Use this checklist to examine the Exchange control plane around mailboxes, administrative access, routing, forwarding, legacy protocols, auditing, and domain trust. It complements, but does not duplicate, a Defender for Office 365 review.
Begin with accepted domains, mailbox populations, shared and resource mailboxes, hybrid dependencies, third-party gateways, application senders, connectors, and the administrators or service principals that can change Exchange. The goal is to establish the real trust boundary before evaluating individual settings.
Exchange exposure is shaped by both tenant-wide settings and per-mailbox exceptions. Sample high-impact populations rather than assuming the organization default tells the whole story.
Review Exchange Administrator and role-group membership, custom management roles, delegated access, standing privilege, inactive administrators, separation of duties, and whether privileged access is protected through Entra ID controls.
Inspect Full Access, Send As, Send on Behalf, folder delegation, shared mailbox ownership, inactive delegates, automapping assumptions, and access granted to applications or service accounts.
Identify mailbox forwarding, forwarding SMTP addresses, external Inbox rules, remote-domain behavior, and justified exceptions. Microsoft notes that compromised accounts can use forwarding to disclose information.
Verify the organization setting and every per-mailbox override. Microsoft recommends disabling SMTP AUTH organization-wide and enabling it only for mailboxes that still require it; each exception needs an owner and migration plan.
Review authentication policies, POP and IMAP use, application sending patterns, OAuth use where supported, service-account lifecycle, and Conditional Access dependencies. Do not break production senders without a tested replacement.
Examine conversion to shared mailboxes, former-employee access, inactive mailboxes, litigation or retention dependencies, aliases, group ownership, and removal of stale permissions after job changes or departures.
Rules and connectors often accumulate around business systems. Review their continued need and combined effect before recommending removal.
Export enabled and disabled rules with priority, conditions, exceptions, actions, dates, and owners. Pay particular attention to SCL bypass, broad allow logic, redirects, Bcc or journaling behavior, attachment actions, header changes, and rules that stop further processing.
Confirm the business scenario, direction, scope, TLS requirements, certificate or IP restrictions, validation status, and overlap for each connector. Microsoft notes that most cloud-only organizations do not need connectors for ordinary internet mail flow.
Where mail is filtered before Microsoft 365, validate the original sender path, inbound connector restrictions, and Enhanced Filtering for Connectors. Broad filtering bypass can prevent Microsoft controls from evaluating messages as intended.
Inventory printers, scanners, line-of-business systems, marketing platforms, relays, direct send, SMTP AUTH, and connector-based delivery. Confirm sender restrictions, monitoring, ownership, and a supported replacement for obsolete methods.
Review unused or stale domains, relay behavior, default remote-domain settings, external automatic replies, forwarding controls, and whether partner-specific behavior remains justified.
Review partner connectors that require TLS, certificate or domain validation, fallback behavior, and operational monitoring. A TLS setting without validated scope and partner coordination can create either exposure or avoidable delivery failure.
Microsoft’s DKIM guidance states that DKIM is only one part of the strategy and should be used with SPF and DMARC.
Microsoft documents the available controls in its guidance for external email forwarding and outbound spam policies.
Microsoft states that mailbox auditing is on by default, but reviewers should verify the organization setting, default audit sets, mailbox-specific changes, bypass associations, licensing, retention, and access to search. A default is not evidence that no one changed it.
Review message trace and reports for forwarding, outbound activity, transport rules, non-accepted domains, and delivery failures. Confirm retention, permissions, escalation, and whether the team knows how to retrieve evidence under time pressure.
Identify how rules, connectors, permissions, domains, and forwarding exceptions are requested, tested, approved, recorded, monitored, and retired. Sample recent changes to determine whether the process operates.
A useful Exchange Online assessment does more than list PowerShell output. It connects each observed condition to affected mailboxes or domains, effective scope, business purpose, evidence, plausible abuse, current monitoring, and a safe corrective sequence.
Review the Exchange Online assessment service, pair it with the Defender for Office 365 checklist, or inspect the sample assessment.
No. A useful review also considers administrative access, mailbox delegation, forwarding, SMTP AUTH, mail flow rules, connectors, accepted domains, auditing, alerting, and domain authentication. Defender for Office 365 is a related but distinct protection layer.
No. Many support legitimate applications, partners, hybrid routing, or policy requirements. The objective is to validate ownership, scope, precedence, security conditions, and continued business need, then remove or redesign only what is unjustified.
No. Mailbox auditing is one evidence source. Useful response also depends on audit availability and retention, alert routing, message trace and investigation capabilities, identity telemetry, documented ownership, and practiced procedures.
Assessment identifies observed conditions and a recommended sequence. DNS and tenant changes belong in a separately approved remediation scope with testing, rollback, and responsibility clearly assigned.
Request an Exchange Online assessment to turn roles, mailbox access, routing, forwarding, authentication, and audit evidence into a prioritized plan.