GAL Segmentation and Room Booking Across Five Brands
A holding company operates five brands with 12,000 mailboxes in Exchange Online. All brands share one tenant and one default GAL, and an internal audit found that Brand A staff can see Brand B's executives and distribution lists. Each brand has departments of 200 to 500 people. The company has 600 conference rooms across 40 sites, and room booking is currently done by delegates. HR wants a 3-year retention policy for employee mailboxes and a 90-day policy for contractor mailboxes; legal wants litigation hold on 50 custodians. The service desk reports that Outlook users see outdated address lists and that room lists return every room in the company. No address book policies exist. Mobile devices use the native mail app.
1. Design address book policies for the five brands and explain three reasons a Brand A user may still see Brand B recipients after the ABP is assigned.
Read the worked answer
An ABP contains one GAL, one OAB, one room list, and a set of address lists. Create a GAL per brand with a recipient filter, for example Department -eq 'Brand A' or a custom attribute, an OAB per brand, brand-specific address lists, and a room list per brand. Create five ABPs and assign exactly one to each mailbox with Set-Mailbox -AddressBookPolicy.
Three reasons a Brand A user may still see Brand B:
- The ABP was not assigned to that mailbox, or the mailbox was created after the rollout and missed assignment.
- The user's Outlook is reading a cached OAB or the native mobile mail app queries the GAL directly, so the change has not propagated.
- ABPs only filter address book views. A user who knows a Brand B SMTP address can still send to it, and distribution group membership can reveal members.
Also check that the default GAL is not still referenced by the ABP and that the recipient filter is not based on a field that is blank for contractors. ABPs are not a security boundary; pair them with a transport rule if cross-brand mail must be blocked.
2. Propose a room mailbox and room list design for 40 sites and 600 rooms, and a booking policy that prevents double-booking and reduces delegate load.
Read the worked answer
Create one room mailbox per room, named with a consistent convention such as site-floor-capacity, and one room list per site, plus per floor for large sites. Room lists are distribution groups that contain only room mailboxes; keep them under 100 rooms per list where possible and create multiple lists per site if needed.
Set each room mailbox to auto-accept with Set-CalendarProcessing: -AutomateProcessing AutoAccept, -AllowConflicts $false, -EnforceCapacity $true, -BookingWindowInDays 180, -MaximumDurationInMinutes 480, -AllowRecurringMeetings $true but -ProcessExternalMeetingMessages $false unless needed. Remove delegate approval for standard rooms to cut the delegate load; keep a delegate only for executive rooms. Publish the room lists in the room finder.
For double-booking, auto-accept plus conflicts disabled prevents it, but recurring meetings need a policy: allow series only within the booking window and require the organizer to include an end date. Do not auto-accept every room: training rooms and boardrooms may still need approval, so use a separate room mailbox policy.
3. How would you apply the 3-year employee, 90-day contractor, and litigation hold requirements? Identify the conflict and its resolution.
Read the worked answer
MRM retention policies are one per mailbox, so you cannot assign a 3-year and a 90-day policy to the same mailbox. Create two retention policies: Employee-3Year with a default tag that deletes or archives at 3 years, and Contractor-90Day with a default tag at 90 days; assign them by recipient type or department.
Litigation hold is separate and overrides deletion: items in a mailbox on hold are preserved even if the retention tag would delete them. That is the conflict: a contractor on hold will not lose mail at 90 days, which is legally correct but may surprise HR. Resolve it by documenting that holds take precedence and by using retention labels for specific content if needed. For the 50 custodians, use eDiscovery holds or In-Place Hold and record the hold date and scope. Test with a pilot mailbox and use Start-ManagedFolderAssistant to force processing. Do not try to solve this with transport rules; retention is a mailbox property.