Before we start: whose notes are these?
This course is independent. Microsoft has not written, reviewed or endorsed it, and it is not Microsoft's documentation. It doesn't copy Microsoft's documentation either. Think of it as an experienced colleague's field notes on how to support mail and calendar.
That matters in practice because Microsoft 365 changes all the time. Menus move, roles get renamed, licence conditions shift, limits change, and features go from preview to general availability or get retired. Two examples from recent years:
- Message trace. Microsoft replaced it with a new version in the Exchange admin centre (EAC), under Mail flow > Message trace. Microsoft announced it as generally available in mid-2025 and started retiring the old interface from 1 September 2025.
- Outlook for Windows. Two clients now sit side by side: classic Outlook and the new Outlook for Windows. Microsoft has said classic Outlook will be supported until at least 2029 for Microsoft 365 subscription customers.
So here is the house rule for all 40 levels: every console path, role, licence and limit you see here gets checked and dated against Microsoft's current documentation before you act on it. Paths in this course were last checked in November 2026.
The picture on one page
Think of Exchange Online as a post office with a records department attached. The user only ever sees the counter, which is their mail app. Everything else happens behind it.
WHAT THE USER SEES (clients)
┌───────────────┬─────────────────────┬───────────────────────┐
│ Outlook for │ Outlook on the web │ Outlook mobile / other│
│ Windows/Mac │ (browser) │ phone mail apps │
│ classic + new │ │ │
└──────┬────────┴─────────┬───────────┴──────────┬────────────┘
│ sign-in & sync │ │
▼ ▼ ▼
WHAT SITS BEHIND
┌──────────────────────────────────────────────────────────────┐
│ DIRECTORY Microsoft Entra ID: who the user is, licence, │
│ groups. Often synced from on-prem AD by Entra │
│ Connect, in which case some edits happen on-prem. │
├──────────────────────────────────────────────────────────────┤
│ MAILBOX The store in Exchange Online: mail, calendar, │
│ contacts, permissions, size, archive, deleted │
│ items. Shared mailboxes and room mailboxes too. │
├──────────────────────────────────────────────────────────────┤
│ MAIL FLOW Moving messages in and out: connectors, transport │
│ rules, delivery. Where message trace looks. │
├──────────────────────────────────────────────────────────────┤
│ PROTECTION Spam, phishing and malware filtering, quarantine, │
│ user-reported messages (Defender portal). │
└──────────────────────────────────────────────────────────────┘
Notice that the client stores very little that is truly its own. Classic Outlook usually keeps a local cached copy of the mailbox, but the real copy lives in Exchange Online. That's why rebuilding a broken Outlook profile doesn't lose mail. It also explains why a fault you can see in Outlook and in Outlook on the web is almost never an Outlook fault.
Which part support usually touches
In practice, first and second line work happens mostly in two layers:
- Client. Profiles, sign-in prompts, cache and sync, and new Outlook versus classic Outlook. This is the most frequent work.
- Mailbox. Permissions on shared mailboxes and calendars, size and archive, and recovering deleted items. This is the most frequent admin work.
In mail flow and protection, support mostly reads. You trace a message, read the delivery report, and release a quarantined message where you're allowed to. The policies there apply to the whole organisation (the tenant). Your job is to understand what a policy did and escalate it, not to redesign it.
Where each layer is managed (checked November 2026):
Directory -> Microsoft 365 admin centre / Microsoft Entra admin centre
Mailbox -> Exchange admin centre: https://admin.exchange.microsoft.com
Mail flow -> Exchange admin centre > Mail flow > Message trace
Protection -> Microsoft Defender portal: https://security.microsoft.com
Quarantine: https://security.microsoft.com/quarantine
Gotcha: if the tenant syncs from on-premises Active Directory, some attributes, such as a user's name or hiding them from the address list, can't be edited in the cloud. Before you edit an attribute in the cloud, check where it is managed.
Worked example: sort tickets before opening a console
This is the habit to build first. Read the ticket, ask "which layer?", and only then pick a tool. Here are four realistic tickets:
T1 "Outlook keeps asking for my password; webmail is fine."
-> CLIENT. Web works, so the mailbox and directory are healthy.
T2 "I can't open the Finance shared mailbox, but Priya can."
-> MAILBOX. A permission on one mailbox, the same in every client.
T3 "Customer says our invoice bounced with a 5.x.x code."
-> MAIL FLOW. The message left or failed to leave; trace it.
T4 "A supplier's email never arrived; the supplier says it was sent."
-> PROTECTION first (quarantine?), then MAIL FLOW (trace).
The quickest test to split the layers is: does it happen in Outlook on the web too?
Fault only in one desktop/phone app -> probably CLIENT
Fault in every client, one mailbox -> probably MAILBOX
Message missing or bounced -> MAIL FLOW / PROTECTION
User can't sign in to anything -> DIRECTORY (identity team)
These are probabilities, not rules. A missing message can also be a client rule that filed it away. Sorting tickets this way gives you the most likely place to look first, but you still have to check.
Labelling what you rely on: GA, preview, unconfirmed
Every written runbook or ticket note should say how solid each step is. Use three labels:
- GA (generally available): Microsoft's current documentation describes it as released.
- Preview: the documentation or Message center post says preview. It may change, may not be in every tenant, and may have no support commitment.
- Unconfirmed: you can't find it in current documentation. Don't build a fix on it.
Where to check:
- The current Microsoft Learn page for the feature. Note its "last updated" date.
- Message center in the Microsoft 365 admin centre. It shows announcements for your tenant and needs an admin role to view.
- The public Microsoft 365 Roadmap, for what is rolling out.
A dated runbook line looks like this:
Step 3 Trace message: EAC > Mail flow > Message trace
Status: GA | Source: Microsoft Learn, message trace (new EAC)
Checked: 2026-11-02 by D. Land
Best practice: if a screen in your tenant doesn't match what the course or your notes describe, trust the tenant and today's documentation. Then update the note and its date.
Key takeaways
- Users see clients: Outlook (classic and new), Outlook on the web and mobile. Behind them sit four layers: directory, mailbox, mail flow and protection.
- Support mostly fixes client and mailbox problems, and mostly reads mail flow and protection to explain them and escalate.
- Sort every ticket by layer before opening a console. "Does it happen in Outlook on the web too?" is the quickest split.
- This course is independent of Microsoft and is not its documentation. Check and date every path, role, licence and limit.
- Label each step you rely on as GA, preview or unconfirmed, using Microsoft Learn, Message center and the Roadmap.