Chapter 4: Managing Exchange Online

If your chosen subscription includes mail from Outlook, you'll be working with Exchange to configure the user experience and security of your mail environment. We'll cover the basics of getting started, as well as a few security features to decrease the likelihood of malicious content reaching your users via Exchange.

We will cover the following recipes in this chapter:

• Creating a user mailbox
• Creating a mail-enabled security group
• Creating a shared mailbox without an O365 group
• Creating a distribution list
• Creating a dynamic distribution list
• Assigning permissions and roles
• Creating an Exchange-specific retention policy
• Creating a mail flow rule
• Configuring spam filter policies
• Creating room and equipment resources
• Enabling advanced threat protection (ATP) features

Technical requirements

There are no technical requirements specific to this chapter, other than needing an Office 365 (O365) subscription and appropriate administrative roles assigned. In most cases, you'll need to be a global or Exchange admin.

Creating a user mailbox

When a user is licensed in O365 under a subscription that includes Exchange, they're automatically allocated a mailbox. This recipe covers how to create a user mailbox through licensing.

How to do it…

1. Go to the Microsoft 365 admin center at https://admin.microsoft.com.
2. Select Users | Active users from the left-hand navigation pane.
3. Select the ellipsis next to an unlicensed user's name and choose Manage product licenses:

   


   Figure 4.1 – A selected user and the Manage product licenses option from the ellipsis menu

4. Choose a location for the user and check a subscription option (such as E3 or E5) that includes Exchange. Click on Save changes:

Figure 4.2 – The Licenses and Apps screen of the user details page

How it works…

You've just created a user mailbox by assigning the user a license for O365. Exchange Online is included in most O365 subscriptions, and users...

Creating a mail-enabled security group

Mail-enabled security groups can be used to assign permissions to their members and provide a shared mailbox for the group. You can create a mail-enabled security group in several locations throughout Microsoft 365, including the Microsoft 365 admin center, Azure Active Directory (AD), and the Exchange admin center. For this recipe, we'll use the Exchange admin center.

Getting ready

You must have an available license from a subscription that includes Exchange to assign to a user.

Getting ready

You'll need to be an Exchange admin, a global admin, or have the Organization Management or Recipient Management roles to complete this recipe's steps.

How to do it…

1. Go to the classic Exchange admin center at https://outlook.office.com/ecp/.
2. Choose groups from beneath the recipients header:

   


   Figure 4.4 – The groups link in the recipients section

3. Select the drop-down arrow next to the New...

Creating a shared mailbox without an O365 group

An O365 group can easily be granted access to several products for the group's usage, such as a Teams team, a SharePoint site collection, and a Planner plan. But sometimes, you just need a shared mailbox for a group of people without any additional applications for collaboration. This recipe outlines the steps to achieving this via the Exchange admin center.

Getting ready

You'll need to be an Exchange admin, global admin, or have the Organization Management or Recipient Management roles to create shared mailboxes.

How to do it…

1. Go to the new Exchange admin center at https://admin.exchange.microsoft.com/.
2. Select Recipients | Mailboxes.
3. Choose Add a shared mailbox:

   


   Figure 4.8 – The Add a shared mailbox button available on the Mailboxes screen

4. Give the shared mailbox a display name (for the address book and email To lines), an email address, and an alias:

   


   Figure 4.9 –...

Creating a distribution list

Create an email account that does not have a shared email inbox but receives and distributes all incoming mail to a static list of users' individual inboxes. You could also use an O365 group, but in some cases, you may not want the additional features or apps that come with that. In this recipe, you'll create a distribution list.

Getting ready

You'll need to be an Exchange admin, global admin, or have the Organization Management or Recipient Management roles to create distribution groups.

How to do it…

1. Go to the classic Exchange admin center at https://outlook.office.com/ecp/.
2. Choose groups from beneath the recipients header:

   


   Figure 4.12 – The groups link in the recipients section

3. Select Distribution list from the drop-down menu next to the New Office 365 group button:

   


   Figure 4.13 – Additional group type options available when using the arrow next to New Office 365 group

4. Enter...

Creating a dynamic distribution list

Create an email account that does not have a shared email inbox, but instead sends all incoming mail to a dynamically generated list of users that updates itself based on specified criteria, such as users listed under a specific department. In this recipe, we'll create a dynamic distribution list.

Getting ready

You'll need to be an Exchange admin or have the Organization Management or Recipient Management roles to create distribution groups.

How to do it…

1. Go to the classic Exchange admin center at https://outlook.office.com/ecp/.
2. Choose groups from beneath the recipients header:

   Figure 4.16 – The groups link under the recipients section

3. Select Dynamic distribution list from the drop-down menu next to the New Office 365 group button:

   Figure 4.17 – Additional group type options available when using the arrow next to New Office 365 group

4. Enter the display name, the alias, notes, and the owner...

Assigning permissions and roles

In this recipe, you'll learn how to manage a user's ability to access, read, edit, or own an inbox, distribution list, shared inbox, O365 group, and more. We'll accomplish this by utilizing the classic Exchange admin center's permissions blade.

Getting ready

You'll need to be an Exchange admin or have the Organization Management or Recipient Management roles to manage permissions and roles in the classic Exchange admin center.

How to do it…

1. Go to the classic Exchange admin center at https://outlook.office.com/ecp/.
2. Click on permissions in the left-hand navigation menu:

   Figure 4.23 – The permissions menu link in the Exchange admin center

3. Double-click on any admin role (such as Discover Management) to see its details and the specific sub-roles (such as Legal Hold and Mailbox Search) included in the main role. You can modify the included sub-roles and add or remove members here as well:

   Figure...

Creating an Exchange-specific retention policy

This recipe will show how you can create a retention policy on specific user inboxes or security groups' inboxes via the O365 Security & Compliance Center.

Getting ready

You'll need access to the O365 Security & Compliance Center and, if you're not a global admin, one of the following roles:

• Compliance Management
• Organization Management
• Records Management

How to do it…

1. Go to the O365 Security & Compliance Center at https://protection.office.com.
2. Select Information governance | Retention from the left-hand navigation menu:

   Figure 4.25 – The Retention link under Information governance in the O365 Security & Compliance Center's left-hand navigation menu

3. Select Create:

   Figure 4.26 – The Create button

4. Name and describe your retention policy:

   Figure 4.27 – The retention policy's name and description

5. Choose the length of time...

Creating a mail flow rule

While users can create their own rules to apply to messages upon delivery, mail flow rules set by administrators take effect on messages in transit before they're delivered. In this recipe, we'll create a mail flow rule to help identify and report outgoing mail containing credit card numbers.

Important note

Mail flow rules are also known as transport rules.

Getting ready

You should be a global admin or have the Organization Management role as part of your assigned permissions to be able to complete the steps in this recipe.

How to do it…

1. Go to the classic Exchange admin center at https://outlook.office.com/ecp/.
2. Select mail flow from the left-hand side navigation menu.
3. Choose the plus sign (+) to create a new rule:

   Figure 4.31 – The plus button for creating a new rule

4. In this recipe, we'll select Generate an incident report when sensitive information is detected:

   Figure 4.32 – The Generate...

Configuring spam filter policies

Configure spam filter policies to allow or reject mail sent by specific domains or users, and apply complex logic to incoming mail to ensure spam is handled appropriately. In this recipe, we'll create a spam filter policy that blocks incoming mail from specific domains that we specify.

Getting ready

To complete the steps in this recipe, you should be a global admin, Exchange admin, or have a role that includes the Organization Management or Hygiene Management roles.

How to do it…

1. Go to the classic Exchange admin center at https://outlook.office.com/ecp/.
2. Click on Protection in the left-hand navigation menu.
3. Select spam filter from the top navigation menu:

   Figure 4.40 – The spam filter link in the Exchange admin center

4. Choose the plus sign (+) to create a new spam filter policy:

   


   Figure 4.41 – The plus button for adding a new policy

5. Give the policy a name and description:

   


   Figure 4...

Creating room and equipment resources

In this recipe, we'll establish a conference room or equipment resource that users can utilize in Outlook. Most commonly, users would invite the room or piece of equipment to a meeting to reserve it.

Getting ready

To create room and equipment resources, you need to be a global or Exchange admin, or at least have the Organization Management or Recipient Management role assigned to you.

How to do it…

1. Go to the new Exchange admin center at https://admin.exchange.microsoft.com/.
2. Select Recipients | Resources:

   Figure 4.46 – The Resources link in the left-hand navigation menu of the new Exchange admin center

3. Click on Add a resource:

   Figure 4.47 – The Add a resource button on the Resources page

4. Choose Room or Equipment and fill in the basic information for it, including the email address it should have. Then, click Next:

   Figure 4.48 – Basic information for a new room or equipment resource in Exchange...

Enabling advanced threat protection (ATP) features

This final recipe will cover the steps needed to configure safe attachments and safe links settings in the Exchange admin center. These settings empower administrators to take steps to minimize vulnerabilities and improve the organization's overall data security.

Getting ready

You'll need access to the O365 Security & Compliance Center and, if you're not a global admin, one of the following roles:

• Compliance Management
• Organization Management
• Records Management

How to do it…

1. Go to the O365 Security & Compliance Center at https://protection.office.com.
2. Select Threat management | Policy:

   Figure 4.52 – The Threat management Policy link in the O365 Security & Compliance Center's left-hand navigation menu

3. Select ATP safe attachments.
4. Click on the plus sign (+) in the Protect email attachments section.
5. Name and describe your safe attachments...