What is Exchange Online?

Exchange Online is Microsoft's cloud-hosted email and calendaring service, and it's the backbone of Microsoft 365 communications. When Outlook loads, when a meeting invite arrives, when a Teams calendar event syncs to your phone, when a shared mailbox forwards a support request — that's Exchange. It is the mail engine under the whole platform.

Email may feel like a solved problem in 2026 but the operational discipline around running a large Exchange Online estate is anything but trivial. Threat protection, retention, e-discovery, hybrid identity, mailbox governance, migration from legacy systems — each of these carries real complexity at scale.

What Exchange Online provides

Mailboxes. Typically 50 GB (E1) or 100 GB (E3+) per user, with an online archive of equivalent size on higher tiers. Shared mailboxes for team addresses (support@, sales@); resource mailboxes for meeting rooms and equipment; scheduling mailboxes for booking.

Calendaring. Shared calendars, scheduling assistant, room and equipment mailboxes with delegated booking policies, resource-availability search. Teams calendar is a lens onto the same Exchange calendar; Places (Microsoft's newer workplace planning product) reads from Exchange too.

Contacts. Personal contacts and the tenant-wide global address list. Contact synchronisation across devices is via ActiveSync (older) or the modern Outlook mobile app.

Groups and distribution lists. Traditional distribution lists (SMTP-only, no shared workspace), Microsoft 365 Groups (email + SharePoint site + Teams team + Planner plan), and dynamic membership groups where membership is driven by user attributes.

Mail flow controls. Transport rules that inspect and act on messages (add disclaimers, redirect, reject), connectors that route mail to and from specific partner endpoints, journaling for compliance archiving, and DKIM / SPF / DMARC for authenticated sending.

Public folders. A legacy feature that many orgs still use for shared calendars and reference data. Modernised path is to Microsoft 365 Groups or Teams; Microsoft is not investing in Public Folder features but keeps them available for continuity.

Clients

Exchange Online works with everything you'd expect and a few things you might not:

• Outlook on Windows and Mac — the traditional desktop clients, being replaced by the new Outlook (a re-engineered client using modern APIs).
• Outlook on the web — the browser client, fully-featured for most workflows.
• Outlook mobile on iOS and Android — the recommended mobile client, backed by Microsoft-hosted middleware.
• Teams calendar — really an Exchange calendar rendered inside Teams.
• Native mail apps on macOS and iOS via Exchange ActiveSync — supported but discouraged in favour of Outlook mobile.
• Third-party clients (Thunderbird, Apple Mail) via IMAP / POP — supported for legacy scenarios; modern authentication now required.

The new Outlook is Microsoft's strategic client for desktop. It runs on the same JavaScript codebase as Outlook on the web, connects to Exchange via modern REST APIs, and is progressively replacing the classic Outlook for Windows over 2025–2027.

Security and compliance

Exchange Online includes anti-spam, anti-malware, and basic phishing protection out of the box (Exchange Online Protection, EOP). This is not optional — it runs on every Exchange Online mailbox.

Microsoft Defender for Office 365 layers on top with Safe Links (URL rewriting and time-of-click detonation), Safe Attachments (sandbox detonation of file attachments), Anti-phishing with impersonation detection, and attack simulation training. Defender for Office 365 Plan 1 is included in Microsoft 365 E5 and Business Premium; Plan 2 adds automated investigation and response.

DKIM, DMARC, SPF, and MTA-STS for sender authentication should be configured for every domain that sends email. Poor configuration is a top cause of legitimate mail landing in spam and of phishing / spoofing incidents.

Purview provides compliance layers on top: sensitivity labels for encryption, DLP for outbound content control, retention labels and policies for lifecycle management, communication compliance for content review, e-discovery for legal holds and content search, and litigation hold to prevent purging.

Mailbox audit logs mailbox operations — who read what, who deleted what, who set forwarding rules. Critical for incident response and compliance.

Groups and shared workflows

Microsoft 365 Groups are the modern replacement for distribution lists in Exchange. A group provisions a mailbox, a calendar, a SharePoint site, a Planner plan, and (if used with Teams) a team. Sending mail to the group address delivers to the shared mailbox that group members can see. Members can be added, removed, or made owners.

Shared mailboxes are the traditional shared address, without the associated workspace. Support desk, sales inbox, legal review — anything where "the box gets email that multiple people work" is the shape. Shared mailboxes don't need a licence unless the mailbox is over 50 GB or the mailbox needs to be in-place archived.

Dynamic distribution groups compute membership from Entra ID attributes at send time — useful for "all managers", "all employees in Sweden", "all staff on the DevOps career track".

Migration and hybrid

Migrating from an on-prem Exchange Server, Google Workspace, or an IMAP source is a real project. Microsoft provides native migration tools in the Exchange admin center for common paths; third-party tools (BitTitan MigrationWiz, Quest) handle edge cases and large-scale batching.

Hybrid Exchange — some mailboxes on-prem, some in the cloud, with unified addressing and free-busy across the boundary — is the classic migration pattern. Increasingly a transient state rather than a permanent architecture; Microsoft is reducing feature investment in hybrid over time.

For orgs migrating in 2026, the typical path is a batch-based mailbox move from the source system to Exchange Online, with users cut over in waves. A typical enterprise migration runs 3–9 months depending on size and complexity.

Exchange Online vs Exchange Server

Exchange Server is the on-premises product that you install on your own Windows servers. Exchange Online is the cloud service. The two share concepts, PowerShell surfaces, and message formats but the feature sets have diverged materially since 2020 and continue to diverge.

For any new deployment, Exchange Online is the answer. Exchange Server continues to receive security updates but has effectively stopped receiving new features. Hybrid Exchange deployments during a migration are common; hybrid as a permanent architecture is rare and getting rarer.

Common operational disciplines

Three areas that every Exchange Online estate has to handle.

Anti-phishing posture. Defender for Office 365 configuration, DKIM/SPF/DMARC on every domain, user awareness training. Phishing remains the top attack vector into most tenants; investment here pays back.

Mail flow and third-party integrations. Connectors to third-party spam filters, journal recipients for archive systems, DLP integrations. Every third-party in the mail flow adds a failure surface — periodic review of what's actually needed is worth the time.

Mailbox governance. Retention policies to purge stale content, litigation hold configuration for regulated users, quota policies to prevent runaway mailboxes, mailbox audit review. The unglamorous side of email administration and the one that catches you in a legal request or a compliance audit if it's not done.

Licensing

Exchange Online is included in every Microsoft 365 SKU. Two standalone tiers exist for orgs that want only email:

• Exchange Online Plan 1 — 50 GB mailbox, no archive, basic features.
• Exchange Online Plan 2 — 100 GB mailbox, unlimited archive on higher tiers, litigation hold, in-place archive, DLP.

Add-ons: Defender for Office 365 Plan 1 and Plan 2, Microsoft 365 Copilot (which reads from Exchange for grounding), Advanced eDiscovery (part of E5 or Purview add-ons).

Frontline (F1, F3) mailboxes are 2 GB, sufficient for shift workers who use email lightly.

The short version

Exchange Online is the cloud email and calendaring service under Microsoft 365. Mailboxes, calendars, groups, shared mailboxes, mail flow, all wired to Entra identity and Purview compliance. Threat protection through EOP and Defender for Office 365; retention and e-discovery through Purview. The three operational disciplines are anti-phishing posture, mail flow health, and mailbox governance.

For any org running Microsoft 365, Exchange is not optional — it is the platform's default communication surface. Running it well is one of the highest-leverage IT investments there is.