Exchange

---
name: exchange
description: "Expert skill for Microsoft Exchange Server 2019, Exchange Server SE, and Exchange Online. Covers DAG high availability, transport pipeline, hybrid deployment, mailbox management, migration, compliance, and EOP/Defender integration. WHEN: \"Exchange Server\", \"Exchange 2019\", \"Exchange SE\", \"Exchange Online\", \"DAG\", \"mailbox database\", \"transport rule\", \"hybrid Exchange\", \"HCW\", \"Hybrid Configuration Wizard\", \"Edge Transport\", \"EAC\", \"Exchange Admin Center\", \"mail flow rule\", \"Exchange migration\", \"New-MoveRequest\", \"migration batch\", \"Send connector\", \"Receive connector\", \"mailbox move\", \"Get-Mailbox\", \"Exchange PowerShell\". Do NOT use for Proofpoint/Mimecast/Defender-for-Office-365 filtering policy — that's the `email-security` skill in the `security` plugin."
license: MIT
---

# Microsoft Exchange

This skill covers Microsoft Exchange Server 2019, Exchange Server SE (Subscription Edition), and Exchange Online. Exchange is Microsoft's enterprise mail and calendaring platform providing SMTP transport, mailbox storage, client access, and compliance features. Read the reference files below for architecture, deployment, hybrid configuration, migration, and operations detail.

## How to Approach Tasks

1. **Classify** the request:
   - **Architecture** -- Load `references/architecture.md` for transport pipeline, DAG internals, client access, storage architecture
   - **Best practices** -- Load `references/best-practices.md` for deployment patterns, security hardening, performance tuning, migration strategies
   - **Troubleshooting** -- Load `references/diagnostics.md` for common errors, transport issues, database failures, hybrid problems
   - **M365 tenant administration** -- Use the `m365` skill for licensing, Entra ID, Purview compliance, Conditional Access
   - **Email security (SPF/DKIM/DMARC)** -- Use the `email-security` skill (`security` plugin) for authentication standards

2. **Identify version** -- Determine the target Exchange version: Exchange 2019 (end-of-support October 2025, ESU available), Exchange SE (current), or Exchange Online. Check `Get-ExchangeServer | Select AdminDisplayVersion`.

3. **Load context** -- Read the relevant reference file before answering.

4. **Analyze** -- Apply Exchange-specific reasoning: transport pipeline order, DAG quorum, client access proxy model, connector configuration, and hybrid OAuth trust.

5. **Recommend** -- Provide concrete PowerShell commands and configuration examples. Always qualify trade-offs.

6. **Verify** -- Suggest validation steps: `Test-ReplicationHealth`, `Test-ServiceHealth`, `Get-MailboxDatabaseCopyStatus`, message trace, `Test-OrganizationRelationship`.

## Core Architecture

### Server Roles

Exchange 2019/SE uses two roles:
- **Mailbox Server** -- Consolidated role: transport services, mailbox databases, client access proxy, EAC
- **Edge Transport** -- Optional DMZ role: perimeter SMTP filtering, antispam agents, EdgeSync

### Transport Pipeline

Three transport services on each Mailbox server:

```
Inbound:  Internet --> Front End Transport (port 25, stateless proxy)
                   --> Transport Service (categorizer, transport rules, shadow redundancy)
                   --> Mailbox Transport Delivery (RPC to database)

Outbound: Mailbox Transport Submission (RPC from database)
       --> Transport Service
       --> Send Connector --> Internet (or Frontend Outbound Proxy)
```

**Shadow Redundancy:** Keeps redundant copies of in-transit messages. If next-hop fails, shadow resubmits.

**Safety Net:** Retains delivered messages for 2 days (default). Enables resubmission after database failover.

### Database Availability Groups

```powershell
# Create a DAG without admin access point (recommended)
New-DatabaseAvailabilityGroup -Name DAG1 -WitnessServer EX-WITNESS `
    -DatabaseAvailabilityGroupIPAddresses ([System.Net.IPAddress]::None)

# Add members
Add-DatabaseAvailabilityGroupServer -Identity DAG1 -MailboxServer EX01

# Add database copy
Add-MailboxDatabaseCopy -Identity DB01 -MailboxServer EX02 -ActivationPreference 2

# Add lagged copy (7-day replay lag)
Add-MailboxDatabaseCopy -Identity DB01 -MailboxServer EX04 `
    -ReplayLagTime 7.0:0:0 -ActivationPreference 4

# Check status
Get-MailboxDatabaseCopyStatus -Identity DB01\* | Select Name, Status, CopyQueueLength, ReplayQueueLength
```

**Preferred Architecture:** 4 copies per database (2 per datacenter), 3 HA copies + 1 lagged copy, ReFS filesystem, JBOD storage, MCDB on SSD.

### Exchange Online

- Multi-tenant service, mailboxes on Microsoft-managed HA infrastructure
- Autodiscover via `https://autodiscover.outlook.com`
- Mailbox types: User (licensed), Shared (no license up to 50 GB), Resource (Room/Equipment)
- EOP included with all subscriptions; Defender for Office 365 adds Safe Attachments, Safe Links, AIR

### Hybrid Deployment

```powershell
# Verify hybrid configuration
Get-HybridConfiguration

# Check hybrid connectors
Get-SendConnector | Where {$_.Name -like "*Hybrid*"} | Select Name, AddressSpaces, SmartHosts

# Check organization relationship (free/busy)
Get-OrganizationRelationship | Select Name, Enabled, FreeBusyAccessEnabled

# Test free/busy
Test-OrganizationRelationship -UserIdentity user@contoso.com -Identity "Exchange Online" -Verbose
```

## Key Operations

### Mailbox Management

```powershell
# Create shared mailbox
New-Mailbox -Shared -Name "Help Desk" -DisplayName "Help Desk" -PrimarySmtpAddress helpdesk@contoso.com

# Convert user to shared
Set-Mailbox -Identity user@contoso.com -Type Shared

# Create room mailbox with auto-accept
New-Mailbox -Room -Name "Conference Room A" -PrimarySmtpAddress confrooma@contoso.com
Set-CalendarProcessing -Identity confrooma@contoso.com -AutomateProcessing AutoAccept

# Enable archive
Enable-Mailbox -Identity user@contoso.com -Archive

# Check mailbox sizes
Get-Mailbox -ResultSize Unlimited | Get-MailboxStatistics | Select DisplayName, TotalItemSize, ItemCount | Sort TotalItemSize -Descending
```

### Transport Rules

```powershell
# Add external disclaimer
New-TransportRule -Name "External Disclaimer" `
    -SentToScope NotInOrganization `
    -ApplyHtmlDisclaimerText "<p>DISCLAIMER: This email is confidential.</p>" `
    -ApplyHtmlDisclaimerLocation Append -ApplyHtmlDisclaimerFallbackAction Wrap

# Block large attachments
New-TransportRule -Name "Block Large Attachments" -AttachmentSizeOver 25MB `
    -RejectMessageReasonText "Attachments exceeding 25MB are not permitted."
```

### Migration

```powershell
# Hybrid remote move (on-prem to cloud)
New-MoveRequest -Identity user@contoso.com -Remote `
    -RemoteHostName mail.contoso.com `
    -TargetDeliveryDomain contoso.mail.onmicrosoft.com `
    -RemoteCredential (Get-Credential) -BadItemLimit 50

# Migration batch (multiple mailboxes)
New-MigrationBatch -Name "Wave1" `
    -SourceEndpoint (Get-MigrationEndpoint -Identity "HybridMigrationEndpoint") `
    -CSVData ([System.IO.File]::ReadAllBytes("C:\Wave1.csv")) `
    -AutoStart -AutoComplete -BadItemLimit 50

# Monitor
Get-MigrationBatch "Wave1" | Select Status, TotalCount, SyncedCount, FailedCount
Get-MigrationUser -BatchId "Wave1" | Select EmailAddress, Status, PercentComplete
```

### Compliance

```powershell
# Enable litigation hold
Set-Mailbox -Identity user@contoso.com -LitigationHoldEnabled $true -LitigationHoldDuration 2555

# Create retention tag
New-RetentionPolicyTag -Name "Delete after 3 years" -Type All `
    -RetentionEnabled $true -AgeLimitForRetention 1095 -RetentionAction DeleteAndAllowRecovery

# Create journal rule
New-JournalRule -Name "Legal Journal" -Recipient cfo@contoso.com `
    -JournalEmailAddress journal@archive.com -Scope Internal -Enabled $true
```

## Version Matrix

| Feature | Exchange 2019 | Exchange SE | Exchange Online |
|---|---|---|---|
| Support status | ESU (end-of-support Oct 2025) | Active (subscription) | Active |
| OS support | WS 2019, WS 2022 | WS 2019, 2022, 2025 | N/A (cloud) |
| TLS | 1.2 (1.0/1.1 disableable) | 1.2 and 1.3 only | 1.2+ |
| Unified Messaging | Removed | Removed | N/A |
| Hybrid Modern Auth | Yes (Classic Hybrid) | Yes | N/A |
| Max DB copies | 16 | 16 | N/A |

## Cross-References

| Topic | Skill | When |
|---|---|---|
| M365 tenant admin | `m365` | Licensing, Entra ID, Conditional Access, Purview |
| Email security | `email-security` (`security` plugin) | SPF/DKIM/DMARC, phishing defense, Defender for O365 |
| Postfix relay | `postfix` | Postfix as edge transport in front of Exchange |
| Google Workspace migration | `google-workspace` | Google Workspace to Exchange Online migration |

## Reference Files

- `references/architecture.md` -- Transport pipeline internals, DAG mechanics, client access proxy, MCDB storage, Edge Transport, Exchange Online architecture. **Load when:** architecture questions, DAG design, transport troubleshooting, storage planning.
- `references/best-practices.md` -- Deployment patterns, hybrid configuration, migration strategies, security hardening, performance tuning, backup. **Load when:** deployment planning, hybrid setup, migration execution, security review.
- `references/diagnostics.md` -- Common errors, transport failures, database copy issues, hybrid troubleshooting, migration errors, EOP/Defender issues. **Load when:** troubleshooting errors, diagnosing mail flow problems, fixing hybrid connectivity.