MS POST key terms

A domain name that an Exchange organization is configured to receive mail for. Its type (authoritative, internal relay, or external relay) determines whether Exchange treats the domain as local or forwards messages elsewhere.

An accepted domain for which Exchange is the final destination for all recipients. Mail to unknown addresses in that domain is rejected with a non-delivery report instead of being relayed.

An accepted domain where Exchange delivers mail for known recipients but forwards messages for unknown recipients to another mail system, typically through a send connector scoped to that address space.

A configuration object that defines how outbound mail leaves the organization, including source servers, address space, cost, and the smart host or DNS routing used for delivery.

A server-level object that controls which remote hosts and IP ranges may connect to a specific transport service and which authentication mechanisms, such as TLS or Exchange server authentication, are permitted.

An intermediate SMTP server through which a send connector routes mail instead of performing direct DNS resolution. Commonly used for outbound hygiene appliances or third-party relay services.

A DNS resource record that publishes the mail exchanger for a domain, with a preference value. Inbound internet mail follows these records unless a third-party filtering layer fronts the domain.

A DNS TXT record that lists the hosts authorized to send mail for a domain. Receiving systems use it to detect spoofing, and it must include all outbound sources such as third-party services.

A signing mechanism that adds a cryptographic signature to outbound messages so receivers can verify the message was authorized by the domain and was not altered in transit.

A published policy that tells receivers how to handle mail failing SPF and DKIM alignment, with modes of none, quarantine, or reject, plus reporting addresses for aggregate and forensic reports.

Also called a mail flow rule, it evaluates message conditions such as sender, recipient, subject, or attachment properties and applies actions like blocking, redirecting, adding headers, or modifying classification.

A set of rules that detects sensitive information types in messages and applies actions such as blocking, encrypting, or notifying users, often with policy tips shown in supported clients.

Configuration that decides which filtered messages are held rather than delivered or deleted, who is notified, and whether recipients or administrators can release items and request false-positive review.

Settings that control impersonation protection for users and domains, mailbox intelligence, spoof intelligence, and the actions taken when a message is judged to be a phishing attempt.

A policy that rewrites and checks URLs in messages at delivery and click time, blocking or warning on malicious destinations. It can also apply to Teams and Office applications.

A policy that detonates attachments in a sandbox before delivery and takes a configured action, such as block, replace, or dynamic delivery, when malware is detected.

An identity-driven policy that grants or blocks access to services based on signals such as user or group, device state, location, and sign-in risk, often requiring multifactor authentication or a compliant device.

Token-based authentication using OAuth 2.0 and Microsoft Entra ID, replacing basic authentication for client access to mailboxes and enabling features such as multifactor authentication and Conditional Access.

A legacy credential method that transmits a username and password with each request. It is disabled by default in cloud services and blocked for most protocols in current Exchange deployments.

A per-organization or per-user setting that controls whether legacy protocols such as IMAP, POP, SMTP AUTH, or Exchange ActiveSync may use basic authentication for a mailbox.

A rule that allows or blocks client connections to Exchange services based on attributes such as protocol, IP address, user, or authentication type, applied before authentication completes.

A collection of Outlook on the web settings applied to mailboxes, covering features such as attachments, calendar sharing, themes, and session timeouts, assigned per mailbox or to a whole organization.

A set of role assignments that determines which self-service mailbox features, such as voicemail, distribution group membership, or profile updates, a user can manage through Outlook on the web.

A security principal that bundles management roles with members, granting administrators or helpdesk staff permission to perform specific tasks in the Exchange admin center or PowerShell.

A filter that limits which objects a role assignment can act on, such as restricting a helpdesk group to mailboxes in a specific organizational unit or with a particular attribute.

A policy that presents a filtered subset of the global address list, offline address book, room list, and GAL to assigned mailboxes, commonly used to isolate tenants or business units.

A mailbox without its own credentials that multiple users access through delegated permissions. It can be converted to a regular mailbox and is licensed differently from user mailboxes.

A mailbox permission that lets a delegate open and read the mailbox and manage its contents, but does not by itself grant the right to send messages as the mailbox owner.

A permission that allows a delegate to send messages that appear to come directly from the mailbox or group, with no indication of the delegate in the From field.

A permission that lets a delegate send messages showing both the delegate and the mailbox owner in the From field, making the delegation visible to recipients.

A mail-enabled object that expands to a list of recipients for message delivery. Unlike security groups, it cannot be used to assign permissions to resources.

A recipient group whose membership is recalculated from a recipient filter or organizational unit at send time, so membership changes automatically as directory attributes change.

A set of conditions based on recipient properties, such as department or custom attribute, used to build dynamic distribution groups or address list membership without manual enumeration.

A policy that applies retention tags to mailbox items so content is moved to an archive or deleted after a defined period, supporting compliance and mailbox size management.

A mailbox setting that preserves deleted and modified items indefinitely for legal purposes, with optional hold duration and a query filter narrowing which items are held.

A guided tool that configures the objects and connectors needed to connect an on-premises Exchange organization with a cloud service, including the hybrid agent or full classic topology.

A lightweight application published through Microsoft 365 that provides inbound connectivity to on-premises mailboxes for hybrid features, reducing the need for published Exchange endpoints.

The trust and service principal objects created between on-premises Exchange and the cloud identity service so features such as free/busy lookup and mailbox moves can authenticate across environments.

The configuration that lets users in one environment view calendar availability of users in the other, typically implemented with an availability address space and an organization relationship.

A trust object that defines which external domains can share free/busy, calendar, or contact data with the organization and which level of access is granted.

A managed set of mailboxes moved between environments, with direction, endpoint, and schedule settings. It reports per-user status and can be completed or rolled back.

The connection information, such as a remote server URL and credentials, that a migration batch uses to reach the source mail system and read mailbox data.

A migration approach that moves all mailboxes from a small on-premises organization in one or a few batches, then repoints mail flow and retires the source server.

A migration approach for larger deployments where batches are moved over time, allowing coexistence between source and target organizations until all mailboxes are transferred.

A request object that tracks the movement of a single mailbox between databases or environments, including status, priority, and options such as primary-only or archive-only moves.

Role-based access control, the authorization model in Exchange that assigns management roles to role groups or users and limits their effect through scopes.