MS POST common mistakes
MS POST · Understand the traps and how to avoid them.
When asked to design a mail flow path, the candidate creates a single send connector scoped to the whole organization and leaves the source transport servers as Hub Transport role defaults, then cannot explain why messages from a newly added mailbox server route through an unintended site.
Candidates memorize 'create a Send connector' steps but never internalize that connector source servers, address spaces, cost, and scoping determine routing; in hybrid scenarios they also forget that the Exchange Online outbound connector and on-premises receive connector must be paired.
What to do instead
Before answering, draw the routing topology: name each connector, its type (Send/Receive), source servers, address space, cost, and whether it is scoped. Verify that the outbound-to-EXO path and the inbound-from-EXO path are each explicitly defined, and check that any new Mailbox server is added as a source server where required.
The candidate configures the hybrid agent or HCW and assumes mail flow is complete, without validating the coexistence of the on-premises accepted domain, the remote domain, and the Autodiscover records, so the answer omits the required DNS and certificate prerequisites.
Hybrid questions are usually framed as 'run the wizard', but the exam tests the prerequisites that make the wizard succeed: a routable accepted domain, an Exchange Online tenant, a public certificate covering mail and Autodiscover, and the connector pair.
What to do instead
List the hybrid prerequisites in order: verified tenant domain, accepted domain on-premises, OAuth/Intra-Organization connector, public certificate with the right SANs, Autodiscover DNS, and the Hybrid Configuration object. State which component fails if each is missing.
When a question asks how to restrict which clients can authenticate, the candidate applies an organization-wide authentication policy or disables basic auth globally instead of scoping the change to the affected protocol, virtual directory, or mailbox plan.
Candidates conflate authentication policy (which controls modern auth methods per mailbox), client access rules, and protocol-level settings on virtual directories; they answer with the broadest control rather than the narrowest correct one.
What to do instead
Map each control to its scope: authentication policies target mailboxes; Client Access Rules target protocol/client/property combinations; virtual directory settings target the protocol endpoint; Conditional Access targets the identity provider. Choose the control whose scope matches the requirement.
The candidate answers a permissions question by adding the user directly to a role group or assigning a management role at the organization scope, when the requirement is to delegate a narrow task on a single mailbox or database.
Role Based Access Control has three layers (management role, role assignment, role group/scope) and candidates collapse them, forgetting that management scopes and recipient scopes limit where an assignment applies.
What to do instead
State the role, the assignee (user or group), and the scope (organization, OU, database, or recipient filter) explicitly. Use the least-privileged role that grants the task and confirm the scope excludes unrelated recipients.
For a mailbox migration question, the candidate selects a cutover or staged migration for a large multi-thousand-mailbox on-premises deployment, or proposes a hybrid migration without first establishing directory synchronization.
Candidates remember migration type names but not the decision criteria: mailbox count, whether directory sync exists, whether coexistence is required, and whether the source is Exchange 2010+ or legacy.
What to do instead
Apply the decision tree: cutover for small single-forest moves with no coexistence; staged for legacy coexistence; hybrid for large or long-term coexistence with dirsync; IMAP for non-Exchange sources. Confirm directory synchronization and licensing before naming the migration batch.
The candidate describes anti-spam or anti-malware protection only in terms of the default policy and forgets that transport rules, the malware filter, and the connection filter each act at a different point in the pipeline.
The security domain blends several independent controls, and candidates answer with 'enable the anti-spam policy' without identifying which control blocks the described message (connection filtering by IP, content filtering by score, transport rules by condition, quarantine by action).
What to do instead
For each scenario, identify the pipeline stage: connection filter (sender IP), malware filter (attachment), transport rule (header/recipient condition), content filter (spam score/action), and quarantine policy (retention and notification). Name the stage and the specific policy object.
When asked to configure a shared mailbox or resource mailbox, the candidate sets the mailbox type at creation but omits the send-as/send-on-behalf permissions, calendar processing, or the fact that shared mailboxes do not require a license for the mailbox itself.
Candidates treat all mailbox types as interchangeable and forget the permission model and the licensing nuance, so the answer fails the 'can the delegate actually send as the mailbox' check.
What to do instead
For each mailbox type, state: who is licensed, which permissions are needed (FullAccess, SendAs, SendOnBehalf), and which cmdlet or admin center setting grants them. For resource mailboxes, state the calendar processing policy (auto-accept, booking window, conflicts).
The candidate answers a mail flow rule question with a single transport rule that combines conditions and exceptions incorrectly, or forgets that transport rules are evaluated in priority order and that a rule can be stopped by a later rule with a StopProcessing action.
Transport rules look like simple if/then statements, but priority, the StopProcessing action, and the difference between 'except if' and a separate lower-priority rule change the outcome.
What to do instead
Write the rule as condition, exception, action, and priority. State explicitly whether StopProcessing is used and which rule runs first. Test the logic against the scenario's edge case (for example, an internal sender who matches the exception).
The candidate describes a hybrid migration of authentication by moving users to modern auth but leaves the on-premises Autodiscover or the legacy protocol enabled, so clients fall back to basic auth and the answer does not actually close the gap.
Authentication questions test the interaction between client capability, server configuration, and the identity provider; candidates change one layer and assume the others follow.
What to do instead
State the three layers: client (supports modern auth), server (virtual directory auth methods, allowed protocols), and identity (Conditional Access, MFA). Confirm that legacy protocols are disabled or blocked and that Autodiscover returns the correct endpoint for each client type.
The candidate answers a recipient management question by editing the user object in Active Directory Users and Computers rather than using the Exchange management tools, or forgets that on-premises recipients must be mail-enabled before they appear in address lists.
Candidates mix the AD and Exchange administrative surfaces and forget that mailbox, mail user, mail contact, and distribution group are distinct recipient types with different attribute requirements.
What to do instead
Name the recipient type first (mailbox, mail user, mail contact, distribution group, dynamic distribution group, shared mailbox), then the tool that manages it (Exchange admin center or Exchange Management Shell), then the attributes required for it to be addressable and to appear in address lists.