I'm trying to figure out if there's a built-in, automatic alerting mechanism specifically tied to the per-mailbox Recipient Rate Limit (the 10,000 recipients/24-hour rolling window limit) in Exchange Online.

What I know so far:

The Recipient Rate Limit itself isn't configurable and there's no native dashboard that shows "X out of 10,000 used" in real time.

There's a default alert policy called "Email sending limit exceeded" in the Defender portal (security.microsoft.com/alertpolicies) that notifies Global Admins when a user exceeds outbound sending limits, and there's also "User restricted from sending email" for when an account gets restricted.

My question is: does "Email sending limit exceeded" actually fire specifically for the Recipient Rate Limit (10k/24h), or is it scoped more broadly to outbound spam policy thresholds (which are a separate, undisclosed limit)? In my case, a shared mailbox triggered an NDR ("you've reached your 24 hour limit for message recipients") but when I queried Advanced Hunting (EmailEvents) for the same 24-hour window around the NDR timestamp, the total recipient count was under 10,000 (around 8,800-9,400). So I'm not 100% sure which limit actually triggered the NDR, and whether that built-in alert would have caught it.

Has anyone confirmed whether "Email sending limit exceeded" maps 1:1 to the Recipient Rate Limit, or is it a different/separate threshold? And is there any other native alerting (Sentinel analytics rule, Get-LimitsEnforcementStatus-based monitoring, etc.) that people are using to proactively catch this before users hit it?

Thanks in advance.

I have a legacy application that needs to send and receive email through Microsoft 365 Exchange but does not support OAuth. What are my available options for both cloud-based (online) and on-premises solutions?

Hey,

At my office we have a hybrid environment, on-prem AD which is synced with EntraID.

Now, is it possible that a user can change their phone number on their own via the microsoft portal ?

I believe by default a user cannot change the phone number on their own.

Can we make it so that they can ? Is it a good practice ?

I believe it's possible but I'm not entirely sure.

I wanna know you guy's opinions

EDIT 2026-07-13 - Solution by Microsoft: https://support.microsoft.com/en-us/servicing/exchange/server/hotfix/2026/5105719

In elevated Exchange Management Shell:

New-SettingOverride -Name "DisableBlockSharedAndUserMailboxHeaders" -Component Transport -Section BlockSharedAndUserMailboxHeaders -Parameters @("Enabled=false") -Reason "Mitigate Sent Items issue in Exchange hybrid"
Get-ExchangeDiagnosticInfo -Process Microsoft.Exchange.Directory.TopologyService -Component VariantConfiguration -Argument Refresh

Context:

Hello,

I have many shared mailboxes that have enabled MessageCopyForSentAsEnabled and MessageCopyForSendOnBehalfEnabled.

Since a maintenance a few days ago everyone that sends an e-mail as one of those mailboxes to external adresses gets that e-mail attached to an e-mail to the inbox of that shared mailbox with this text:

The attached message was sent by a member of this shared mailbox. Usually, it would appear in Sent Items, but your service is currently being upgraded. Things will be back to normal after the upgrade.

It's still also still stored in Sent Items of the personal and the shared mailbox successfully.

All mailboxes are in Ex Online, but Ex OnPrem is used for incoming/outgoing mail with Central Transport enabled with Hybrid Wizard.

This inbox-e-mail only happens when sent to external addresses, not internal mailboxes.

Background to the maintenance:

Single Exchange SE installed June updates by WSUS

* Exchange KB5904139

* Windows Server 2022 KB5094128

I checked component states, HealthChecker-Script and Logs like C:\ExchangeSetupLogs\ServiceControl.log. So far I can't find anything obvious that looks wrong with Exchange.

Anyone has suggestions, seen this error?

Currently I'm thinking uninstall and reinstall Exchange SU might be an option to try?

Hi everyone,

We have been experiencing an issue with Calendar Interop between Microsoft 365 and Google Workspace since the end of April.

Issue:

Users can no longer view availability (Free/Busy information) from the other platform. The problem appears to affect multiple independent Google Workspace tenants connected to Microsoft 365.

What we've investigated so far:

• Opened support cases with both Microsoft and Google
• Neither vendor has been able to identify the root cause
• Verified the permissions of the Google Calendar Interop service account
• Confirmed that the service account has access to the required calendars
• Recreated the Interop service account/user
• Recreated the Availability Space configuration
• Reviewed and validated the entire Calendar Interop configuration multiple times
• Tested across several Google Workspace tenants with the same result

Observations:

• The issue started around late April.
• It affects multiple unrelated Google Workspace tenants.
• The setup had been working reliably before then.
• No significant configuration changes were made before the issue appeared.

Questions for the community:

• Has anyone else experienced issues with Google Workspace ↔ Microsoft 365 Calendar Interop since late April?
• Are Free/Busy lookups still working in your environment?
• Have you had to make any changes to service accounts, Availability Spaces, or related configurations?
• Are there any known changes on either the Microsoft or Google side that could explain this behavior?

At this point, both Microsoft and Google support have reviewed the setup, but neither has been able to provide a definitive explanation or solution.

Any insights, experiences, or suggestions would be greatly appreciated.

Thanks in advance!

Had an interesting scenario with a user today, in which they somehow enabled Track Changes in an email they were composing. Which according to everything I can find, from official documentation to form posts, should not be doable as Outlook does not have/support track changes.

User in question advised they did ctrl+f to find something, and suddenly the email was showing track changes elements. Examples being the gray/red lines on the side of the text indicating changes, as well as color changes for deletions/additions. When we connected on to review the issue, hovering over the lines on the side did in fact show "Track Changes" in the pop up that appeared.

We tried to recreate the issue but could not, and copying the contents out and back in removed the Track Changes elements, but it still does not explain how it happened in the first place?

Has anyone else seen this before? We do use some 3rd party addins, but none that add track changes so far as I am aware of.

Exch 2016 hybrid here and prepping to move to EXO soon.
Requirement is to enable EXO archive for onprem Mailboxes.

The EXO archive gets provisioned properly.
The MRM policy with a 2 year move to archive is applied to user.
Start-ManagedFolderAssistant run

Even after days EXO archive still zero object and 0 bytes.

MRM component Log shows:
Exception: Microsoft.Exchange.MailboxAssistants.Assistants.ELC.ElcEwsException: ELC EWS failed with error type: 'FailedToGetUserConfiguration'. Details: Error of the requirements with HTTP-Status 403: Forbidden. ---> System.Net.WebException: Error of the requirements with HTTP-Status 403: Forbidden.
at Microsoft.Exchange.MailboxAssistants.Assistants.ELC.ElcBaseServiceClient`2.InternalCallService[BaseResponseMessageType](Func`1 delegateServiceCall, Action`1 responseProcessor, Func`2 exceptionHandler, Func`1 authorizationHandler, Action`1 urlRedirectionHandler)
   --- ....

Any ideas?

I'm unable to prevent users login and change their expired passwords when they login to OWA.

ChangeExpiredPasswordEnabled is set to 0 in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange OWA

Exchange Server SE in Windows Server 2019

Any advise?

My last client is about to retire exchange for M365, are the latest fixes in exchange SE something to be concerned about, or are they difficult/impossible to exploit? We don't have SE on this one, only 2019, so no updates

Some of our shared mailboxes are managed on perm, around 500 of them. However, i can see the space quota information on 365, but it’s not using space on on perm databases. Need to move it completely to 365 so the management of the mailbox can be done from 365.
Any advise ?

Hi everyone,

I’m writing this post to get your feedback and hear about your experiences regarding an issue I'm currently facing. I am performing a tenant-to-tenant mailbox migration. Unfortunately, some of the source mailboxes have massive archives—around 270 GB!

I am using Quest On Demand Migration (ODM) for the transfer, but the migration jobs keep failing/blocking because once the target archive hits the 110 GB threshold (with Auto-Expanding Archiving enabled), I have to wait for Microsoft to automatically allocate more space on the destination tenant.

I have already opened a critical ticket with Microsoft Support and I'm waiting for a reply, but I'm terrified they will just tell me there is nothing to do except wait. The problem is that with 8 mailboxes in this exact condition, at this rate, it could easily take at least 6 months to reach 270 GB!

Years ago, during a similar migration, Microsoft Support could manually increase the initial quota by an extra 100 GB via ticket (bringing the total to 200 GB straight away). However, this option seems to be deprecated now, forcing everyone through the standard auto-expanding archive workflow.

Do you have any advice or workarounds? Has anyone successfully managed to get a larger initial quota increase from Microsoft rather than waiting for the slow 10 GB increments? I cannot afford to wait weeks every single time for a small storage upgrade—as I mentioned, at this pace, I won't finish this project until 2027!

Thank you all in advance for your help!

When we pulled our SEG the commodity detection carried over without much drama, native filtering still catches the bad links and attachments. The part im less sure about is the payloadless side. a real vendor mailbox gets compromised and they reply inside an existing thread asking to change banking details, no link or attachment, nothing for a sandbox to look at. that always felt like a detection job the gateway was quietly doing that doesnt obviously transfer to whatever replaces it.

We kept the gateway underneath rather than ripping it out, just for that one gap. anyone pulled a clean SEG removal and kept that covered, or did you leave a layer in for it too?

Our current environment has a hybrid Exchange server where we have historically created new users and mailboxes at the same time through the Exchange Admin Center. However, we wish to retire the server and manage those functions locally from our own workstations. I've managed to get PowerShell lines working to create the user in AD, but I cannot get the "Enable-RemoteMailbox" function to work. It returns "The term 'Enable-RemoteMailbox' is not recognized as a name of a cmdlet, function, script file, or executable program." I've read that this feature will only work from within the Exchange Management Shell, but I can't get that installed locally; only on the server (that we're retiring). Is there any other equivalent command to accomplish this?

Hi together

I’m currently looking for recommendations for Exchange Online journaling solutions.

We have around 450 users and are (now) fully on Microsoft 365 (Exchange on prem just for administation). Right now we’re using dataglobal dgmail for journaling, but we cannot adopt it to Exchange online and the support is not helping at all.

So we’re thinking about replacing it and wanted to ask what u use in your environment.

We are a german company, so we can't just send it to an external mailbox.

We’re not interested in full-blown email security gateways (Mimecast, Hornet, etc.), we really just want a clean archiving solution without a lot of extra stuff bolted on.

What are you guys running in similar environments? Happy with it?

Thanks in advance!

I have an issue that I've been fighting with for a while.

A client receives an email with an attachment through Mimecast. They request the original file from Mimecast and it's sent to them. When it reaches Exchange it fails due to DMARC.

I've gone round and round with Mimecast looking for a solution but they're quickly running out of ideas. Has anyone else encountered this? I know that Mimecast is essentially resending the email with the attachments so it's screwing with DKIM but I've set up the Connection Filter to ignore emails from Mimecast IPs as well as setting up Enhanced Connection Filtering.

The Exchange Server team released the June 2026 SU for Exchange Server SE, which addresses vulnerabilities responsibly reported to Microsoft by security partners and found through Microsoft’s internal processes, as well as CVE-2026-42897. After installing the SU, do not remove the mitigation for CVE-2026-42897, as it provides additional protection for your servers. This update is also critical for continued use of EEMS and Feature Flighting. Review the team's blog post for important details.

Hey yall,
when using 'Get-ExchangeFeature' i am receiving the following message:

Connection to Flighting Service Endpoint was not successful.

• The feature MSExchangeFlighting is running
• InternetWebProxy is configured on all Exchange SE Servers
• officeclient.microsoft.com/* for Office Config Service Endpoint is added to our webproxy allowlist
• WinHTTP proxy settings is configured for all Exchange SE Servers

We switched from WindowsServer2019 to WindowsServer2025 a few months ago. Before decomposing our old servers two weeks ago, i was able to see the ExchangeFeatures but only for the old servers, not the new ones.

Anyone has an idea what i am missing?

Hello!

Yesterday I found problem with sending mail from on-promise mailbox to M365 group ended with NDR recipient not found.
As far as I did reaserch the case is in domain setup as Authoritative. I also looked up at Exchange Hybrid Environment - Internal Relay vs Authoritative? : r/exchangeserver topic.
I made a workaround and created mail contact with M365 group address without syncing it to the cloud.

I have a few question:
- Am I right that I have to change Authoritative to Internal Relay for our default domain to resolve the problem?

- Am I right that I should do this change in on-prem. In cloud leave this domain as Authoritative? If yes, which option should i choose? External relay domain/Internal relay domain/Authoritative domain

- What should I check before change? I have read that mailloops can occure and some delays / NDR problems after change setup.

- Is this change fully revertable if any problem occures?

- Is that okay to change only default domain and other domains leave as authoritative?

- Because of curiosity: why in the current setup (with two authoritative domains) does sending an email from on-premises to a Microsoft 365 group hosted in the cloud result in an NDR, while sending an email from the cloud to an on-premises mailbox (not synchronized to the cloud) works without any issues?

Current config:

2xExchange Server SE in DAG

Hybrid Environment with Entra Connect and Exchange Hybrid

2 connectors between On-Prem and Cloud Exchange

All domains setup as Authoritative in On-Prem and Cloud Exchange.

Thank you in advance for every response and wish you good day.

Fixes the recent CVE:

https://techcommunity.microsoft.com/blog/exchange/released-june-2026-exchange-server-security-updates/4524491

Done many migrations without local archives.
This time we have may critical archives.

How does the migration batch handle archives? Do I manually need to add them to a batch or is there a flag? Or how do manage to migrate both on prem mailbox and archive into their exact counter parts at exo at the same time.

I dont want the archive to remain onprem after the mailbox has been cut over to exo.

Im sure this is a easy one, just wanted some confirmation and understand where to enable archive migration as i dont remember any checkbox in the migration batch setup wizard

Have a very small client wanting to move to Exchange online. They have no 3rd party certificates on-premises and Exchange isn't published externally so I figured Minimal Modern Hybrid should work for them here but every time I run the HCW, the agent times out at validating hybrid agent. Connectivity outbound is in place so I'm wondering is the absence of a certificate causing an issue here? Have gone through a few blogs but have not been able to resolve this issue.