CC-CEM cheat sheet

Deployment patterns: (a) MX-to-cloud native, (b) gateway/hybrid with on-prem smart host, (c) coexistence with split routing via directory sync, (d) journaling/archiving offload.

MX record priority determines inbound path; lowest preference wins. Multiple equal-preference MX records imply load distribution and must all be reachable and authenticated.

Cloud mail flow components: inbound connector/gateway, transport rule engine, mailbox store, outbound relay, journal/archive sink. Each hop adds a Received header.

Hybrid coexistence requires bidirectional connector trust (TLS certificate or IP allowlist) plus accepted-domain configuration (authoritative vs. internal relay vs. external relay).

Accepted domain types: authoritative (cloud delivers to mailboxes), internal relay (cloud forwards to on-prem), external relay (cloud forwards to third party). Misclassification causes NDR loops.

Directory synchronization scope: users, groups, contacts, and mail-enabled public folders. Sync latency affects address resolution and free/busy; plan for a 15-30 minute propagation window.

High availability: cloud providers replicate mailbox databases across availability zones; client access uses DNS-based failover. On-prem connectors remain a single point of failure if not paired.

Message size, recipient, and hop-count limits are enforced per transport service; large attachment handling should use shared links rather than inline MIME.

SPF: TXT record at the envelope domain. Evaluates MAIL FROM against authorized IPs. Limit of 10 DNS-lookup mechanisms (include, a, mx, ptr, exists); exceeding yields permerror.

SPF results: none, neutral, pass, fail, softfail, temperror, permerror. Only pass authorizes; softfail and neutral are non-committal.

DKIM: signs selected headers plus body hash with a private key; public key published at selector._domainkey.domain. Canonicalization (relaxed/simple) must match between signer and verifier.

DKIM alignment for DMARC compares the d= domain against the From header domain (relaxed = organizational domain match; strict = exact match).

DMARC policy p=none|quarantine|reject, with pct for partial rollout, sp for subdomains, adkim/aspf for alignment mode, and rua/ruf for aggregate and forensic reporting.

DMARC requires at least one aligned authenticated identifier (SPF with aligned envelope domain, or DKIM with aligned d=). SPF pass alone with unaligned domain does not satisfy DMARC.

ARC seals a message with three header sets (AAR, AMS, AS) so that forwarding intermediaries' authentication results survive; ARC validation is separate from DMARC pass.

Reporting: rua aggregate XML reports arrive daily; ruf forensic reports are rare because most receivers redact or suppress them.

Subdomain policy: sp applies to subdomains of the organizational domain; absence of sp means p applies. Organizational domain is derived from the public suffix list.

Detection layers in order: connection filtering (IP reputation), sender authentication, content/spam scoring, URL detonation, attachment detonation, and post-delivery remediation (ZAP-style purge).

BEC indicators: display-name spoofing, reply-to mismatch, newly registered domain, first-time sender, payment or gift-card urgency, and thread hijacking without malicious links.

URL sandboxing: links are rewritten to a time-of-click proxy; detonation occurs on first click or pre-delivery. Time-of-click protection defeats delayed payload activation.

Attachment sandboxing: files run in an isolated VM; verdicts are benign, malicious, or unknown. Password-protected archives typically bypass detonation and require policy to quarantine.

Safe Links and Safe Attachments policies are scoped by recipient, group, or domain; policy order matters when multiple rules apply.

Impersonation protection covers protected users, protected domains, and mailbox intelligence (behavioral graph of prior correspondents).

Quarantine policies define end-user self-release permissions and notification cadence; admin-only review is required for high-confidence malware verdicts.

Anti-phishing thresholds: bulk complaint level, spoof intelligence, and mailbox intelligence confidence levels determine action (move to junk, quarantine, or block).

Outbound controls: TLS enforcement on connectors, outbound spam thresholds, auto-forwarding blocks, and rate limits per sender to prevent compromise-driven mass mail.

Outbound DKIM signing should occur at the last hop before the internet; intermediate gateways must not break the signature by modifying signed headers or body.

DLP policy structure: conditions (sensitive information types, document fingerprints, trainable classifiers), actions (block, encrypt, notify, override), and policy tips.

Sensitive information types use confidence levels (low/medium/high) based on pattern plus corroborative evidence such as keywords or proximity.

Encryption options: transport (opportunistic or forced TLS), message-level (S/MIME or OME), and at-rest (service encryption with customer keys).

Office Message Encryption wraps content in an HTML attachment with a time-limited link; recipients authenticate via one-time passcode or federated identity.

DLP policy evaluation order: the most restrictive matching rule wins unless an override with justification is permitted and logged.

Data loss prevention false positives are tuned via instance counts, unique-match requirements, and exclusion of internal-only recipients.

Residency controls: tenant-level data location, multi-geo mailbox placement, and advanced data residency for Teams/SharePoint content at rest.

Data at rest versus data in transit versus metadata: residency commitments typically cover at-rest storage; routing metadata may traverse other regions.

Regulatory frameworks to map: GDPR (EU data subject rights, 72-hour breach notification), HIPAA (BAA required), CCPA/CPRA, and sector rules such as FINRA retention.

Retention labels versus retention policies: labels apply at item level and can trigger disposition review; policies apply at mailbox or folder scope.

Litigation hold and eDiscovery preserve deleted items in the Recoverable Items folder; the dumpster quota must be raised for long holds.

Customer Lockbox and privileged access management require explicit approval for Microsoft or provider engineer access to tenant content.

Data subject requests require content search across mailboxes, sites, and chats, plus export in a machine-readable format.

Cross-border transfer mechanisms: standard contractual clauses, adequacy decisions, and binding corporate rules.

Authentication methods: password plus MFA, certificate-based auth, FIDO2 security keys, and passwordless (Authenticator, Windows Hello).

Conditional Access evaluates signals (user, device, location, app, risk) and applies grant or session controls; named locations and compliant-device checks are common gates.

Legacy auth protocols (IMAP, POP, SMTP AUTH basic, Exchange ActiveSync basic) bypass MFA and should be blocked by policy.

OAuth app consent and Graph API permissions: delegated (user context) versus application (app-only, admin consent required).

Service principals and managed identities avoid stored secrets; certificate credentials should replace client secrets with rotation schedules.

Role-based access control: least privilege via scoped roles (e.g., View-Only Recipients, Hygiene Management) rather than global admin.

Privileged Identity Management provides just-in-time role activation with approval and time-bound assignment.

API throttling: Graph returns 429 with Retry-After; implementations must honor backoff and batch requests where possible.

Audit log sources: unified audit log (mailbox, admin, eDiscovery events), message trace, transport logs, and Defender/SIEM telemetry.

Message trace retention is typically 10 days in the portal with extended retrieval up to 90 days via historical search or export to storage.

Unified audit log default retention is 180 days; add-on retention can extend to 1 or 10 years with the corresponding license.

Incident response phases: identify, contain (block sender, reset credentials, revoke sessions), eradicate, recover, and lessons learned.

Compromised mailbox triage: review inbox rules, forwarding settings, OAuth grants, sign-in logs, and sent items for phishing propagation.

Forensic artifacts: original message headers (Received chain, Authentication-Results, DKIM-Signature), message-ID, and network message ID for correlation.

Content search and eDiscovery hold preserve evidence; export with hash verification for chain of custody.

Alert policies trigger on admin actions, malware detections, unusual sign-ins, and DLP rule matches; tune to reduce noise.

Migration types: cutover (single batch, small orgs), staged (pilot then batches), hybrid (coexistence with on-prem), and IMAP or third-party migration for non-Exchange sources.

Cutover migration limits: roughly 2,000 mailboxes and requires a single cutover event; larger environments need staged or hybrid.

Migration prerequisites: verified domain, autodiscover, mailbox permissions (ApplicationImpersonation or migration endpoint credentials), and MX cutover timing.

Hybrid requires the Hybrid Configuration Wizard, an accepted domain, federation trust for free/busy, and an Edge or transport certificate.

Change management: use a change advisory process, test in a pilot ring, and maintain rollback plans for MX and connector changes.

Role assignment auditing and periodic access reviews prevent privilege creep; use the principle of separation of duties for admin roles.

Documentation set: mail flow diagram, accepted domains, connector inventory, authentication records, and retention policy map.

Service health monitoring and Message Center advisories drive proactive response to provider-side incidents.