SAMPLE-EXO-01 · FICTIONAL DATE 2026-01-12
Example Workshop Ltd · Exchange Online and Hybrid Mail Flow Review
Status: Fictional format sample · Domain label: example.test (reserved fictional domain; no real organisation) · Method: read-only review of supplied evidence; no live access.
Scope
Connectors, mail flow rules, shared mailboxes, accepted domains and one remaining Exchange 2016 server in a fictional hybrid environment.
Executive summary
Mail flows reliably, but the environment carries history: a remaining Exchange 2016 server with no exit plan, transport rules that add external recipients with no documented owner, and shared mailboxes with unreviewed permissions.
Evidence reviewed
| ID | Source | Coverage | Status |
|---|---|---|---|
| E-01 | Connector list export | 2 inbound, 2 outbound | Provided |
| E-02 | Mail flow rule export | 23 rules | Provided |
| E-03 | Shared mailbox permission report | 17 shared mailboxes | Provided |
| E-04 | Accepted domains, MX and DKIM status list | 3 domains | Provided |
| E-05 | Server inventory note | 1 Exchange 2016 hybrid server | Provided by the administrator |
What was not checked
- Mailbox content
- Message trace results
- Individual client protocols
- Public folders (none reported)
Findings
Severity: High means fix first; Medium means plan soon; Low means tidy up.
| ID | Severity | Finding | Evidence | Recommended next step |
|---|---|---|---|---|
| F-01 | High | Exchange Server 2016 still in use and past end of support | E-05 | Decide the exit route (finish the migration, upgrade to a supported Exchange Server version, or a recipient-management-only server where Microsoft guidance allows) and set a date. Check current Microsoft guidance. |
| F-02 | High | 2 transport rules add external recipients to mail matched by broad conditions | E-02 | Confirm the business reason and owner for each rule, narrow the conditions or remove the rules. |
| F-03 | Medium | Outbound connector accepts any sending IP | E-01 | Restrict by certificate or IP range as appropriate. |
| F-04 | Medium | 5 shared mailboxes have no named owner and Full Access granted to individuals | E-03 | Name an owner for each, move access to groups and review it regularly. |
| F-05 | Medium | No DKIM signing configured for one accepted domain | E-04 | Enable DKIM for the domain and publish the records. |
| F-06 | Low | 8 transport rules have no description or owner | E-02 | Document or retire each rule. |
Fix first
- Choose the Exchange 2016 exit route and date Effort: Medium.
- Review and narrow the two recipient-adding rules Effort: Low.
- Restrict the outbound connector Effort: Low.
- Name owners and tidy access on shared mailboxes Effort: Low.
- Enable DKIM on the third domain Effort: Low.
30/60/90-day plan
- First 30 days: Decide the exit route; review the two recipient-adding rules with their owners; name shared mailbox owners.
- By 60 days: Restrict the connector; enable DKIM; document every rule.
- By 90 days: Carry out the chosen exit steps under a separate plan; re-export configuration for a follow-up check.
Customer decision
- Approval: this sample authorizes no changes; no remediation was performed.
- Limit: findings reflect only the evidence listed above, as supplied at the time.
Limitations
This fictional sample demonstrates format, not a real assessment. It contains no real customer data, gives no security or compliance guarantee, and made no change to any system.