Microsoft 365 Email: Exchange Online Setup Guide

What Is Exchange Online?

Exchange Online is Microsoft's cloud-hosted email service, included in all Microsoft 365 Business and Enterprise plans. It provides business email with a custom domain (yourname@yourcompany.co.uk), calendar, contacts and tasks — accessible through Outlook (desktop or web), mobile apps, and integrated directly into Teams.

Unlike traditional on-premises Exchange servers, Exchange Online requires no server hardware, no Exchange licensing, and no infrastructure maintenance. Microsoft manages availability, updates and redundancy. For businesses that previously ran their own mail server, Exchange Online removes a significant operational burden while improving reliability and feature access.

Mailbox Sizes

• Business Basic, Standard, Premium — 50GB primary mailbox per user
• E3 and E5 — 100GB primary mailbox plus unlimited archive (In-Place Archive)

For most users, 50GB is sufficient. Heavy email users in roles like legal, finance or procurement may fill a 50GB mailbox over several years. If archiving becomes a requirement, upgrading to E3 or enabling a third-party archive solution is the appropriate approach.

Setting Up Microsoft 365 Email

Adding Your Domain

After creating a Microsoft 365 subscription, add your business domain through the Microsoft 365 Admin Centre. Microsoft guides you through adding DNS records to your domain registrar — typically an MX record for email routing, an SPF record for sender verification, and a CNAME for Autodiscover. Once DNS propagates (usually within a few hours), Microsoft 365 begins receiving email for your domain.

Creating User Mailboxes

User mailboxes are created automatically when you add users in the Microsoft 365 Admin Centre and assign a licence that includes Exchange Online. Users can access their mailbox via outlook.com (Outlook on the web), the Outlook desktop app, or mobile.

Configuring Outlook

The Outlook desktop application (on Windows or Mac) connects to Exchange Online automatically using Autodiscover. Users simply open Outlook, enter their work email address, and the configuration completes without needing to manually enter server settings. On mobile, the Outlook app (available on iOS and Android) connects via the same mechanism.

Migrating Email to Microsoft 365

If your business is moving to Microsoft 365 from another email platform, the migration approach depends on your current setup:

From Google Workspace (Gmail)

Microsoft provides a migration tool in the Admin Centre for Google Workspace migrations. It migrates email, contacts and calendar items. The process can run in the background over several days, with a final cutover once migration is complete.

From Another Exchange Server

Businesses migrating from on-premises Exchange can use a staged, cutover or hybrid migration. The appropriate approach depends on the size of the organisation and whether any on-premises Exchange functionality needs to be retained. Hybrid configurations allow Exchange Online and on-premises Exchange to co-exist during a phased migration.

From Other Hosted Email (e.g. Ionos, Fasthosts)

IMAP migration is the standard approach for moving email from non-Microsoft hosted providers. Microsoft's migration wizard supports IMAP, though the process may require some manual steps for contacts and calendar data. For complex migrations, working with an experienced Microsoft partner reduces risk.

Email Security Configuration

Out-of-the-box, Exchange Online includes Microsoft's baseline anti-spam and anti-malware filtering. However, several additional security configurations should be applied to any business tenant:

SPF, DKIM and DMARC

These three DNS-based email authentication standards work together to prevent email spoofing and improve deliverability:

• SPF (Sender Policy Framework) — tells receiving mail servers which IP addresses are authorised to send email on behalf of your domain
• DKIM (DomainKeys Identified Mail) — adds a cryptographic signature to outgoing email, allowing recipients to verify it hasn't been tampered with in transit
• DMARC — instructs receiving servers what to do with email that fails SPF or DKIM checks, and provides reporting on spoofing attempts

All three should be configured for any business using Exchange Online. SPF and DKIM are quick to implement; DMARC requires monitoring before enforcement to avoid blocking legitimate mail.

Microsoft Defender for Office 365

Defender for Office 365 Plan 1 (included in Business Premium) adds Safe Links (URL scanning at click time) and Safe Attachments (sandboxing of email attachments before delivery). These features provide meaningful protection against phishing and malware beyond the baseline spam filter.

Multi-Factor Authentication

MFA should be enforced for all mailbox users. A compromised email account without MFA can be accessed from anywhere using stolen credentials. Enabling Security Defaults or configuring conditional access policies (available in Business Premium and above) enforces MFA across the organisation.

Shared Mailboxes and Distribution Groups

Exchange Online supports shared mailboxes (for addresses like info@company.co.uk or accounts@company.co.uk) at no additional licence cost up to 50GB. Distribution groups route email to multiple recipients. Both are managed through the Exchange Admin Centre or Microsoft 365 Admin Centre.

For businesses with complex email routing requirements — multiple domains, shared mailboxes, legal hold, or compliance archiving — AMVIA provides Exchange Online management as part of our Microsoft 365 support service.