration
Manage mailboxes
+ Add a shared mailbox ①
↓ Export
⟳ Refresh
↓ Export
⟳ Refresh
① In Recipients → Mailboxes, click + Add a shared mailbox. Enter the display name (e.g. "IT Support") and the email address (e.g. itsupport@techcareers.in). Click Create.
② After creation, click the new mailbox in the list → Delegation tab → add members under Read and manage (Full Access) and Send As. Members may take up to 60 minutes to receive access, and the mailbox appears in their Outlook automatically via auto-mapping.
PowerShell — Create Shared Mailbox & Grant Permissions
Connect-ExchangeOnline # Create the shared mailbox New-Mailbox -Shared -Name "IT Support" -DisplayName "IT Support" -Alias "itsupport" -PrimarySmtpAddress "itsupport@techcareers.in" # Grant Full Access with auto-mapping Add-MailboxPermission -Identity "itsupport@techcareers.in" -User "amit@techcareers.in" -AccessRights FullAccess -InheritanceType All -AutoMapping $true # Grant Send As Add-RecipientPermission -Identity "itsupport@techcareers.in" -Trustee "amit@techcareers.in" -AccessRights SendAs -Confirm:$false # Verify who has access Get-MailboxPermission -Identity "itsupport@techcareers.in" | Where-Object {$_.IsInherited -eq $false -and $_.User -ne "NT AUTHORITY\SELF"}
🔑 Mailbox Permissions — Full Access vs Send As vs Send on Behalf
Understanding the three permission types is essential — both for daily administration and for MS-203:
| Permission | What the Delegate Can Do | How Sent Mail Appears | PowerShell Cmdlet |
|---|---|---|---|
| Full Access | Open the mailbox, read, and manage all content — email, calendar, contacts. Does NOT include the right to send | N/A — reading permission only | Add-MailboxPermission |
| Send As | Send email that appears to come directly from the mailbox — the recipient cannot tell a delegate sent it | From: IT Support | Add-RecipientPermission |
| Send on Behalf | Send email marked as sent on behalf of the mailbox — recipients see both names | From: Amit Sharma on behalf of IT Support | Set-Mailbox -GrantSendOnBehalfTo |
PowerShell — All Three Permission Types
Connect-ExchangeOnline # Full Access (read and manage — no send rights) Add-MailboxPermission -Identity "itsupport@techcareers.in" -User "priya@techcareers.in" -AccessRights FullAccess -InheritanceType All # Send As (mail appears directly from the mailbox) Add-RecipientPermission -Identity "itsupport@techcareers.in" -Trustee "priya@techcareers.in" -AccessRights SendAs -Confirm:$false # Send on Behalf (mail shows "on behalf of") Set-Mailbox -Identity "itsupport@techcareers.in" -GrantSendOnBehalfTo @{Add="priya@techcareers.in"} # Remove Full Access Remove-MailboxPermission -Identity "itsupport@techcareers.in" -User "priya@techcareers.in" -AccessRights FullAccess -Confirm:$false
💡 Auto-Mapping — How Mailboxes Appear in Outlook
When Full Access is granted with auto-mapping enabled (the default), Outlook automatically adds the mailbox to the delegate's folder pane on next start — no manual configuration required. For delegates with access to many mailboxes, this can slow Outlook down; grant with -AutoMapping $false and have users add the mailbox manually instead.
↪️ Managing Email Forwarding
Email forwarding — the first quick action on the EAC dashboard — redirects a mailbox's incoming email to another address. Two configuration decisions matter: the destination type, and whether a copy stays in the original mailbox.
EAC › Recipients › Mailboxes › select mailbox › Mailbox tab › Manage email forwarding
| Setting | Behaviour | PowerShell Parameter |
|---|---|---|
| Forward to internal recipient | Forwards to another mailbox inside the organisation | -ForwardingAddress |
| Forward to external address (SMTP) | Forwards to any external email address — subject to outbound spam policy controls | -ForwardingSmtpAddress |
| Keep a copy | Message is delivered to the mailbox AND forwarded | -DeliverToMailboxAndForward $true |
| Forward only | Message is forwarded without a local copy remaining | -DeliverToMailboxAndForward $false |
PowerShell — Configure & Audit Forwarding
Connect-ExchangeOnline # Forward externally, keep a copy in the original mailbox Set-Mailbox -Identity "amit@techcareers.in" -ForwardingSmtpAddress "amit@partner.com" -DeliverToMailboxAndForward $true # Remove forwarding Set-Mailbox -Identity "amit@techcareers.in" -ForwardingSmtpAddress $null # Audit ALL mailboxes with any forwarding configured Get-Mailbox -ResultSize Unlimited | Where-Object {$_.ForwardingSmtpAddress -ne $null -or $_.ForwardingAddress -ne $null} | Select-Object DisplayName,PrimarySmtpAddress,ForwardingSmtpAddress,ForwardingAddress,DeliverToMailboxAndForward
⚠️ External Forwarding — Blocked by Default
Since 2020, Microsoft's default outbound spam policy sets automatic external forwarding to "Automatic - System-controlled", which blocks it. If external forwarding is required for legitimate business reasons, an administrator must explicitly allow it in the Microsoft Defender portal under Email & collaboration → Policies → Anti-spam → Outbound spam policy — either globally or for specific users. Admin-configured SMTP forwarding (Set-Mailbox) and inbox rules that forward externally are both affected by this control.
🙈 Hide from Address List
Hiding a mailbox from the Global Address List (GAL) removes it from Outlook's address book — commonly used for departed employees, service accounts, and internal-only mailboxes. It is the third quick action on the EAC dashboard.
① In Recipients → Mailboxes, select the mailbox → General tab → toggle Hide from address lists → Save. The change can take up to 24 hours to fully propagate in cached Outlook clients using the Offline Address Book.
PowerShell — Hide from GAL
Set-Mailbox -Identity "oldemployee@techcareers.in" -HiddenFromAddressListsEnabled $true # Report all hidden mailboxes Get-Mailbox -ResultSize Unlimited | Where-Object {$_.HiddenFromAddressListsEnabled -eq $true} | Select-Object DisplayName,PrimarySmtpAddress
🔄 Converting a User Mailbox to a Shared Mailbox
A common leaver-process task: when an employee departs, convert their mailbox to shared so the team retains access to historical email without consuming a license.
① In Recipients → Mailboxes, select the user mailbox → Others tab → Convert to shared mailbox → Confirm.
② After conversion completes, the Exchange Online license can be removed from the account in the M365 Admin Center — provided the mailbox is under 50 GB with no archive or hold. Block the account's sign-in as well since shared mailbox accounts should never be signed into directly.
PowerShell — Convert Mailbox Type
# Convert user mailbox to shared Set-Mailbox -Identity "leaver@techcareers.in" -Type Shared # Convert back to a user mailbox (license must be assigned first) Set-Mailbox -Identity "leaver@techcareers.in" -Type Regular # Verify the mailbox type Get-Mailbox -Identity "leaver@techcareers.in" | Select-Object DisplayName,RecipientTypeDetails
📏 Mailbox Sizes, Quotas & Statistics
| Quota Setting | Default (Plan 1 / Plan 2) | Behaviour When Reached |
|---|---|---|
| Issue warning quota | 49 GB / 98 GB | User receives a warning email that the mailbox is nearly full |
| Prohibit send quota | 49.5 GB / 99 GB | User can no longer send email; receiving continues |
| Prohibit send/receive quota | 50 GB / 100 GB | Mailbox rejects all inbound mail with an NDR to senders |
PowerShell — Mailbox Size Report
Connect-ExchangeOnline # Single mailbox size and item count Get-MailboxStatistics -Identity "amit@techcareers.in" | Select-Object DisplayName,TotalItemSize,ItemCount,LastLogonTime # Top 20 largest mailboxes in the organisation Get-Mailbox -ResultSize Unlimited | Get-MailboxStatistics | Sort-Object TotalItemSize -Descending | Select-Object -First 20 DisplayName,TotalItemSize,ItemCount
💡 Best Practices
- Use shared mailboxes for team inboxes rather than sharing one user's credentials — credential sharing breaks audit trails and MFA
- Block sign-in on all shared mailbox accounts — they are disabled by default at creation; keep them that way
- Audit mailbox forwarding quarterly — unexpected external forwarding is a top indicator of account compromise
- Convert leaver mailboxes to shared before removing licenses to preserve email history for the team at zero cost (under 50 GB)
- Grant Send As rather than Send on Behalf for team inboxes where a consistent single identity matters to customers
- Use -AutoMapping $false when a delegate needs access to more than ~10 mailboxes to prevent Outlook performance issues
🎓 Interview Q&A
Q: When does a shared mailbox require a license in Exchange Online?
A shared mailbox is free up to 50 GB. It requires an Exchange Online Plan 2 license (or Plan 1 with the Exchange Online Archiving add-on) in three cases: the mailbox needs to exceed 50 GB (up to 100 GB), an In-Place Archive is enabled, or a litigation hold is applied. Without a license in those scenarios, the configuration is unsupported.
Q: Explain the difference between Send As and Send on Behalf.
Send As makes email appear to come directly from the mailbox — recipients see only "From: IT Support" with no indication a delegate sent it. Send on Behalf exposes both identities — recipients see "From: Amit Sharma on behalf of IT Support". Send As is granted via Add-RecipientPermission; Send on Behalf via Set-Mailbox -GrantSendOnBehalfTo. If a user holds both, Send As takes precedence.
Q: A user configured an inbox rule to forward mail to their personal Gmail, but the messages never arrive. Why?
Automatic external forwarding is disabled by default in Exchange Online's outbound spam policy (set to "Automatic - System-controlled"). Both inbox-rule forwarding and admin-configured SMTP forwarding to external addresses are blocked, and senders may receive NDR 5.7.520. To allow it, an admin must change the outbound spam policy in the Microsoft Defender portal to permit external forwarding — globally or for that specific user.
Q: What is the process to preserve a departed employee's email without keeping their license?
Convert the user mailbox to a shared mailbox (EAC → Others tab → Convert to shared mailbox, or Set-Mailbox -Type Shared), verify the mailbox is under 50 GB with no archive or hold, then remove the license and block sign-in. Team members needing the historical email are granted Full Access. If long-term legal preservation is required instead, apply litigation hold before license removal — which then requires keeping an Exchange Online Plan 2 license on the mailbox — or use Microsoft Purview retention.
Q: A delegate was granted Full Access an hour ago but still cannot open the shared mailbox. What do you check?
First, confirm the permission actually exists with Get-MailboxPermission. Permission propagation and auto-mapping can take up to 60 minutes, and Outlook may need a restart to pick up auto-mapped mailboxes. If auto-mapping was disabled at grant time, the user must add the mailbox manually (File → Account Settings → Change → More Settings → Advanced → Add mailbox in Outlook, or "Open another mailbox" in Outlook on the web). Also verify the user is licensed and their own mailbox is functional.
🎯 MS-203 Mock Test
Module 2 — Exchange Online: Mailbox Management
Question 1 of 5
A company's support team needs a shared mailbox at support@contoso.com. The mailbox currently holds 30 GB and must be placed on litigation hold for a legal case. What is required?
✅ Correct answer: C. A shared mailbox is license-free under 50 GB — but applying litigation hold requires an Exchange Online Plan 2 license (or Plan 1 + Exchange Online Archiving) regardless of size. Answer A misses the hold requirement; Plan 1 alone (B) does not include litigation hold.
Question 2 of 5
Customer-facing replies from the sales@ shared mailbox must show only "From: Sales Team" with no indication of which employee sent them. Which permission should the employees be granted?
✅ Correct answer: B. Send As makes messages appear directly from the mailbox with no delegate identity visible. Send on Behalf (C) would show "Employee on behalf of Sales Team" — exactly what the requirement forbids. Full Access (A) only grants the ability to open and read the mailbox; it includes no send rights at all.
Question 3 of 5
A user sets up an Outlook inbox rule to forward all email to their personal Gmail address. Senders begin receiving NDRs with code 5.7.520 and the messages never reach Gmail. What is the cause?
✅ Correct answer: D. Exchange Online's default outbound spam policy sets automatic forwarding to "Automatic - System-controlled", which blocks external auto-forwarding and generates NDR 5.7.520. An admin must explicitly enable external forwarding in the Defender portal outbound spam policy if it is required for legitimate reasons.
Question 4 of 5
An employee has left the company. The team needs continued access to their email history, and the company wants to reclaim the license. The mailbox is 35 GB with no holds. What is the correct sequence?
✅ Correct answer: A. Convert while licensed, then remove the license once the mailbox is shared and under 50 GB, block sign-in, and grant delegates access. Removing the license first (B) risks the mailbox entering a deletion grace period before conversion. PST export (C) loses ongoing receive capability and creates governance issues. Deleting the user (D) soft-deletes the mailbox — it does not become shared.
Question 5 of 5
A user reports they can no longer send email, but new messages are still arriving in their inbox. What has most likely happened?
✅ Correct answer: C. Exchange Online has staged quotas: at the prohibit send quota (49.5 GB on Plan 1) sending stops but receiving continues; at the prohibit send/receive quota (50 GB) all mail flow stops. Sending blocked + receiving working = between the two thresholds. Verify with Get-MailboxStatistics and have the user archive or delete content.
🔒
This module is lockedComplete Module 1 and pass its mock test to unlock this module.