MS POST cheat sheet

Exchange admin roles are role-based access control (RBAC) objects: management role groups assign roles to administrators, while role assignment policies assign end-user roles such as MyVoiceMail or MyDistributionGroups.

Accepted domains have three types: Authoritative (mailbox delivery), Internal Relay (recipient not in this organization is relayed via Send connector), and External Relay (relay for an external domain).

An email address policy generates proxy addresses for recipients; the policy with priority 0 is applied first, and the last applied policy wins for a conflicting address type.

Address book policies (ABPs) scope a user's GAL, offline address book, room list, and address lists; assigning an ABP requires the Global Address List segregation to be pre-created with address list and OAB objects.

Organization relationships enable free/busy, calendar, and contact sharing with another Exchange forest; sharing policies control which calendar or contact data is shared with external or federated domains.

Retention policies apply retention tags (default, RPT, and personal) to mailbox folders; a retention policy is assigned per mailbox, and managed folder mailbox policies are the legacy equivalent.

Mailbox quotas use IssueWarningQuota, ProhibitSendQuota, and ProhibitSendReceiveQuota; exceeding ProhibitSendReceiveQuota returns a mailbox-full NDR to senders.

Exchange Server 2019 supports coexistence with Exchange 2016; Exchange 2013/2010 coexistence requires specific update levels, and the /PrepareAD, /PrepareSchema, and /PrepareAllDomains switches extend the schema and configure permissions.

The transport pipeline order is: Front End Transport (Client Frontend, Default Frontend receive connectors) → Transport service (Submission, Categorizer, Mailbox Transport Delivery/Submission) → Mailbox Transport service.

Send connectors on a Mailbox server route outbound mail; a SourceTransportServers list defines which servers use the connector, and address spaces define which recipient domains it matches.

Receive connectors are scoped to a transport role (FrontendTransport, HubTransport, or HubTransport with Custom usage) and bind to a local IP/port; default connectors exist on port 25 for Frontend and Hub.

Categorizer resolves recipients, expands distribution groups, applies transport rules, and applies journaling; transport rules evaluate in priority order and stop processing when a StopProcessing action runs.

Shadow redundancy keeps a shadow copy of a message in the Transport service until delivery is confirmed; XSHADOW and XATTRIBUTE commands in SMTP EHLO control the behavior.

Safety Net (Exchange 2013+) stores copies of delivered messages for a configurable period (default 2 days) and resubmits them after a mailbox database failover; it replaces transport dumpster.

Connector selection for outbound mail: the Send connector with the most specific address space match wins; equal matches use lowest cost, then the connector with the most recent modification.

A Send connector with the Internal usage type is used for mail relayed between internal servers; Internet usage type is for external delivery.

Message tracking logs record every transport event; Get-MessageTrackingLog filters by sender, recipient, and event ID (e.g., DELIVER, FAIL, RECEIVE).

The Hybrid Configuration wizard (HCW) configures the Hybrid Agent or classic hybrid; it provisions the federation trust, OAuth, and the Intra-Organization connector and requires an Exchange hybrid license key.

Hybrid requires an Exchange server (or Exchange Server 2016/2019 in the on-premises environment) to manage recipients; Exchange Online does not remove the need for on-premises Exchange for recipient management.

The Hybrid Agent uses outbound-only connections from on-premises to Exchange Online; classic hybrid requires publishing the EWS, Autodiscover, and SMTP endpoints.

Migration batches: Cutover (all mailboxes at once, no coexistence), Staged (legacy, coexistence with Exchange 2003/2007), and Hybrid (coexistence with Exchange 2010+).

A migration endpoint defines the source server connection; for IMAP it uses port 993, for Exchange it uses EWS, and for cutover/staged it uses MRSProxy on the Client Access server.

After a hybrid mailbox move, on-premises mailbox becomes a mail-enabled user (MEU) with a targetAddress; remote mailbox objects are managed with Enable-RemoteMailbox and Disable-RemoteMailbox.

Free/busy between on-premises and Exchange Online requires OAuth (Exchange Online) and the organization relationship plus the Availability address space configured by HCW.

The HCW must be run from a server with the Exchange Trusted Subsystem and must use an account with Organization Management; the wizard creates the Federation Trust and the OAuth configuration.

Exchange uses the Anti-Malware agent (MalwareFilter) and transport rules; the built-in malware agent scans attachments and can be disabled per-server with Set-TransportAgent or Set-MalwareFilteringServer.

Anti-spam agents (Content Filter, Sender Filter, Recipient Filter, IP Block List, Sender ID, and Connection Filter) run on Edge Transport servers or on Mailbox servers when the Anti-Spam agents are installed.

Transport rules can apply rights protection (IRM), moderation, and disclaimer actions; the ApplyHtmlDisclaimer action supports append, prepend, or wrap.

S/MIME uses certificates for message signing and encryption; the certificate must be published in Active Directory or exchanged between parties.

Exchange supports TLS via Receive/Send connectors; the connector's TlsCertificateName and RequireTLS settings enforce encryption, and Domain Secure (mutual TLS) requires the TLSSendDomainSecureList.

Message encryption options: Office 365 Message Encryption (OME) with Azure Information Protection (AIP) uses encryption templates; the older OME uses transport rules with the Encrypt action.

Auditing: mailbox audit logging records owner, delegate, and admin access; admin audit logging records cmdlet execution. Both are enabled per-mailbox or per-organization.

Role Based Access Control: management role assignments can be scoped with management scopes (recipient, server, or database scope) and applied to role groups, users, or universal security groups.

Transport rule priority: lower number = higher priority; rules run in order and a StopProcessing action halts evaluation of later rules.

A transport rule can be scoped with a predicate (From, To, Subject, message size, attachment) and an action (redirect, reject, add header, BCC, moderate).

Moderation: a moderated recipient has a moderator who approves or rejects; the arbitration mailbox stores the approval messages.

Distribution group expansion: nested groups expand during categorization; a group can be restricted to authenticated senders with RequireSenderAuthenticationEnabled.

Connector selection for outbound mail uses address space specificity, then cost; a Send connector with scoped address space (e.g., *.contoso.com) wins over a * connector.

Queue management: Get-Queue shows queues; Retry-Queue and Suspend-Queue control them; a poison message queue holds messages that repeatedly crash the transport service.

Journaling: standard journaling records all messages to/from a mailbox database; premium journaling uses journal rules to target specific recipients and stores messages in a journaling mailbox.

Mail flow diagnostics: Test-Mailflow tests delivery between servers; Test-SmtpConnectivity tests SMTP connectivity on receive connectors.

Accepted domain type affects relay: an Internal Relay domain requires a Send connector for mail to that domain, or the message is rejected as unresolvable.

Recipient types: user mailbox, shared mailbox, room mailbox, equipment mailbox, linked mailbox, resource mailbox, mail-enabled user, mail contact, distribution group, mail-enabled security group, and dynamic distribution group.

A shared mailbox has no license required for the mailbox itself (Exchange Online) but requires a license for the account if it has more than 50 GB or needs archive; delegates access it via FullAccess and SendAs.

Room and equipment mailboxes are resource mailboxes; booking policies (AllowConflicts, BookingWindowInDays, MaximumDurationInMinutes) control calendar behavior.

Dynamic distribution groups use an OPATH or recipient filter to compute membership at query time; membership is not stored.

Mailbox move requests use the Mailbox Replication Service (MRS); Get-MoveRequest and Get-MoveRequestStatistics track progress, and New-MoveRequest requires the target database.

Disabled mailboxes retain mailbox data for the RetentionHold or DisconnectedMailbox retention period; Connect-Mailbox reconnects a disconnected mailbox to an existing or new user account.

Mailbox permissions: FullAccess, SendAs, SendOnBehalf, and mailbox folder permissions; SendAs is granted via Add-RecipientPermission, FullAccess via Add-MailboxPermission.

Archive mailboxes: in-place archive requires an Exchange Enterprise CAL (on-premises) or an Exchange Online Archiving license; the archive is a separate mailbox database in Exchange.

Distribution group management: group owners can manage membership if the group is set with ManagedBy; member join/leave restrictions are set with MemberJoinRestriction.

Client access authentication methods: Basic, NTLM, Kerberos, OAuth, and forms-based (legacy); Outlook on the web (OWA) virtual directory uses forms-based or Windows authentication.

Modern authentication (OAuth 2.0) is required for Exchange Online; disabling it blocks Outlook clients that rely on basic authentication, which Microsoft retired.

MFA: Exchange Online supports MFA via Azure AD; on-premises Exchange supports MFA via ADFS or third-party providers, not native MFA.

ActiveSync device access: device access rules (Allow, Block, Quarantine) are set per organization, per group, or per user; quarantine holds devices until an admin approves them.

Outlook on the web mailbox policies control features (e.g., calendar, tasks, file access, and the ability to change password); one policy is assigned per mailbox.

ActiveSync mailbox policies control device settings such as password requirements, attachment size, and device encryption; one policy is assigned per mailbox.

Client Access rules (Exchange 2019/2016) filter connections by protocol, IP range, and authentication type; they can block or allow access to virtual directories.

Autodiscover: the SCP in Active Directory is used by domain-joined clients; external clients use the Autodiscover DNS record (autodiscover.contoso.com) and HTTPS redirects.

OAuth and hybrid: the OAuth configuration and the Intra-Organization connector are required for free/busy and cross-premises permissions between Exchange Online and on-premises Exchange.