Applications & Data · Collaboration
Exchange Online
Microsoft's cloud email service, including transport rules, connectors, mailbox permissions and hybrid coexistence with on premises Exchange.
IntermediateMicrosoftUpdated 2026-09-01
Overview
Mail flow is shaped by connectors and transport rules, while security is layered by SPF, DKIM, DMARC and the Defender for Office 365 stack. Hybrid deployments keep an on premises server for attribute management and coexistence during migration.
Mailbox auditing is essential and is the primary evidence source for business email compromise investigations, so its retention should be checked before it is needed.
Security considerations
- Disable legacy authentication protocols; they are the standard route around MFA.
- Alert on new inbox rules, external forwarding and mailbox permission changes.
- Restrict who can create transport rules, a single rule can silently redirect all mail.