Exchange Online

The PST is now a very old file format. Originally introduced to give users the ability to store email moved from their Exchange mailbox, the need for PSTs disappeared years ago because Office 365 users have massive mailboxes. Despite this, some organizations persist in allowing people to use PSTs.

Office ProPlus Version 1904 boasts new privacy controls and Microsoft has documented how it thinks about required and optional data collected from users. Office 365 still lacks privacy controls for the server apps. It remains to be seen if customers will be happy and consider that Microsoft has solved the GDPR issues identified in the Dutch DPIA report in November 2018.

Office 365 retention policies help organizations keep information for as long as needed. But retention consumes storage. This isn’t a problem for Exchange Online, but it is for SharePoint Online, because files held in the Preservation Hold Library are charged against the tenant storage quota. This isn’t a reason to not use retention policies, but you should be careful.

Exchange 2019 has been around for six months. It’s a good time to consider if on-premises organizations should upgrade or stick with the version of Exchange they run today. Exchange 2019 is a solid release, even if Microsoft’s engineering efforts are largely focused on the cloud these days. Of course, moving to Exchange Online is an option too, but perhaps not for the dedicated on-premises deployments.

The recent exposure of a privilege elevation vulnerability that exists in the control Exchange has over Active Directory and EWS push notifications is fixed by cumulative updates for Exchange 2013, Exchange 2016, and Exchange 2019 and a roll-up update for Exchange 2010 SP3. These changes mark an architectural modification for Exchange, something that Microsoft is loathe to do outside major releases. Install the updates now!

Exchange Online transport (mail flow) rules are a powerful way to ensure that email from Office 365 tenants to specific recipients are encrypted in a consistent manner. Using rules relieves the need for users to become involved and makes sure that email is protected in a way that recipients can read messages. It’s a good way to use the protection features built into Office 365.

Azure Conditional Access policies are pretty powerful, especially when applications accommodate their controls. OWA and SharePoint Online can co-operate with conditional access policies to block the ability of Office 365 users to download email attachments and documents. Although not a perfect solution, it’s a good start.

Microsoft is still building out the new OWA (for Exchange Online) interface. One new feature is the ability to make categories into Outlook favorites. This seems like a small thing, but it’s really quite useful if you make an effort to use categories. Some people will love it. Some will say “blah.”

Microsoft plans to create an automatic policy to encrypt outbound email containing sensitive data for all Office 365 tenants. It sounds like a good idea until you begin looking at the operational consequences of such an action. For instance, how to insert a new transport rule into a complex set of existing rules. All in all, this is not a good plan.

Microsoft has optimized the Click-to-Run version of Outlook for Office 365. There’s nothing startling about that, but the Outlook team didn’t communicate the change well and they weren’t very kind to people who asked them to reconsider the change in UserVoice. That’s not good.