Docs

Appearance

M365 / Exchange Operations Guide ​

Overview ​

Day-to-day Microsoft 365 and Exchange Online operations — shared mailboxes, distribution groups, mail flow, calendar permissions, licensing, and troubleshooting. All M365 admin work happens in the Microsoft 365 Admin Center at https://admin.microsoft.com using your @ciriusgroup.com admin account.

For identity operations (creating users, managing groups, MFA, Conditional Access) see Entra Identity Operations. For Entra-specific items this guide links there rather than duplicating.

Admin Center Navigation ​

TaskWhere to Go
Users, licenses, groupsMicrosoft 365 Admin Center (admin.microsoft.com)
Mailboxes, shared mailboxes, mail flowExchange Admin Center (admin.exchange.microsoft.com)
Device managementIntune Admin Center (intune.microsoft.com)
Security policies, DLPMicrosoft 365 Defender / Purview
SharePoint sitesSharePoint Admin Center (<tenant>-admin.sharepoint.com)

The M365 Admin Center links to all sub-centers in its left nav. You can also go directly to each URL.

Shared Mailboxes ​

Shared mailboxes let multiple people read and send from a single address (e.g., support@ciriusgroup.com, billing@ciriusgroup.com) without needing a separate license.

Creating a Shared Mailbox ​

  1. Exchange Admin Center → Recipients → Shared mailboxes → Add a shared mailbox
  2. Fill in:
    • Display name: Support Team (how it appears in Outlook)
    • Email address: support@ciriusgroup.com
  3. Click Save
  4. After creation, click Edit on the new mailbox → Delegation tab
  5. Add members under Send As and Read and manage — these are the people who can use the mailbox

Members access it in Outlook: File → Account Settings → Add Account (Exchange) → it will appear as a secondary mailbox automatically if they have Full Access permission.

Adding / Removing Members ​

Exchange Admin Center → Recipients → Shared mailboxes → select mailbox → Delegation:

  • Full Access — can read and manage the mailbox (open in Outlook)
  • Send As — can send email that appears to come from this address (not "on behalf of")
  • Send on Behalf — can send, but recipients see "Sent on behalf of" in the From field

For most shared mailboxes, grant both Full Access and Send As.

Shared Mailbox Alias / Additional Addresses ​

Exchange Admin Center → select mailbox → Email addresses tab → Add email address. Useful for catch-all addresses (e.g., info@ and contact@ both go to the same mailbox).

Distribution Groups ​

Distribution groups (also called distribution lists) send one email to multiple recipients. Unlike shared mailboxes, members receive the email in their own inbox.

Creating a Distribution Group ​

  1. M365 Admin Center → Teams & groups → Distribution lists → Add a group
  2. Or Exchange Admin Center → Recipients → Groups → Add a distribution list
  3. Fill in:
    • Name and Email address (e.g., allstaff@ciriusgroup.com)
    • Owner: the person responsible for managing membership
  4. Add members

Who Can Send to the Group ​

By default, only internal users can email a distribution group. To allow external senders (e.g., customers emailing support@):

Exchange Admin Center → select group → Settings → uncheck Require senders to be authenticated (the "Allow external senders" toggle in the new EAC).

Dynamic Distribution Groups ​

Dynamic groups calculate membership from Entra attributes rather than manual lists. Useful for "all employees" or "all contractors" lists that auto-update when users are added/removed.

Exchange Admin Center → Recipients → Groups → Add a dynamic distribution list. Define the filter (e.g., Department equals IT). These sync from Entra attributes.

Mail Flow Rules (Transport Rules) ​

Mail flow rules intercept, modify, or reject messages based on conditions. Common uses: adding disclaimers, blocking certain file types, routing mail to a shared mailbox.

Exchange Admin Center → Mail flow → Rules → Add a rule

Common Rule Patterns ​

Add a disclaimer to all outbound email:

  • Condition: The sender is located → Inside the organization
  • Action: Apply a disclaimer → Append → paste disclaimer HTML

Block executable attachments inbound:

  • Condition: Any attachment → file extension matches → exe, bat, cmd, vbs, ps1
  • Action: Reject the message with explanation

Route mail from external address to shared mailbox:

  • Condition: The recipient address includes → support@ciriusgroup.com
  • Action: Redirect the message to → <shared-mailbox> (Note: use Redirect not Forward — redirect changes the To: address, forward keeps it)

Calendar Permissions ​

Sharing a User's Calendar ​

A user can share their own calendar in Outlook. For admin-managed sharing:

powershell
# Connect to Exchange Online
Connect-ExchangeOnline -UserPrincipalName admin@ciriusgroup.com

# Grant read access to a calendar
Add-MailboxFolderPermission -Identity "user@ciriusgroup.com:\Calendar" `
  -User "colleague@ciriusgroup.com" -AccessRights Reviewer

# Grant edit access
Add-MailboxFolderPermission -Identity "user@ciriusgroup.com:\Calendar" `
  -User "colleague@ciriusgroup.com" -AccessRights Editor

# View current permissions
Get-MailboxFolderPermission -Identity "user@ciriusgroup.com:\Calendar"

Room Calendars ​

Room mailboxes (conference rooms) are a special mailbox type. Create via: Exchange Admin Center → Resources → Rooms & equipment → Add a resource mailbox

Room booking settings (auto-accept, capacity, booking window) are set in the resource mailbox properties → Booking options.

Licensing ​

Checking and Assigning Licenses ​

M365 Admin Center → Billing → Licenses → select the license (Microsoft 365 Business Premium)

To assign to a user: M365 Admin Center → Users → Active users → select user → Licenses tab → assign/unassign

Current license tier: Microsoft 365 Business Premium (standard for all staff).

License Inventory ​

powershell
Connect-MgGraph -Scopes "Organization.Read.All"
Get-MgSubscribedSku | Select SkuPartNumber, ConsumedUnits, @{N="Total";E={$_.PrepaidUnits.Enabled}}

This shows how many of each license are used vs available. Run this before adding new staff to confirm capacity.

Troubleshooting Mail Delivery ​

Message Trace — Find a Missing Email ​

Exchange Admin Center → Mail flow → Message trace → Start a trace

  • Set time range (default 48h; up to 90 days for extended)
  • Fill in sender or recipient address
  • Results show every hop the message took: delivered, filtered, bounced

For the last 10 days only (no EAC needed):

powershell
Connect-ExchangeOnline
Get-MessageTrace -RecipientAddress "user@ciriusgroup.com" -StartDate (Get-Date).AddDays(-2) `
  -EndDate (Get-Date) | Format-Table Received, SenderAddress, RecipientAddress, Status, Subject

Email Rejected by Spam Filter ​

  1. Run a message trace — if status is FilteredAsSpam, the filter caught it
  2. EAC → Mail flow → Message trace → click the trace row → Message events → look for the SCL (Spam Confidence Level) and which filter rule triggered
  3. To whitelist a sender: EAC → Mail flow → Rules → add a rule to bypass spam filtering for a specific sender domain (use sparingly — only for trusted senders)

SPF / DKIM / DMARC Check ​

If external recipients are bouncing your email or marking it spam:

bash
# Check SPF record
dig TXT ciriusgroup.com | grep spf

# Check DKIM selector
dig TXT selector1._domainkey.ciriusgroup.com

# Check DMARC
dig TXT _dmarc.ciriusgroup.com

DMARC enforcement plan is documented in DMARC Enforcement Plan. If you modify SPF or DKIM records, coordinate with the DMARC plan — changes can affect email deliverability.

Email Sent "On Behalf Of" Unexpectedly ​

Happens when a user has Send on Behalf permission but the sender intended Send As. Fix: Exchange Admin Center → shared mailbox → Delegation → move from "Send on Behalf" to "Send As".

Offboarding — Email Handling ​

When a user leaves, their mailbox should be converted to a shared mailbox (not deleted) so their email history is preserved and manager can access it:

  1. M365 Admin Center → Users → Active users → select user → Block sign-in
  2. Remove the license (releases it for reuse)
  3. Exchange Admin Center → Recipients → Mailboxes → select → More → Convert to shared mailbox
  4. Add the user's manager as a Full Access delegate
  5. Keep for 30 days minimum before deleting (align with Entra account retention)

Do not delete the mailbox immediately — litigation hold and compliance may require retention.

PowerShell Reference ​

Most Exchange admin tasks can be done in the GUI, but PowerShell is faster for bulk operations and automation.

powershell
# Connect to Exchange Online
Install-Module ExchangeOnlineManagement   # one-time install
Connect-ExchangeOnline -UserPrincipalName admin@ciriusgroup.com

# Common commands
Get-Mailbox -Identity user@ciriusgroup.com                      # check a mailbox
Get-MailboxStatistics user@ciriusgroup.com | Select TotalItemSize # mailbox size
Get-DistributionGroupMember -Identity allstaff@ciriusgroup.com  # list group members
Add-DistributionGroupMember -Identity group@ciriusgroup.com -Member user@ciriusgroup.com
Remove-DistributionGroupMember -Identity group@ciriusgroup.com -Member user@ciriusgroup.com

# Disconnect when done
Disconnect-ExchangeOnline -Confirm:$false

Document History ​

DateChangeAuthor
May 2026Initial draft — shared mailboxes, distribution groups, mail flow rules, calendar permissions, licensing, delivery troubleshooting, offboarding, PowerShell reference.Rory

Internal use only — Cirius Group