Exchange Online Features Explained: How to Set Up Anywhere Access, Shared Mailboxes, Delegation, Retention, and Security

Most overviews list what Exchange Online *can* do. This one covers what you have to *do* to get it. For each of eleven features you get the user steps, the admin steps (portal and PowerShell), the limits, and what to check afterwards. A summary matrix and a rollout checklist are at the end.

Before You Start: Connect and Check Your Access

Most admin tasks below use Exchange Online PowerShell. Install the module and connect once per session:

You will need an admin role such as Exchange Administrator, or Global Administrator for tenant-wide security settings. Use the least privileged role that does the job. Examples use contoso.com and jsmith@contoso.com; replace them with your own.

Where the Brochure Overreaches

These descriptions appear in most Exchange Online marketing and vendor overviews. Each is partly true and worth qualifying before you promise it to a customer or a board:

Common claim	What is actually true
"Administrators can recover mailbox content from backups"	Exchange Online does not give you a point-in-time backup of a mailbox. Recovery relies on the Recoverable Items folder (14 days by default, up to 30), holds, and retention policies. For true backup and restore, use a third-party backup service
"Recover emails in seconds no matter when they were deleted"	Only while the item is within its retention window. Once it is purged, it is gone unless a hold or retention policy kept it
"Protected without lifting a finger"	Baseline filtering is automatic, but the strongest protections (Safe Links, Safe Attachments, preset policies, MFA, blocking legacy sign-in) need to be turned on and tuned
"Retention lowers storage costs"	Retention is mainly a compliance tool. A retention policy that *keeps* mail can increase storage use. Deleting on expiry saves space only if the policy is set to delete
"No special VPN or apps"	True, but Outlook on the web is only as safe as your sign-in controls. Add MFA and Conditional Access, or the lack of a VPN becomes a weakness

1. Access Email and Calendar From Anywhere

What users do. Sign in at https://outlook.office.com from any modern browser, or install Outlook for Windows, Mac, iOS, or Android. The calendar, contacts, and rules follow the account, because they live in the mailbox on the server.

What admins should do. Open access carries risk, so control it:

1. Require MFA. In the Microsoft Entra admin center, create a Conditional Access policy that requires multifactor authentication for all users, with a break-glass account excluded and tested. Security defaults are an acceptable minimum for small tenants that have no Conditional Access.
2. Block legacy sign-in. Basic authentication has been retired for most Exchange Online protocols, but verify that no remaining client, script, or device depends on it, and block legacy authentication with Conditional Access.
3. Limit what unmanaged devices can do. Browser access from personal computers is convenient but leaves data on the device. Restrict downloads in Outlook on the web for unmanaged devices:

Then create a Conditional Access policy that uses Use app enforced restrictions for Exchange Online. Test it with one user before applying it to everyone. Without the matching Conditional Access policy, this setting does nothing.

4. Turn off protocols nobody needs per mailbox, for example POP and IMAP:

Check. Sign in from a private browser window on a device that is not managed, and confirm you are challenged for MFA and that attachment downloads behave as the policy intends.

2. Inbox Rules That Sort, Flag, and Forward

What users do. In Outlook for Windows, open Home, Rules, Manage Rules and Alerts, New Rule. In Outlook on the web, open Settings, Mail, Rules, Add new rule. Typical rules:

• Messages from billing@vendor.com, or with "invoice" in the subject, move to an *Invoices* folder.
• Messages from your manager get a flag and the *High importance* category.
• Combine flag + forward to hand a task to a delegate: forward the message to the delegate and flag your copy for follow-up, so you keep a visible reminder.

Create rules in a way that runs on the server (the wizard says "this rule will run on the server"). Rules that run only on the client stop working when Outlook is closed.

What admins should know.

• External forwarding is blocked by default. Rules that forward to outside addresses are stopped by the outbound spam filter policy. That is a deliberate protection against account-takeover data theft. Allow it only for specific, justified mailboxes by editing the policy in the Microsoft Defender portal (Email & collaboration, Policies & rules, Threat policies, Anti-spam policies, Outbound).
• Audit rules, especially forwarding ones. Attackers who compromise a mailbox often add a hidden forwarding rule. Check for them:

• Organization-wide rules belong in mail flow rules (transport rules) in the Exchange admin center, not in each user's mailbox.

3. Recover Deleted Email

What users do.

1. Open the Deleted Items folder and look there first.
2. If it is not there, select Deleted Items, then Recover items recently removed from this folder (Outlook on the web) or Home, Recover Deleted Items From Server (Outlook for Windows).
3. Select the items and choose Restore. They return to Deleted Items or their original folder.

What the retention window really is. Items removed from Deleted Items (or permanently deleted with Shift+Delete) stay in the Recoverable Items folder for 14 days by default. Administrators can raise this to a maximum of 30 days. Calendar items are kept longer (120 days by default). If a litigation hold or a retention policy applies, the 14 or 30-day limit is superseded and items are preserved for the hold or policy period. Items cannot be recovered after the window passes unless a hold or policy kept them.

What admins do.

1. Extend the window to 30 days for everyone (this requires PowerShell):

2. Find and restore items for a user (verify syntax with Get-Help Restore-RecoverableItems -Full in your tenant, as parameters have changed over time):

3. Recover a deleted mailbox or user. A deleted user's mailbox can be restored within 30 days by restoring the user in the Microsoft 365 admin center (Users, Deleted users).
4. Do not rely on this as a backup. For protection from malicious deletion, ransomware, and long-term recovery, add a third-party Microsoft 365 backup service and a litigation hold or retention policy for important mailboxes.

4. Give Access Without Sharing Passwords

Exchange has several separate delegate permissions. Choose the right one for the job:

Permission	What it lets the delegate do	Typical use
Full Access	Open the mailbox and read, move, and delete mail	An assistant managing an executive's mailbox, or a colleague covering leave
Send As	Send messages that appear to come *from* the mailbox owner, with no indication of the delegate	Shared mailboxes, role addresses
Send on Behalf	Send messages marked "*Assistant* on behalf of *Executive*"	Executive assistants
Calendar delegate	Manage the calendar, with rights from read to editor	Scheduling for a manager

Admin steps (PowerShell).

If your mailbox uses a non-English language, the folder name is not "Calendar". Find it with Get-MailboxFolderStatistics jsmith@contoso.com -FolderScope Calendar.

User steps. In Outlook for Windows: File, Account Settings, Delegate Access to add a delegate and choose permissions. In Outlook on the web: Settings, Calendar, Shared calendars to share a calendar, or Settings, Mail, Accounts to grant mailbox access.

Notes.

• Changes can take up to an hour to appear in a delegate's Outlook (auto-mapping especially).
• Prefer security groups for access to shared resources so you grant and remove access in one place.
• Review who has access periodically:

5. Share Calendars and Schedule Across Teams

See when colleagues are free or busy. Inside your organization, free/busy information is visible by default. In Outlook, use Scheduling Assistant when you create a meeting and add attendees; it shows their availability and suggests times.

Control how much others can see. The default for colleagues is *availability only* (free/busy). To show titles and locations for everyone in the organization:

For a whole-organization change, apply the same cmdlet across mailboxes in a script, and tell users first, since some people use titles that are sensitive.

Share a calendar with specific people. A user can open the calendar in Outlook, choose Share Calendar, add people, and choose a permission level (can view when I'm busy, titles and locations, all details, edit, delegate).

Shared team calendars. Two good options:

• A shared mailbox with a calendar for a team, department, or room.
• A Microsoft 365 group, which gives a shared calendar and mailbox along with Teams and SharePoint.

Share outside the organization. Sharing with external people is governed by the sharing policy. Check what is allowed:

Either extend the policy to named partner domains, or publish a read-only calendar through Settings, Calendar, Shared calendars, Publish a calendar in Outlook on the web. Be careful: a published calendar is accessible to anyone who has the link.

6. Shared Mailboxes for Teams

A shared mailbox (such as support@contoso.com) has its own address that several people read and send from, with no password and no separate sign-in.

Create one.

Or in the Exchange admin center: Recipients, Mailboxes, Add a shared mailbox.

Add members. Grant Full Access and Send As (see the delegation section), ideally to a security group:

Make replies stay with the team. By default, a reply sent from a shared mailbox is saved in the *sender's* Sent Items. To keep a copy in the shared mailbox so everyone sees the response and "who has this" is answered:

Licensing and size. A shared mailbox needs no license while it is under 50 GB and does not need an archive or litigation hold. Above that, assign an Exchange Online Plan 2 license. Block direct sign-in to the shared mailbox's own account.

Reduce confusion in a busy team.

• Use categories and flags to show who owns a message.
• Use Microsoft Teams channel integration, a shared inbox tool, or a shared inbox app if you need assignment and status tracking. A plain shared mailbox has no concept of "assigned to".
• Add an auto-reply that sets expectations on response times.

7. Contacts and Distribution Lists

Personal contacts live in the *People* section of Outlook and are tied to the mailbox, so they follow the user across devices. Organization-wide contacts come from the Global Address List (GAL), which includes users, groups, shared mailboxes, and mail contacts.

Mail contacts represent people outside your organization in the GAL:

Distribution lists (groups).

Dynamic distribution groups keep membership up to date from attributes, so "all field engineers" does not need maintaining by hand:

Which to choose.

Need	Use
Email a fixed set of people	Distribution group
Membership follows department, title, or location	Dynamic distribution group
Email, files, calendar, and chat together	Microsoft 365 group (or a Team)
Only permissions, no email	Mail-enabled security group

Keep these rules in mind: restrict who can send to large lists (to prevent accidental all-company mail), hide sensitive groups from the address list, and remember that Exchange Online enforces limits on recipients per message and per day. Check the current Exchange Online limits before planning a mass mailing.

8. Integration With Teams, OneDrive, SharePoint, and Planner

• Teams meetings from Outlook. The Teams Meeting add-in installs with Teams and adds a New Teams Meeting button to Outlook calendar. Select it and a join link and dial-in details are added to the invite. If the button is missing, check that Teams is installed for the user, restart Outlook, and confirm the add-in is not disabled (File, Options, Add-ins).
• Attach files from OneDrive and SharePoint. In a new message, select Attach File, Browse Web Locations, choose the file, and send it as a *link* (everyone with access can open the same version). Set organization sharing defaults in the SharePoint admin center so links are not more open than you intend.
• Teams calendar and chat. The Calendar app in Teams shows the same Exchange Online calendar. A mailbox must be in Exchange Online, or in a correctly configured hybrid with OAuth, for Teams to show calendar and meeting features for it.
• Planner and To Do. Tasks flagged in Outlook appear in To Do, and Planner tasks assigned to a user show in their To Do list.

Admin checks. Confirm licenses include the services, review sharing and external access settings in SharePoint and Teams, and run a pilot meeting with users on different clients.

9. Built-In Anti-Spam, Anti-Malware, and Phishing Protection

What is on by default. Every Exchange Online mailbox is protected by Exchange Online Protection (EOP): anti-spam, anti-malware, and basic anti-phishing. Filtering is updated continuously by Microsoft, and the service can remove a message after delivery if it is later identified as malicious (zero-hour auto purge). That baseline is real and needs no setup.

What is not automatic.

• Preset security policies. Turn on the Standard (or Strict) preset in the Microsoft Defender portal: Email & collaboration, Policies & rules, Threat policies, Preset Security Policies. Choose Manage protection settings, apply it to all recipients, and save. This applies Microsoft's recommended anti-spam, anti-malware, and anti-phishing settings in one step.
• Safe Links and Safe Attachments are part of Microsoft Defender for Office 365 (included in some plans, such as Business Premium, and available as an add-on). Check your license. If you have it, the preset policies also configure these.
• Email authentication. Publish SPF, enable DKIM signing for each domain, and publish a DMARC policy, moving from monitoring to enforcement. See our guide to DKIM, SPF, DMARC, and ARC in Exchange Online.
• Block risky sign-in. MFA and blocked legacy authentication (section 1) stop most account takeovers, which are the main way attackers get past filtering.
• Report and review. Let users report phishing from Outlook, and review the quarantine and the Threat Explorer or Email security reports.

Test it. Send a test message to a mailbox from an external account with an attachment that is the EICAR test file name, and confirm it is blocked. Check the message trace in the Exchange admin center to see how the message was handled.

10. Retention Policies and Compliance

Retention answers "what do we keep, and for how long?" It is different from backup (restoring data) and from DLP (stopping data leaving).

Create a retention policy.

1. Open the Microsoft Purview portal, then Data lifecycle management, Microsoft 365, Retention policies, New retention policy.
2. Name it for the business reason (for example, "Finance mail 7 years").
3. Choose the scope: Exchange mailboxes, all or specific users and groups.
4. Choose the action: Retain items for a period, Delete items after a period, or both ("retain, then delete").
5. Review and create.

A new policy can take up to seven days to take effect across all mailboxes.

Practical advice.

• Pilot with a small group, and start with *retain only* before you add *delete*. Deletion is the dangerous half.
• When several policies apply, the longest retention wins and retention beats deletion, so check for conflicts before you rely on a delete rule.
• Use litigation hold or an eDiscovery hold for legal matters, which is separate from routine retention.
• Make sure archives are enabled for users who need more space; retention interacts with the archive mailbox.
• Document the policy owner and the legal or regulatory reason for each period.

Add data loss prevention (DLP). Retention decides what stays and what goes. DLP controls what leaves. In the Purview portal, open Data loss prevention, Policies, Create policy, choose a template (for example U.S. financial data), select Exchange email as the location, and start in *test mode with policy tips* to see what it finds before you enforce blocking.

Check cost claims. Retention is a compliance feature. If a policy keeps mail longer than users would, mailbox and archive usage grows. A delete-after policy reduces data, but only after the period ends.

11. Professional Out-of-Office Messages

What users do.

• Outlook for Windows: File, Automatic Replies, Send automatic replies, tick Only send during this time range, set the start and end, then write the inside-my-organization message and the outside-my-organization message.
• Outlook on the web: Settings, Mail, Automatic replies, switch on, and set the dates.

Tips for good replies. State the return date, name a contact for urgent matters, avoid revealing too much about travel or personal circumstances in the *external* message, and turn off replies to unknown external senders if you do not want to confirm that a mailbox is active.

What admins do.

ExternalAudience can be None, Known (only senders in the user's contacts), or All. An admin can also set the reply for a departed employee, which is a good use during leaver processing. Check the result with Get-MailboxAutoReplyConfiguration jsmith@contoso.com.

Summary Matrix

Category	Feature	What it helps with	Key setup step
Productivity	Access from anywhere	Remote and flexible work	MFA, block legacy sign-in, limit unmanaged devices
Productivity	Inbox rules	Prioritizing and automating mail	Server-side rules, audit forwarding
Productivity	Email recovery	Preventing accidental data loss	Raise retention to 30 days, know the limits
Collaboration	Calendar sharing	Faster scheduling	Set default calendar detail, sharing policy
Collaboration	Shared mailboxes	Team email management	Create, grant to a group, copy sent items
Collaboration	Contacts and groups	One address list for everyone	Distribution and dynamic groups
Collaboration	Teams and Office integration	Seamless workflow	Check licenses and sharing defaults
Security	Anti-spam, anti-malware	Safer email	Turn on Standard preset policy, add Defender for Office 365
Security	Retention and DLP	Legal and compliance	Pilot policies, retain before delete
Security	Automatic replies	Professional communication	Schedule, set external audience
Admin	Delegate access	Assisted mailbox management	Full Access, Send As, groups

Rollout Checklist

• [ ] Admin roles reviewed, break-glass account created and tested
• [ ] MFA required, legacy authentication blocked, unmanaged-device restrictions tested
• [ ] Forwarding rules audited and external forwarding left blocked
• [ ] Deleted item retention set to 30 days, third-party backup decision made
• [ ] Delegation granted through groups, access reviewed on a schedule
• [ ] Default calendar sharing level chosen and communicated
• [ ] Shared mailboxes created with sent-item copying and a response-time auto-reply
• [ ] Distribution and dynamic groups created, sender restrictions set
• [ ] Teams and OneDrive sharing defaults reviewed
• [ ] Standard preset security policy applied, SPF, DKIM, and DMARC in place
• [ ] Retention policy piloted (retain first), DLP in test mode
• [ ] Automatic replies documented in the leaver process

Facts in this guide about retention windows, default behavior, and limits come from Microsoft's published documentation and can change. Check Microsoft's Recoverable Items documentation and your tenant's current settings before relying on them.

If you want help hardening a tenant, setting up shared mailboxes and delegation properly, or planning a move from a hosted or on-premises mail server to Exchange Online, get in touch.