MSCE French cheat sheet

Exchange role split: Mailbox server hosts databases and transport; Client Access services front client protocols (MAPI over HTTP, EAS, IMAP, POP, Outlook on the web); Edge Transport sits in the perimeter and handles internet SMTP with anti-spam agents.

Send/receive connector logic: a send connector is selected by address space and cost (lowest cost wins, then closest proximity); receive connectors are bound to a local IP/port and selected by remote IP range and authentication type.

Database copy limits per server depend on edition and version; a database can hold one active copy and multiple passive copies, and each mailbox server has a maximum active-database count that constrains the DAG layout.

DAG requires Windows Failover Clustering; the quorum model is node majority with witness (file share or disk witness) when the node count is even, and node majority alone when odd.

Name resolution: the DAG uses a cluster name object (or administrative access point for IP-less DAGs); clients connect to a namespace served by load balancing, not to individual servers.

Mail flow path: internal sender to Mailbox transport submission, to Transport service on the same or another server, to the destination mailbox; internet-bound mail exits through a send connector to Edge or a smart host.

Accepted domains: authoritative (recipient exists locally, NDR if not), internal relay (unknown recipients forwarded), and external relay (forwarding to external domains); relay domains require explicit send connectors.

Address policies and connectors are scoped by recipient filter and by server or organization scope; organization-scoped objects replicate via Active Directory, server-scoped objects live in the transport configuration of that server.

Authentication methods rank strongest to weakest: certificate-based, Kerberos/NTLM integrated, then basic; disabling basic authentication on client protocols forces modern auth and blocks credential replay.

SMTP TLS: opportunistic TLS encrypts only when the peer offers STARTTLS; forced TLS requires a matching certificate and a configured domain-secured connector or Receive connector with certificate validation.

Anti-malware scanning operates on transport; anti-spam agents include connection filtering (IP block lists), sender filtering, recipient filtering, content filtering (SCL), and sender ID.

SCL thresholds: SCL at or above the quarantine threshold diverts to the spam quarantine; SCL at or above the delete threshold is dropped silently; SCL -1 bypasses content filtering.

Transport rules evaluate conditions, exceptions, and actions in priority order; a rule can stamp a header, redirect, block, or apply rights protection, and rules apply to messages in transit, not to mailbox contents.

Role Based Access Control: management role groups assign roles to users; role assignment policies govern what end users can configure on their own mailboxes; scope limits which objects a role applies to.

Permissions model: Full Access, Send As, and Send on Behalf are distinct; Send As requires the right on the target mailbox and does not alter the From address display, while Send on Behalf shows the delegator.

Message encryption options: S/MIME for end-to-end signing and encryption, IRM/OME for rights-managed mail that travels outside the organization, and TLS for transport hop protection only.

High availability components: DAG for mailbox database redundancy, network load balancing for client access, and transport high availability via shadow redundancy and the safety net.

Database availability: a database needs a majority of DAG members healthy to mount; failover occurs automatically on active copy failure, and switchover is a manual activation of a passive copy.

Content index and log truncation: passive copies replay logs and re-index; truncation happens only after all copies (or the required minimum) have committed the logs.

Backup types: full, copy, incremental, and differential; the Exchange-aware VSS writer truncates logs after a successful full or incremental backup, and circular logging disables that truncation benefit.

Recovery scenarios: dial tone database (empty DB mounted to restore service, then merged), recovery database (restore and extract mailboxes), and lagged copy (delayed replay for point-in-time recovery).

RPO and RTO drive design: lagged copies set replay lag and truncation delay to bound RPO; DAG copy count and activation preference bound RTO during a site or server loss.

Single item recovery and the dumpster: deleted items are retained for the deleted item retention period, and litigation hold or in-place hold preserves items regardless of user deletion.

Monitoring signals: replication health (copy queue and replay queue lengths), database copy state, mailbox server health, and transport queue length; sustained queue growth indicates a downstream failure.

Retention policy tags: retention tags apply at mailbox (default), folder, or personal scope; a retention policy is a set of tags assigned to a mailbox, and managed folder mailbox policies are the legacy predecessor.

Retention actions: delete and allow recovery (moves to Recoverable Items), permanently delete, and move to archive; the move-to-archive action requires an archive mailbox and works only for default or personal tags.

In-place hold and litigation hold preserve deleted and modified items in Recoverable Items; litigation hold is mailbox-wide, while in-place hold supports query-based filtering by sender, recipient, keywords, or date range.

Journaling captures a copy of all messages sent and received by journaled recipients; standard journaling records envelope recipients, while premium journaling adds scope and content filtering.

Archive mailbox: an additional mailbox for a user, either on-premises or cloud-based; auto-expanding archives remove the size ceiling, and retention policies move items into the archive over time.

eDiscovery workflow: create a case, place sources on hold, run a search with keywords and date filters, preview statistics, then export; search results can be copied to a discovery mailbox.

Data loss prevention evaluates sensitive information types with confidence levels and can block, encrypt, or notify; policy tips surface to senders during composition, and transport rules can enforce similar actions.

Message records management uses labels and file plan descriptors to classify content for retention and disposition; disposition review holds items for human approval before permanent deletion.

Coexistence prerequisites: matching accepted domains, send/receive connectors between organizations, and a shared namespace with Autodiscover pointing clients to the correct system during the transition.

Migration types: cutover (single forest, all mailboxes at once), staged (batch of mailboxes over time), hybrid (ongoing coexistence with cloud mailboxes), and IMAP or PST-based migrations for non-Exchange sources.

Hybrid requirements: directory synchronization, Exchange hybrid license on the on-premises servers, an organization relationship, OAuth or federation trust for free/busy, and a hybrid agent or Exchange server for mailbox moves.

Mailbox move batches: move requests are created per batch, throttled by concurrency limits, and can be validated with a test move; the source mailbox remains accessible until the final switchover completes.

Client access namespace planning: use a load-balanced virtual IP per service, keep internal and external URLs consistent, and publish Autodiscover, EWS, MAPI over HTTP, and OAB endpoints through the reverse proxy.

Certificate planning: the certificate must contain all published names (mail, autodiscover, and service names) and be trusted by clients; wildcard certificates simplify but do not cover multi-level names.

Pilot and validation: run a pilot batch first, verify mail flow in both directions, free/busy, calendar and delegate permissions, and public folder access before migrating the bulk of users.

Decommissioning: remove the hybrid configuration and connectors, redirect or remove DNS records, and confirm no mail flow or Autodiscover dependency remains before retiring on-premises servers.