Microsoft 365 Email: Exchange Online Setup Guide

What is Exchange Online?

Exchange Online is the email engine behind Microsoft 365. It delivers business email on your own domain (yourname@yourcompany.co.uk), plus shared calendars, contacts and tasks, reached through Outlook on desktop, web and mobile and built straight into Teams. It is included in every Microsoft 365 Business and Enterprise plan.

Unlike a traditional on-premises Exchange server, Exchange Online needs no server hardware, no Exchange Server licence and no patching cycle. Microsoft runs the availability, updates and redundancy across its datacentres (Microsoft 365 plans). For any business still nursing an ageing mail server, moving to Exchange Online removes a real operational burden and usually improves reliability at the same time. Securing that mailbox properly is where our Microsoft 365 security work begins.

How big is a Microsoft 365 mailbox?

Mailbox size depends on the plan. Microsoft 365 Business plans give a 50GB primary mailbox, while the Enterprise E3 and E5 plans give 100GB plus a separate archive. For most office users that is years of headroom; only heavy-correspondence roles tend to push the limit (Exchange Online limits).

• Business Basic, Standard, Premium — 50GB primary mailbox per user
• E3 and E5 — 100GB primary mailbox plus unlimited archive (In-Place Archive)

For most users, 50GB is comfortable. Heavy email users in legal, finance or procurement roles may fill a 50GB mailbox over several years. When archiving becomes a hard requirement, the right move is usually upgrading to E3/E5 to enable the In-Place Archive rather than bolting on a workaround.

The list prices that include Exchange Online are public: Business Basic is £4.60, Business Standard £9.60 and Business Premium £16.90 per user per month (ex VAT, annual commitment) (Microsoft 365 for business). Business Premium is the plan we recommend to most SMEs because it bundles the security tooling, not just the mailbox.

How do you set up Microsoft 365 email?

Setting up Microsoft 365 email is a three-step job: prove you own your domain, point its DNS records at Microsoft, then create licensed mailboxes. Outlook configures itself automatically once a mailbox exists, so most of the effort sits in getting DNS right the first time.

Adding your domain

After creating a Microsoft 365 subscription, add your business domain in the Microsoft 365 Admin Centre. Microsoft walks you through the DNS records to add at your registrar — typically an MX record for mail routing, an SPF record for sender verification and a CNAME for Autodiscover. Once DNS propagates (usually within a few hours), Microsoft 365 starts receiving mail for your domain.

Creating user mailboxes

User mailboxes are created automatically when you add a user in the Admin Centre and assign a licence that includes Exchange Online. Users then reach their mailbox through Outlook on the web (outlook.office.com), the Outlook desktop app, or the mobile app.

Configuring Outlook

The Outlook desktop app on Windows or Mac connects to Exchange Online automatically using Autodiscover. The user opens Outlook, enters their work email address, and the profile completes without manual server settings. The Outlook mobile app on iOS and Android connects the same way.

How do you migrate email to Microsoft 365?

The migration method depends on where your email lives today. Microsoft provides built-in tools for Google Workspace and on-premises Exchange, and supports IMAP for most other hosts. The data — mail, contacts, calendars — moves in the background, with a final DNS cutover once everything has copied across.

From Google Workspace (Gmail)

Microsoft provides a Google Workspace migration tool in the Admin Centre that moves email, contacts and calendar items. It can run in the background over several days, with a final cutover once the copy completes.

From another Exchange server

Businesses leaving on-premises Exchange can use a staged, cutover or hybrid migration. The right approach depends on organisation size and whether any on-premises Exchange functionality must be retained. Hybrid lets Exchange Online and on-premises Exchange co-exist during a phased move.

From other hosted email (Ionos, Fasthosts)

IMAP migration is the standard route for non-Microsoft hosts. Microsoft's migration wizard supports IMAP, though contacts and calendar data often need manual handling. For complex cutovers, working with an experienced Microsoft partner cuts the risk of lost mail or extended downtime.

How do you secure Microsoft 365 email?

Exchange Online ships with baseline anti-spam and anti-malware filtering, but the default tenant is not hardened. Three things matter most: email authentication (SPF, DKIM, DMARC), enforced multi-factor authentication, and the advanced filtering in Microsoft Defender for Office 365. Skipping any of them leaves the door open.

SPF, DKIM and DMARC

These three DNS-based standards work together to stop attackers spoofing your domain and to improve deliverability. The NCSC recommends all three for any organisation sending email (NCSC email security guidance).

SPF and DKIM are quick wins. DMARC needs a monitoring period before you move to enforcement, so legitimate mail is not blocked while you tune it.

Microsoft Defender for Office 365

Defender for Office 365 Plan 1 (included in Business Premium) adds Safe Links, which scans URLs at click time, and Safe Attachments, which sandboxes attachments before delivery. Both go well beyond the baseline spam filter and are central to credible phishing protection. For wider endpoint and identity coverage, this pairs with Microsoft Defender for Business.

Multi-factor authentication

MFA should be enforced for every mailbox user. A compromised account without MFA can be opened from anywhere with stolen credentials — and email is the most-attacked entry point in most SMEs. Enabling Security Defaults or, better, conditional access (Business Premium and above) enforces MFA across the tenant. See our guide to MFA setup for Microsoft 365.

What about shared mailboxes, groups and backup?

Exchange Online supports shared mailboxes — for addresses like info@ or accounts@ — at no extra licence cost up to 50GB, plus distribution groups for routing mail to multiple recipients. Both are managed in the Exchange or Microsoft 365 Admin Centre. One thing it does not do is back your mail up.

Microsoft protects the platform, but under its shared-responsibility model your data is your responsibility. Accidental deletion, malicious insiders and ransomware can all destroy mail that Microsoft will not recover for you. That is why we treat third-party Microsoft 365 backup as standard, not optional, for any business that relies on email for evidence, contracts or compliance.

For organisations with complex routing — multiple domains, shared mailboxes, legal hold or compliance archiving — AMVIA runs Exchange Online as part of our Microsoft 365 support service. One provider, security-first, Microsoft-certified engineers.