Hands-on Microsoft 365 and Exchange Online support portfolio demonstrating mailbox administration, licensing troubleshooting, shared mailbox permissions, distribution groups, mail forwarding, message trace, Microsoft Defender quarantine, external mail flow, Outlook access troubleshooting, and Exchange Online PowerShell.
This project simulates real-world Exchange Online incidents commonly handled by:
- Help Desk Technicians
- IT Support Specialists
- Microsoft 365 Support Engineers
- Junior Microsoft 365 Administrators
- Cloud Support Specialists
The lab focuses on a complete troubleshooting lifecycle:
- Reproduce the user-reported issue
- Establish a known-good baseline
- Gather administrative evidence
- Investigate through Microsoft 365 and Exchange tools
- Validate findings with PowerShell
- Identify the root cause
- Apply targeted remediation
- Perform end-to-end testing
- Document the incident
- Preserve screenshot evidence
- 10 completed Exchange Online support incidents
- 9 detailed technical documentation files
- 96 troubleshooting screenshots
- Microsoft 365 and Exchange Online administration
- Exchange Online PowerShell
- Microsoft Defender quarantine investigations
- Message Trace analysis
- Shared mailbox permission testing
- Internal and external mail-flow testing
- Controlled fault simulation and remediation
- ServiceNow-style incident documentation
- Microsoft 365 Admin Center
- Microsoft Entra ID
- Exchange Online
- Exchange Admin Center
- Outlook on the web
- Microsoft Defender
- PowerShell 7
- ExchangeOnlineManagement
- Exchange Online PowerShell
- Git
- GitHub
- User Mailboxes
- Shared Mailboxes
- Mailbox Delegation
- Full Access
- Send As
- Send on Behalf
- Distribution Groups
- Mailbox Forwarding
- Inbox Rules
- Message Trace
- Transport Rules
- Hosted Quarantine
- External Mail Flow
- Client Access Settings
- Microsoft 365 Licensing
- Exchange Online Service Plans
The lab uses a Microsoft 365 cloud tenant containing test users, Exchange Online mailboxes, shared mailboxes, distribution groups, licensing, Microsoft Defender functionality, and controlled mail-flow configurations.
Administration was performed from macOS using browser-based Microsoft administrative portals and PowerShell.
PowerShell 7.6.3
ExchangeOnlineManagement 3.10.1
Example connection:
Connect-ExchangeOnline -ShowBanner:$falseAffected User: Brian Carter
Brian existed in Microsoft 365 and Microsoft Entra ID but did not have an Exchange Online mailbox.
- Verified the Microsoft 365 user account
- Verified the identity in Microsoft Entra ID
- Searched Exchange Admin Center
- Confirmed the mailbox was missing
- Reviewed Microsoft 365 licensing
- Confirmed Brian did not have an Exchange-capable license assigned
No Microsoft 365 license containing Exchange Online services was assigned.
Microsoft 365 Business Basic was assigned and Exchange Online provisioned the mailbox.
DisplayName : Brian Carter
PrimarySmtpAddress : brian.carter@Stefon.onmicrosoft.com
RecipientTypeDetails : UserMailbox
Affected User: Emily Brown
Emily still had Microsoft 365 Business Basic assigned, but her Exchange Online mailbox became unavailable.
The parent Microsoft 365 license remained assigned, but the Exchange Online service inside the license was disabled.
Exchange Admin Center no longer displayed Emily's active mailbox and Exchange Online PowerShell could not locate it.
The Exchange Online service plan was disabled while the parent Microsoft 365 license remained assigned.
Re-enabled:
Exchange Online (Plan 1)
Emily's Exchange mailbox returned as:
RecipientTypeDetails : UserMailbox
Affected User: Brian Carter
Shared Mailbox: Company Shared
Brian needed access to the Company Shared mailbox.
The shared mailbox existed, but Brian did not have Full Access delegation.
PowerShell also showed no Full Access permission for Brian.
Missing mailbox delegation.
Assigned Brian:
Full Access
PowerShell confirmed:
AccessRights : {FullAccess}
IsInherited : False
Deny : False
Shared Mailbox: Company Shared
This scenario demonstrated the practical difference between Exchange Online mailbox delegation permissions.
Brian was assigned:
Send As
PowerShell confirmed:
AccessRights : {SendAs}
A live Outlook test showed the recipient saw the sender as:
Company Shared
Brian's personal identity was not displayed.
Emily was assigned:
Send on Behalf
A live Outlook test showed:
Emily Brown on behalf of Company Shared
| Permission | Function |
|---|---|
| Full Access | Open and manage mailbox contents |
| Send As | Send directly as the shared mailbox identity |
| Send on Behalf | Send while displaying the delegate identity |
Affected User: Brian Carter
Distribution List: Finance Department
Brian was not receiving messages sent to the Finance Department distribution list.
Exchange Admin Center showed existing members including:
- Emily Brown
- Robert Garcia
Brian was not present.
PowerShell verification using:
Get-DistributionGroupMemberalso confirmed that Brian was not a member.
Brian was missing from the Finance Department distribution list.
Added Brian Carter to the distribution list.
PowerShell confirmed his membership and a live message sent to the Finance Department distribution list successfully arrived in Brian's Inbox.
Affected User: Robert Garcia
Forwarding Destination: Brian Carter
Messages addressed to Robert were unexpectedly appearing in Brian's mailbox.
Exchange Online mailbox forwarding was configured.
PowerShell showed:
DeliverToMailboxAndForward : False
The forwarding target was resolved as:
Brian Carter
brian.carter@Stefon.onmicrosoft.com
A test message sent directly to Robert:
- Arrived in Brian's mailbox
- Was addressed to Robert
- Did not remain in Robert's mailbox
Mailbox-level forwarding redirected incoming messages to Brian without retaining a copy in Robert's mailbox.
Disabled forwarding.
PowerShell showed no forwarding destination and a new test message arrived normally in Robert's Inbox.
Affected User: Brian Carter
Sender: Emily Brown
Brian reported that an expected email was missing from his Inbox.
Exchange Online Message Trace showed:
Status : Delivered
Detailed trace information showed that the message had been delivered to:
Deleted Items
PowerShell trace events included:
- Receive
- Submit
- Deliver
An Inbox rule named:
LAB - Message Trace Test
was identified as the cause.
An enabled Inbox rule moved the matching message away from Brian's Inbox.
Disabled the Inbox rule using Exchange Online PowerShell.
PowerShell confirmed the rule was disabled and a new controlled message appeared directly in Brian's Inbox.
Affected User: Brian Carter
Sender: Emily Brown
An expected test message did not appear in Brian's Inbox.
A transport rule was created:
LAB - Quarantine Test
The rule quarantined messages containing the controlled test subject.
Message Trace showed:
Quarantined
Microsoft Defender identified:
Quarantine reason : Transport rule
Policy name : LAB - Quarantine Test
PowerShell initially showed:
ReleaseStatus : NOTRELEASED
A controlled Exchange Online transport rule sent the matching message to hosted quarantine.
The message was reviewed and released through Microsoft Defender.
The controlled transport rule was then disabled.
PowerShell showed:
ReleaseStatus : RELEASED
and:
State : Disabled
A follow-up message successfully delivered to Brian's Inbox.
Sender: Emily Brown
Destination: External Gmail recipient
A normal external message from Exchange Online successfully arrived in Gmail.
This established a known-good baseline for outbound internet mail delivery.
A transport rule was configured:
LAB - External Mail Block
Condition:
Subject or body contains LAB EXTERNAL BLOCK TEST
Action:
Reject message
Enhanced status code:
5.7.1
Emily received a non-delivery report showing:
Blocked by mail flow rule
and:
550 5.7.1
Exchange Admin Center Message Trace showed:
Status : Failed
Detailed trace information identified:
LAB - External Mail Block
PowerShell showed:
TRANSPORT.RULES.RejectMessage
and indicated:
the message was rejected by organization policy
An organizational Exchange transport rule rejected the message before normal external delivery completed.
Disabled the transport rule.
PowerShell confirmed:
State : Disabled
A new test message successfully reached Gmail.
PowerShell Message Trace returned:
Status : Delivered
Detailed processing included:
Send external
confirming successful handoff to Google's SMTP infrastructure.
Affected User: Brian Carter
Brian could not access Outlook on the web.
A fresh browser session returned an Outlook error containing:
Error: 440
Brian's Exchange Online mailbox still existed as a valid:
UserMailbox
Client Access settings showed:
OWAEnabled : False
MAPIEnabled : True
PopEnabled : True
ImapEnabled : True
ActiveSyncEnabled : True
Emily sent a controlled test message:
LAB OWA ACCESS TEST - Mailbox Healthy
Message Trace reported:
Status : Delivered
Detailed events showed:
- Receive
- Submit
- Deliver
This proved that Brian's mailbox remained healthy and continued receiving email while Outlook on the web access was disabled.
Outlook on the web had been specifically disabled through Brian's Exchange Online Client Access configuration.
Set-CASMailbox -Identity "brian.carter@Stefon.onmicrosoft.com" -OWAEnabled $truePowerShell returned:
OWAEnabled : True
Brian successfully accessed Outlook again.
The message delivered while OWA was disabled was visible in his Inbox after access was restored.
| File | Topic |
|---|---|
| 01-Environment-Setup.md | Microsoft 365 and Exchange environment |
| 02-Mailbox-Provisioning-Licensing.md | Mailbox provisioning and licensing |
| 03-Shared-Mailboxes-Permissions.md | Shared mailbox delegation |
| 04-Distribution-Groups.md | Distribution list administration |
| 05-Mail-Forwarding-Mail-Flow.md | Forwarding and mail flow |
| 06-Message-Trace.md | Missing email investigation |
| 07-Quarantine-Security.md | Defender and quarantine |
| 08-External-Mail-Flow.md | External delivery troubleshooting |
| 09-Outlook-Mailbox-Access.md | Outlook client-access troubleshooting |
| Incident | Scenario |
|---|---|
| INC-001 | Mailbox not provisioned |
| INC-002 | Exchange service entitlement |
| INC-003 | Shared mailbox access |
| INC-004 | Send As / Send on Behalf |
| INC-005 | Distribution group membership |
| INC-006 | Mail forwarding |
| INC-007 | Missing email investigation |
| INC-008 | Quarantined message |
| INC-009 | External mail-flow failure |
| INC-010 | Outlook on the web access |
Each ticket documents:
- User-reported symptoms
- User impact
- Initial investigation
- Troubleshooting steps
- Commands used
- Root cause
- Resolution
- Validation
- Closure notes
- Skills demonstrated
The repository contains 96 organized screenshots.
Screenshots/
├── 01-Environment/
├── 02-Mailboxes/
├── 03-Shared-Mailboxes/
├── 04-Groups/
├── 05-Mail-Flow/
├── 06-Message-Trace/
├── 07-Security/
├── 08-External-Mail-Flow/
└── 09-Outlook-Mailbox-Access/
Evidence includes:
- Microsoft 365 Admin Center
- Microsoft Entra ID
- Exchange Admin Center
- Microsoft Defender
- Exchange Online PowerShell
- Message Trace
- Mailbox delegation
- Distribution groups
- Mail forwarding
- Inbox rule troubleshooting
- Hosted quarantine
- Non-delivery reports
- External email delivery
- Outlook access failures
- Post-remediation validation
Commands demonstrated throughout the lab include:
Connect-ExchangeOnline
Get-ConnectionInformation
Get-EXOMailbox
Get-Mailbox
Get-CASMailbox
Set-CASMailbox
Get-MailboxPermission
Get-RecipientPermission
Get-Recipient
Get-DistributionGroup
Get-DistributionGroupMember
Get-InboxRule
Disable-InboxRule
Get-MessageTraceV2
Get-MessageTraceDetailV2
Get-TransportRule
Get-QuarantineMessage
Get-AcceptedDomain
Get-RemoteDomain
Get-OutboundConnectorThe scenarios follow a repeatable enterprise-support workflow:
User Report
↓
Establish Baseline
↓
Reproduce Problem
↓
Verify Identity and Licensing
↓
Inspect Exchange Configuration
↓
Run Message Trace / PowerShell
↓
Identify Root Cause
↓
Apply Minimal Remediation
↓
Test End-to-End
↓
Document Resolution
The objective was not simply to restore service, but to prove the cause through administrative evidence before making changes.
- Mailbox Administration
- Mailbox Provisioning
- Recipient Administration
- Shared Mailboxes
- Mailbox Delegation
- Full Access
- Send As
- Send on Behalf
- Distribution Groups
- Mailbox Forwarding
- Inbox Rules
- Message Trace
- Transport Rules
- External Mail Flow
- Client Access Settings
- Microsoft 365 Admin Center
- Microsoft Entra ID
- Microsoft 365 Licensing
- Exchange Online Service Plans
- Identity Troubleshooting
- Microsoft Defender
- Quarantine Investigation
- Message Release
- Transport Rule Analysis
- Policy Troubleshooting
- ExchangeOnlineManagement
- Exchange Online PowerShell
- Recipient Queries
- Permission Queries
- Message Trace Queries
- Client Access Administration
- Transport Rule Investigation
- Help Desk Troubleshooting
- Incident Management
- Root Cause Analysis
- Service Restoration
- User Impact Analysis
- End-to-End Validation
- Technical Documentation
- ServiceNow-Style Incident Documentation
A Microsoft 365 product license can remain assigned while the Exchange Online service plan inside that license is disabled.
Both the product license and individual service entitlement should be checked during troubleshooting.
Full Access, Send As, and Send on Behalf provide different capabilities and should be investigated independently.
Message Trace can show a message as delivered while an Inbox rule moves it into Deleted Items or another folder.
Successful Exchange transport does not guarantee that the user's mailbox experience is functioning normally.
An NDR to an external recipient does not automatically mean the external provider rejected the message.
Exchange Online transport rules and organizational policies can stop mail before it leaves Microsoft 365.
A mailbox can remain provisioned and continue receiving messages while Outlook on the web is disabled.
Exchange-Online-Messaging-Support-Lab/
│
├── README.md
├── .gitignore
│
├── Documentation/
│ ├── 01-Environment-Setup.md
│ ├── 02-Mailbox-Provisioning-Licensing.md
│ ├── 03-Shared-Mailboxes-Permissions.md
│ ├── 04-Distribution-Groups.md
│ ├── 05-Mail-Forwarding-Mail-Flow.md
│ ├── 06-Message-Trace.md
│ ├── 07-Quarantine-Security.md
│ ├── 08-External-Mail-Flow.md
│ └── 09-Outlook-Mailbox-Access.md
│
├── Help-Desk-Tickets/
│ ├── Ticket-001-Mailbox-Not-Provisioned.md
│ ├── Ticket-002-Missing-Exchange-License.md
│ ├── Ticket-003-Shared-Mailbox-Access.md
│ ├── Ticket-004-Send-As-Permission.md
│ ├── Ticket-005-Distribution-Group.md
│ ├── Ticket-006-Mail-Forwarding.md
│ ├── Ticket-007-Missing-Email-Message-Trace.md
│ ├── Ticket-008-Quarantined-Message.md
│ ├── Ticket-009-External-Mail-Flow-Failure.md
│ └── Ticket-010-Outlook-Mailbox-Access-Issue.md
│
├── Screenshots/
│ ├── 01-Environment/
│ ├── 02-Mailboxes/
│ ├── 03-Shared-Mailboxes/
│ ├── 04-Groups/
│ ├── 05-Mail-Flow/
│ ├── 06-Message-Trace/
│ ├── 07-Security/
│ ├── 08-External-Mail-Flow/
│ └── 09-Outlook-Mailbox-Access/
│
├── Scripts/
└── Diagrams/
This repository provides evidence of:
- 10 completed support incidents
- 9 detailed technical documentation files
- 96 organized screenshots
- Live Exchange Online administration
- Real PowerShell command output
- Microsoft Defender quarantine investigation
- Exchange Online Message Trace
- Internal and external mail tests
- Root cause analysis
- Controlled fault simulation
- Targeted remediation
- End-to-end validation
- Enterprise-style incident documentation
This project demonstrates practical support experience across the Microsoft 365 messaging stack:
Identity
↓
Licensing
↓
Mailbox Provisioning
↓
Recipient Configuration
↓
Permissions
↓
Mail Flow
↓
Message Trace
↓
Security / Quarantine
↓
External Routing
↓
Client Access
The support approach demonstrated throughout the project is:
Verify the symptom, isolate the affected layer, gather evidence, identify the root cause, apply the smallest appropriate remediation, test the result, and document the resolution.
10 / 10 Exchange Online support scenarios completed
Technical lab work complete
Portfolio documentation complete