How to set up exchange online: Admin Access and Mailboxes

How to set up Exchange Online depends on your scenario: enable a new tenant, add mailboxes to an existing tenant, configure archiving, or grant admin access. Pick the wrong path and mail flow can break, retention settings can stay unset, or users can lose sign-in access. This guide shows the exact setup steps for each case, plus the admin access and app connection points you need.

What Exchange Online setup means

Exchange Online is Microsoft-hosted business email with email, calendar, and contacts access in a browser and on devices. It includes built-in anti-malware and anti-spam filtering, supports an in-place archive, and comes with a 99.9% uptime SLA. It also integrates with Outlook for offline access. (Microsoft)

The setup path can change by scenario. A new tenant needs mailbox licensing and organization setup. An existing tenant may only need mailbox assignment, admin access, or app authentication. Archiving is separate again, because retention and compliance needs often depend on mailbox policy choices, not just basic mail delivery.

Which Exchange Online setup path do I need?

📊 Exchange Online offers a 99.9% uptime service level agreement. Source: Microsoft.

What you'll need before setup

Before you touch a mailbox or a connector, verify licensing, permissions, tenant match, and the mailbox defaults already in place. Most setup failures come from missing admin rights, the wrong tenant, or trying to configure archiving or PowerShell before the account has the needed role.

Pre-flight checks

• Confirm the user has an Exchange Online Plan 1 license or the archive license needed for the task.
• Check that your account has an Exchange admin role in Microsoft 365.
• Verify the tenant where you sign in is the same tenant that hosts the mailbox or app.
• Review whether the mailbox already exists or still needs provisioning.
• Check the default mailbox profile fields for the recipient, especially if an app will connect later.
• Confirm whether the task belongs in the Exchange admin center or in PowerShell.

Common blockers to spot first

• Permission mismatch: the account can sign in, but not manage mailboxes or archives.
• Tenant mismatch: the mailbox exists in one tenant and the admin signs into another.
• Missing license: the mailbox opens, but archive or admin features do not appear.
• Auth failure: PowerShell uses legacy sign-in instead of modern authentication.
• Incomplete mailbox defaults: display name, aliases, or recipient settings are not finished.

Set up the mailbox path

Use this path when you need to create or activate a user mailbox in a new or existing tenant. The main job is to assign the right license, open the Exchange admin center, and confirm the mailbox can send, receive, and open in Outlook and Outlook on the web.

Steps for mailbox setup

1. Assign the user an Exchange Online Plan 1 license in Microsoft 365 admin center > Billing > Licenses.
2. Open Exchange admin center > Recipients > Mailboxes and confirm the mailbox appears.
3. Set the mailbox details in Mailboxes > Edit, including aliases and address policy if needed.
4. Open Outlook on the web and confirm sign-in works with the licensed account.
5. Open Outlook desktop and confirm offline access syncs mail, calendar, and contacts.

New tenant versus existing tenant

A new tenant often needs the first mailbox created, a custom domain added, and the initial admin account confirmed. An existing tenant usually needs a mailbox assigned to a user who already exists, plus a quick check that the address policy and recipient settings match the organization’s current structure.

Say your tenant has 12 users and only one new contractor needs email. The faster path is to assign the license to that account, then verify the mailbox in the Exchange admin center. The domain and tenant already exist, so you do not need a fresh organization setup.

Set up Exchange Online archiving

Use the archive path when the goal is compliance, regulatory retention, or eDiscovery. Exchange Online Archiving is described as supporting archiving, compliance, regulatory, and eDiscovery needs, and it supports long-term email retention with an in-place archive. This is separate from normal mailbox setup.

Steps for archive setup

1. Confirm the mailbox has the archive license or archive add-on required for that user.
2. Open Exchange admin center > Recipients > Mailboxes > select the user.
3. Turn on the in-place archive in mailbox features or archive settings.
4. Set the retention policy that fits your compliance target before any cleanup runs.
5. Check eDiscovery permissions and confirm the mailbox appears in the discovery scope.

What to validate after enabling archive

Make sure the archive mailbox is visible in Outlook on the web and in Outlook desktop after sync completes. If the user depends on litigation holds or long retention, confirm those settings separately. Archive enablement alone does not replace a retention policy.

Set up admin access and PowerShell

Use PowerShell when you need scripted administration, bulk changes, or access that is faster than the web interface. Install the Exchange Online PowerShell module, connect, and verify that the account has the right role before you run anything that changes recipients or settings.

How to install Exchange Online PowerShell module

1. Open PowerShell as a user with permission to install modules.
2. Run Install-Module ExchangeOnlineManagement.
3. If prompted, allow the repository and complete the installation.
4. Run Import-Module ExchangeOnlineManagement.
5. Confirm the module loads without errors.

How to open Exchange online PowerShell

1. Open PowerShell or Windows Terminal.
2. Run Connect-ExchangeOnline -UserPrincipalName admin@domain.com.
3. Sign in with an account that has Exchange admin rights.
4. Run Get-EXOMailbox -ResultSize 5 to confirm access.

If sign-in prompts repeat or the session fails, the account may lack the right role, or the module may be outdated. A quick first validation is to list a small number of mailboxes before making changes.

Authentication choice for apps

For Dynamics 365 Customer Engagement, Exchange Online can be configured as a server profile type. When Exchange and Dynamics 365 are in the same tenant, use Server-to-Server Authentication. When Exchange is in a different tenant, use OAuth cross-tenant authentication, and in the connection settings verify the server URL, port values, and connector fields such as the outgoing server, authentication mode, and TLS-related options before saving.

Suppose a CRM instance is in Tenant A and mailboxes are in Tenant B. That is a cross-tenant case, so the OAuth path is the right one. If both services sit in the same tenant, use the same-tenant server-to-server path instead.

Common setup blockers

Most failures come from a short list of issues: the wrong admin role, the wrong tenant, a missing license, or a partially configured mailbox. Treat the blocker first, then return to the setup path that matches the scenario.

If that didn't work, try this next

1. Check Microsoft 365 admin center > Users > Active users and confirm the license is assigned.
2. Check Exchange admin center > Permissions and confirm your role can manage recipients or archives.
3. Reopen the sign-in session in the correct tenant, sign out of any other tenant context, and retry the connection.
4. Update the Exchange Online PowerShell module, then reconnect.
5. Review mailbox features and recipient settings for missing aliases, archive state, or policy assignment.

Common first-timer mistake: a user gets the license, but the admin never checks the mailbox in Exchange admin center. The mailbox then appears incomplete because the license is present, yet the recipient settings still need review before Outlook and web access are validated.

Prevention: after each setup, run one validation step immediately. For mailboxes, open Outlook on the web. For PowerShell, run a read-only mailbox command. For archiving, confirm the archive state in the mailbox properties.

Frequently asked questions

How do I set up Exchange online Plan 1?

Assign the license in Microsoft 365 admin center > Billing > Licenses, then open Exchange admin center > Recipients > Mailboxes to confirm the mailbox appears.

How do I install the Exchange Online PowerShell module?

Open PowerShell and run Install-Module ExchangeOnlineManagement, then Import-Module ExchangeOnlineManagement. Use an account that can install modules. If the repository prompt appears, allow it, then verify the module loaded before you connect to Exchange Online.

How do I open Exchange online PowerShell?

Open PowerShell or Windows Terminal and run Connect-ExchangeOnline -UserPrincipalName admin@domain.com. Sign in with an Exchange admin account. A good first check is Get-EXOMailbox -ResultSize 5, which confirms the session is live and the role can read mailbox data.

How do I set up Exchange Online archiving?

Open Exchange admin center > Recipients > Mailboxes, select the user, and enable the in-place archive. Then assign the archive license, set the retention policy, and confirm the mailbox is ready for compliance or eDiscovery needs. Archive setup should be validated separately from ordinary mailbox creation.

How do I set up SMTP relay for Exchange Online?

Use the connector path in Exchange admin center > Mail flow > Connectors, then create a connector from your organization's email server to Microsoft 365. In the connector, set the sender domain, require TLS, and specify the certificate subject name or common name that matches the certificate used by the sending device or app. On the sending system, enable TLS, install the matching certificate, and point mail to the correct smart host before you test with a controlled message.

How do I set up Exchange Online as an SMTP relay?

Set up a mail flow connector in Exchange admin center and verify the sending system uses the approved sender address and authentication method. If the relay also needs TLS, confirm the certificate is installed on the sending system, the certificate name matches the value entered in the connector, and the TLS option is enabled before testing. Keep this separate from mailbox or archive setup.