📧 Exchange Online Course · Module 3 of 7
Groups, Resources & Contacts
MS-203 Exam Alignment
MS-203
Skill Area 3 — Manage recipient objects and resources: create and manage the four Exchange Online group types, configure resource mailboxes with calendar processing (booking policies), and manage mail contacts and mail users.
- Know all four group types the EAC manages and when to use each (per Microsoft Learn: M365 Groups, distribution groups, mail-enabled security groups, dynamic distribution groups)
- Understand dynamic distribution group membership — filter-based, evaluated at send time
- Configure room mailbox booking with Set-CalendarProcessing — AutoAccept, booking window, delegates
- Know the difference between a mail contact and a mail user
- Understand which group settings control external senders and message approval (moderation)
Exam Tip: MS-203 tests dynamic distribution groups heavily — remember membership is calculated each time a message is sent, not stored statically, and you preview membership with Get-Recipient -RecipientPreviewFilter. Also know that a mail-enabled security group can secure resources AND receive email, while a distribution group cannot secure anything.
The EAC Recipients section contains three more pages beyond Mailboxes: Groups, Resources, and Contacts — exactly as they appear in the left navigation. According to Microsoft's EAC documentation, the EAC enables you to create and manage four types of groups: Microsoft 365 Groups, distribution groups, mail-enabled security groups, and dynamic distribution groups. This module covers all four, plus room and equipment resource mailboxes with automated booking, and external-recipient objects (mail contacts and mail users).
👥 The Four Group Types in Exchange Online
| Group Type | Purpose | Can Secure Resources | Membership | Extras |
|---|---|---|---|---|
| Microsoft 365 Group | Full collaboration — shared inbox, shared calendar, SharePoint site, Planner, and optionally a Team | Yes (many workloads) | Static (or dynamic with Entra ID P1) | Guest access, self-service creation, connected services |
| Distribution Group | Email delivery to all members — a classic distribution list | No | Static | Moderation, delivery management, MailTips |
| Mail-Enabled Security Group | Grants permissions to resources AND receives email at one address | Yes | Static | Dual-purpose object — security principal + distribution list |
| Dynamic Distribution Group | Email delivery to a membership calculated from recipient filters | No | Dynamic — recalculated at each send | Attribute-based (department, office, custom attributes) |
💡 Choosing the Right Group — Decision Guide
- Need shared files, a Team, or a shared calendar? → Microsoft 365 Group
- Only need to email a fixed set of people? → Distribution Group
- Need to email a set of people AND grant them access to something? → Mail-Enabled Security Group
- Need to email "everyone in Sales" without maintaining the list manually? → Dynamic Distribution Group
➕ Creating a Group — Portal Walkthrough
EAC › Recipients › Groups › + Add a group
🏠 Home
👤 Recipients
Mailboxes
Groups
Resources
Contacts
📧 Mail flow
🔑 Roles
Choose a group type ①
◉ Microsoft 365 group
Work together with shared email, files, and a calendar. Add a Team later.
○ Distribution
Send email to all group members from one address.
○ Mail-enabled security
Grant access to resources and send email to members.
○ Dynamic distribution
Membership updates automatically based on rules you set.
① In Recipients → Groups, click + Add a group and choose the group type. The wizard then asks for a name, description, owners, members (or membership rules for dynamic), the email address, and settings such as external senders and join approval.
PowerShell — Create Each Group Type
Connect-ExchangeOnline # 1. Microsoft 365 Group New-UnifiedGroup -DisplayName "Project Phoenix" -Alias "phoenix" -PrimarySmtpAddress "phoenix@techcareers.in" -AccessType Private -Owner "amit@techcareers.in" # 2. Distribution Group New-DistributionGroup -Name "All Managers" -Alias "allmanagers" -PrimarySmtpAddress "allmanagers@techcareers.in" -Type Distribution # 3. Mail-Enabled Security Group New-DistributionGroup -Name "Finance Secure" -Alias "financesecure" -PrimarySmtpAddress "financesecure@techcareers.in" -Type Security # 4. Dynamic Distribution Group — everyone in Sales New-DynamicDistributionGroup -Name "All Sales" -Alias "allsales" -PrimarySmtpAddress "allsales@techcareers.in" -IncludedRecipients MailboxUsers -ConditionalDepartment "Sales" # Add a member to a static group Add-DistributionGroupMember -Identity "All Managers" -Member "priya@techcareers.in" # Preview dynamic group membership BEFORE first send $ddg = Get-DynamicDistributionGroup "All Sales" Get-Recipient -RecipientPreviewFilter $ddg.RecipientFilter | Select-Object DisplayName,Department
⚠️ Dynamic Distribution Groups — Membership Is Calculated at Send Time
A dynamic distribution group has no stored member list. Every time a message is sent to the group, Exchange Online evaluates the recipient filter and delivers to whoever matches at that moment. A user whose Department attribute changes to "Sales" today automatically receives the next message sent to All Sales — no admin action needed. This also means attribute hygiene matters: an empty Department field silently excludes a user.
⚙️ Group Delivery Management & Moderation
Every group's settings pages control who can send to it and whether messages need approval:
| Setting | What It Controls | PowerShell |
|---|---|---|
| External senders | Whether people outside the organisation can email the group. Off by default — a common cause of "external senders get NDRs" tickets | Set-DistributionGroup -RequireSenderAuthenticationEnabled $false |
| Delivery management | Restrict which internal senders are allowed to email the group | Set-DistributionGroup -AcceptMessagesOnlyFrom |
| Message approval (moderation) | Route messages to a moderator for approval before delivery to members | Set-DistributionGroup -ModerationEnabled $true -ModeratedBy |
| Join/leave restrictions | Open, closed, or owner-approval membership requests | Set-DistributionGroup -MemberJoinRestriction ApprovalRequired |
| Hidden from GAL | Hide the group from the address book | Set-DistributionGroup -HiddenFromAddressListsEnabled $true |
🏢 Resources — Room & Equipment Mailboxes
The Recipients → Resources page manages the two resource mailbox types. Both are free (no license) and both work through calendar-based booking: users invite the resource to a meeting, and the resource accepts or declines automatically based on its calendar processing policy.
| Type | Represents | Key Properties |
|---|---|---|
| Room mailbox | A physical location — meeting room, boardroom, training room | Capacity, location, Hide from GAL toggle (documented in the EAC What's New notes under resource General settings) |
| Equipment mailbox | A movable asset — company car, projector, AV kit, laptop pool | No capacity/location; otherwise identical booking behaviour |
Booking Options — Calendar Processing
Booking behaviour is controlled per-resource. In the EAC these appear under the resource's Booking options; in PowerShell they map to Set-CalendarProcessing:
| Booking Option | Behaviour | PowerShell Parameter |
|---|---|---|
| Automatically accept | Accept when free, decline when conflicting — no human involved | -AutomateProcessing AutoAccept |
| Delegate approval | Requests are routed to named delegates who accept/decline manually | -AutomateProcessing AutoUpdate -ResourceDelegates |
| Booking window | How far in advance a booking can be made (default 180 days) | -BookingWindowInDays |
| Maximum duration | Longest single booking allowed (default 24 hours = 1440 min) | -MaximumDurationInMinutes |
| Repeating meetings | Whether recurring bookings are permitted | -AllowRecurringMeetings |
| Conflicts | Whether double-booking is allowed (almost always no) | -AllowConflicts |
PowerShell — Room Mailbox with Auto-Accept Booking Policy
Connect-ExchangeOnline # Create the room New-Mailbox -Room -Name "Boardroom A" -DisplayName "Boardroom A" -Alias "boardrooma" -PrimarySmtpAddress "boardrooma@techcareers.in" # Set capacity and location Set-Mailbox -Identity "boardrooma@techcareers.in" -ResourceCapacity 20 -Office "Mumbai HQ - Floor 3" # Booking policy: auto-accept, 8h max, 90-day window, no conflicts Set-CalendarProcessing -Identity "boardrooma@techcareers.in" -AutomateProcessing AutoAccept -AllowConflicts $false -BookingWindowInDays 90 -MaximumDurationInMinutes 480 -AllowRecurringMeetings $true -AddOrganizerToSubject $true -DeleteComments $false -DeleteSubject $false # Equipment mailbox with delegate approval instead of auto-accept New-Mailbox -Equipment -Name "Company Car" -Alias "companycar" -PrimarySmtpAddress "companycar@techcareers.in" Set-CalendarProcessing -Identity "companycar@techcareers.in" -AutomateProcessing AutoUpdate -ResourceDelegates "fleet@techcareers.in" # Verify Get-CalendarProcessing -Identity "boardrooma@techcareers.in" | Select-Object AutomateProcessing,BookingWindowInDays,MaximumDurationInMinutes,AllowConflicts
📇 Contacts — Mail Contacts & Mail Users
The Recipients → Contacts page manages external-recipient objects — people outside your organisation who need to appear in your GAL:
| Object | What It Is | Can Sign In | Typical Use |
|---|---|---|---|
| Mail contact | A GAL entry pointing to an external email address — no account, no mailbox | No | External partners, vendors, and consultants who staff frequently email; members of distribution lists |
| Mail user | An account in your directory with sign-in credentials but whose email address is external — no Exchange Online mailbox | Yes | Contractors who need access to internal resources (SharePoint, apps) but keep their own external mailbox |
PowerShell — Mail Contacts & Mail Users
Connect-ExchangeOnline # Mail contact — external partner in the GAL New-MailContact -Name "Rahul Vendor" -ExternalEmailAddress "rahul@vendorco.com" -Alias "rahulvendor" # Add the contact to a distribution group Add-DistributionGroupMember -Identity "Project Partners" -Member "rahulvendor" # List all mail contacts Get-MailContact -ResultSize Unlimited | Select-Object DisplayName,ExternalEmailAddress # List all mail users Get-MailUser -ResultSize Unlimited | Select-Object DisplayName,ExternalEmailAddress,UserPrincipalName
💡 Best Practices
- Prefer Microsoft 365 Groups over classic distribution groups for new team collaboration — they include files, calendar, and optional Teams integration
- Use dynamic distribution groups for org-wide or department-wide lists to eliminate manual membership maintenance — but enforce directory attribute hygiene first
- Always preview dynamic membership with Get-Recipient -RecipientPreviewFilter before announcing a new dynamic group
- Leave "external senders" disabled on internal groups; enable it deliberately only for groups meant to receive outside email (e.g. info@, careers@)
- Set AddOrganizerToSubject on room mailboxes so room calendars show who booked each slot
- Use delegate approval (AutoUpdate + ResourceDelegates) for high-demand or restricted resources; AutoAccept for everything else
- Use mail contacts, not shadow user accounts, for external people who only need to appear in the GAL or in distribution lists
🎓 Interview Q&A
Q: What four group types can be created in the Exchange Admin Center?
Per Microsoft's EAC documentation: Microsoft 365 Groups (full collaboration with shared inbox, files, calendar, and optional Team), distribution groups (email-only static lists), mail-enabled security groups (security principal that also receives email), and dynamic distribution groups (membership computed from recipient filters at send time).
Q: How is dynamic distribution group membership determined, and how do you check who will receive a message?
Membership is not stored — Exchange Online evaluates the group's recipient filter each time a message is sent and delivers to everyone matching at that moment. To preview membership: retrieve the group with Get-DynamicDistributionGroup, then run Get-Recipient -RecipientPreviewFilter using the group's RecipientFilter property.
Q: When would you use a mail-enabled security group instead of a distribution group?
When the same set of people needs both a shared email address AND access permissions to a resource — for example, a Finance team that receives finance@ email and needs access to a restricted SharePoint library. A distribution group cannot be used to grant permissions; a mail-enabled security group can do both. Note the conversion is one-way in practice: you choose Security type at creation (New-DistributionGroup -Type Security).
Q: External customers emailing your support distribution group receive NDRs, but internal staff can email it fine. Why?
The group has sender authentication required enabled — the default for new groups — which rejects mail from unauthenticated (external) senders. Fix it in the EAC group settings ("Allow external senders to email this group") or via PowerShell: Set-DistributionGroup -RequireSenderAuthenticationEnabled $false.
Q: What is the difference between a mail contact and a mail user?
A mail contact is only a GAL entry pointing at an external address — no credentials, no sign-in, no directory account privileges. A mail user is a real account in your directory that can sign in and access resources (SharePoint, apps), but its email address is external and it has no Exchange Online mailbox. Use contacts for address-book visibility; use mail users for contractors needing authenticated access without a mailbox.
🎯 MS-203 Mock Test
Module 3 — Exchange Online: Groups, Resources & Contacts
Question 1 of 5
The Finance team needs a single email address that receives departmental mail AND grants its members access to a restricted SharePoint document library. Which object should you create?
✅ Correct answer: C. Only a mail-enabled security group is both a security principal (can be granted permissions on SharePoint) and an email recipient. Distribution groups (A) and dynamic distribution groups (B) cannot secure resources. A shared mailbox (D) provides a mailbox, not group-based permission assignment.
Question 2 of 5
A user transfers from Marketing to Sales and their Department attribute is updated. The organisation uses a dynamic distribution group "All Sales" filtered on Department = Sales. What must an administrator do so the user receives future All Sales messages?
✅ Correct answer: B. Dynamic distribution groups store no member list — the recipient filter is evaluated every time a message is sent. Once the Department attribute is Sales, the user matches the filter and receives the next message. Add-DistributionGroupMember (C) does not work on dynamic groups at all.
Question 3 of 5
A boardroom must automatically accept bookings when free, reject double-bookings, and limit meetings to 4 hours. Which PowerShell command applies this policy?
✅ Correct answer: A. Set-CalendarProcessing controls resource booking. AutoAccept enables fully automatic processing, AllowConflicts $false rejects double-bookings, and MaximumDurationInMinutes 240 caps meetings at 4 hours. AutoUpdate (C) marks requests tentative pending delegate action — not automatic acceptance.
Question 4 of 5
External customers emailing careers@contoso.com (a distribution group) receive delivery failures, while internal employees can email it successfully. What should you change?
✅ Correct answer: D. New groups require sender authentication by default, rejecting external mail. Run Set-DistributionGroup -RequireSenderAuthenticationEnabled $false (or toggle "Allow external senders" in the EAC group settings). A connector (A) is unrelated to group-level sender restrictions, and adding contacts (B) does not bypass authentication requirements.
Question 5 of 5
A contractor keeps their own external mailbox at their company but needs to sign in to your tenant to access SharePoint and internal apps. They should also appear in the GAL with their external address. Which object should you create?
✅ Correct answer: B. A mail user is a directory account with sign-in credentials (can access SharePoint and apps) whose email address is external — no Exchange Online mailbox is provisioned. A mail contact (A) cannot sign in at all. A user mailbox with forwarding (D) consumes a license and creates an unnecessary mailbox.
🔒
This module is lockedComplete Module 2 and pass its mock test to unlock this module.