Overview
Mailbox delegation, message delivery, Defender review, Conditional Access remediation, and bounded licensing evidence.
Classification: Developer environment.
Operational scenario & objectives
Validate messaging operations and security-policy behavior while preserving the unresolved Graph licensing-metadata discrepancy.
Environment & technologies
Personal Microsoft 365 E5 Developer tenant with Exchange Online, Defender, Conditional Access, and test identities.
Architecture
Personal Microsoft 365 E5 Developer tenant with Exchange Online, Defender, Conditional Access, and test identities.
Implementation & administration
M365 Lab Project 03 · COMPLETE
Microsoft 365 Messaging & Security Administration
Personal-tenant Microsoft 365 administration demonstrating Exchange Online configuration, Defender review, Conditional Access troubleshooting, audit validation, and licensing administration without presenting lab work as production ownership.
Scope
Personal Microsoft 365 developer tenant
This project uses a personal Microsoft 365 developer tenant to demonstrate bounded messaging, security, identity, and licensing administration. The work is documented as lab validation and does not claim production tenant ownership, enterprise mail-flow responsibility, or organization-wide security authority.
Exchange Online
Shared mailbox, distribution group, transport rule, and message trace
A shared mailbox was configured with Full Access, Send As, and Send on Behalf delegation. A distribution group was created and validated with member delivery. An external-sender transport rule was enabled in Enforce mode and functionally validated through message trace and subject tagging.
Microsoft Defender
Baseline mail protection and message investigation
Anti-malware, Safe Attachments, Safe Links, anti-phishing, quarantine, and Explorer views were reviewed. Explorer evidence confirms visibility of the Project 3 test messages, including the external-sender validation message.
Conditional Access
Troubleshoot the policy result, correct scope, then validate
An internal test user was blocked with sign-in error 53003 because a security-information registration block policy intended for external identities was scoped to all users. Sign-in details and policy evaluation identified the cause. The policy was changed to guest or external users, the audit log recorded the successful update, and a later My Apps sign-in succeeded while MFA still evaluated successfully and the block policy no longer applied.
Licensing
Effective Developer E5 assignment with discrepancy preserved
A dedicated security group was used for Developer E5 licensing. Microsoft 365 Admin Center showed the group assignment with zero licensing errors and zero members without licenses, and the test user held an active effective E5 license. Microsoft Graph returned conflicting assignment metadata, so the discrepancy is explicitly documented instead of being presented as reconciled.
Troubleshooting
Evidence before resets or rebuilds
The project preserved working Exchange and identity configuration while using sign-in logs, Conditional Access evaluation, audit logs, message trace, Defender Explorer, and Graph responses to isolate issues. Exchange Online and Microsoft Graph were also kept in separate PowerShell processes after an assembly-version conflict was identified.
Evidence
Sanitized validation
- Conditional Access evaluationMFA succeeds and the external-user block is not applied
- Successful sign-in detailsPost-remediation My Apps sign-in with MFA requirement
- Exchange validationShared mailbox, distribution group, and transport-rule PowerShell validation
- Message traceDelivered Send As validation
- Defender ExplorerProject 3 message visibility and external-sender validation
- Licensing validationDeveloper E5 group assignment shown in Microsoft 365 Admin Center
- Validation recordDocumented results, limitations, and Graph metadata discrepancy
Project 3 Evidence Set / README.md
Project 3 Evidence Set
Microsoft 365 Messaging & Security Administration
Status: COMPLETE — validated portfolio scope; documented evidence limitations and licensing-metadata discrepancies remain in force
This evidence package consolidates the configuration and validation work completed for Project 3. It is designed for portfolio use and avoids exposing passwords, recovery keys, tokens, private keys, authentication secrets, source IP addresses, local workstation paths, tenant-specific UPNs, and unnecessary object identifiers in public text artifacts.
Validated areas
- Exchange Online shared mailbox configuration and delegation
- Exchange Online distribution group creation and membership
- Exchange Online external-sender transport rule
- Exchange message trace validation
- Microsoft Defender Explorer message visibility
- Microsoft Defender baseline mail protection review
- Microsoft Entra Conditional Access troubleshooting and remediation
- Conditional Access audit-log validation
- Successful post-remediation sign-in validation
- Microsoft 365 Developer E5 effective licensing validation
- Group-license assignment UI validation and documented Graph metadata discrepancy
Important status note
Microsoft 365 Admin Center shows Project 3 E5 Licensing as a group assignment for the Developer E5 SKU, and the test user has an active effective E5 license. However, Microsoft Graph continued to return an empty assignedLicenses collection for the group and assignedByGroup: null for the user. This discrepancy is documented rather than hidden or represented as fully reconciled.
See validation.md and evidence-index.md for the evidence-to-claim mapping.
Public evidence handling
Text-based logs and command output in this folder are public sanitized derivatives. They preserve the validated result and troubleshooting narrative while omitting tenant-specific identifiers that are not necessary to support the portfolio claim. Screenshot evidence is retained as captured project proof and should be reviewed before reuse outside this repository.
Evidence Index / evidence-index.md
Evidence Index
| ID | Evidence file | Supports |
|---|---|---|
| E01 | evidence/screenshots/01-exchange-powershell-validation.png |
PowerShell validation of shared mailbox, distribution group, and external-sender transport rule |
| E02 | evidence/screenshots/02-exchange-message-trace-sendas-delivered.png |
Shared mailbox Send As functional delivery validation |
| E03 | evidence/screenshots/03-defender-explorer-external-sender-validation.png |
Defender Explorer visibility of Project 3 messages and external-sender test |
| E04 | evidence/screenshots/04-ca-policy-scope-update-success.png |
Successful save of corrected external-user Conditional Access scope |
| E05 | evidence/screenshots/05-post-remediation-myapps-success.png |
Functional post-remediation interactive access |
| E06 | evidence/screenshots/06-signin-log-pre-post-remediation.png |
Sign-in log showing failed attempts before remediation and successful attempts afterward |
| E07 | evidence/screenshots/07-signin-success-details.png |
Successful sign-in details, MFA requirement, user and application |
| E08 | evidence/screenshots/08-conditional-access-evaluation-success.png |
MFA policy succeeds; security-info block policy is Not applied |
| E09 | evidence/screenshots/09-m365-e5-group-assignment-list.png |
M365 Developer E5 product page showing Project 3 E5 Licensing as Type Group |
| E10 | evidence/screenshots/10-m365-license-errors-zero.png |
Licensing errors = 0 and members without licenses = 0 |
| E11 | evidence/screenshots/11-m365-group-apps-services.png |
Apps & services configuration view for the selected licensing group |
| L01 | evidence/logs/AuditLogs_2026-09-21.csv |
Public sanitized audit-event derivative validating the Conditional Access policy update |
| L02 | evidence/logs/license-details-output.txt |
Public sanitized summary of effective E5 licenseDetails and relevant service-plan provisioning states |
| C01 | command-evidence.txt |
Sanitized PowerShell evidence transcribed from validated commands in the project session |
Recommended portfolio subset
Use E01, E02, E03, E04, E07, and E08 as the primary visible evidence set. Use E09/E10 for licensing administration if licensing is discussed on the project page. L01/L02 are sanitized public derivatives intended for supporting review; tenant-specific identifiers and source IP details are intentionally omitted.
Validation Record / validation.md
Validation Record
Exchange Online
Shared mailbox
Status: COMPLETE
Validated object:
- Display name:
IT Support Shared - Primary SMTP address:
<shared-mailbox-smtp> - Recipient type:
SharedMailbox
Delegation validated:
- Full Access:
<lab-administrator> - Send As:
<lab-administrator> - Send on Behalf: resolved to Lab Administrator /
<lab-administrator>
Functional message trace evidence shows a message sent as the shared mailbox with status Delivered.
Distribution group
Status: COMPLETE
Validated object:
- Display name:
Project 3 Distribution List - Primary SMTP address:
<distribution-group-smtp> - Recipient type:
MailUniversalDistributionGroup
Validated members:
- Jeremy Fontenot
- Adele Vance
External sender transport rule
Status: COMPLETE
Validated rule:
- Name:
Project 3 - External Sender Pilot - State:
Enabled - Mode:
Enforce - Priority:
0 - Sender scope:
NotInOrganization - Recipient:
<lab-administrator> - Action: prepend subject with
[ EXTERNAL]
Functional validation:
- External test message was delivered with the external-subject marker.
- Defender Explorer showed the message and related test messages as delivered.
Microsoft Defender
Status: COMPLETE for reviewed baseline controls
Reviewed and documented during the project:
- Anti-malware default policy
- Safe Attachments built-in protection
- Safe Links built-in protection
- Anti-phishing default policy
- Quarantine view
- Explorer message investigation view
Defender Explorer evidence confirms visibility of Project 3 test messages, including the external-sender validation message.
Microsoft Entra Conditional Access
Problem observed
Status: REMEDIATED
The Project 3 License Test account authenticated successfully but received sign-in error 53003 because Conditional Access blocked access.
Sign-in analysis showed two relevant policy evaluations:
Multifactor authentication for Microsoft partners and vendors— Failure during the blocked attemptSecurity info registration for Microsoft partners and vendors— Failure withBlock
The security-info registration policy was incorrectly scoped to All users, causing an internal tenant member to hit a policy intended for external/partner identities.
Remediation
Status: COMPLETE
Policy scope changed from:
- Include:
All users
to:
- Include:
Guest or external users - All six external identity categories selected
- External Microsoft Entra organizations:
All
The existing emergency-access exclusions and trusted-location behavior were preserved.
Audit validation
Status: COMPLETE
Relevant audit event:
- Activity:
Update conditional access policy - Result:
Success - Target:
Security info registration for Microsoft partners and vendors - Initiated by: Jeremy Fontenot
- Time: 2026-09-21T20:48:36Z
The audit record shows the policy changed away from includeUsers: ["All"] to external-user targeting.
Post-remediation sign-in validation
Status: COMPLETE
Validated successful sign-in:
- User:
Project 3 License Test - UPN:
<test-user-upn> - Application:
My Apps - Time: 2026-09-21T20:53:15Z
- Status:
Success - Authentication requirement:
Multifactor authentication - Additional detail:
MFA requirement satisfied by claim in the token
Conditional Access evaluation after remediation:
- MFA policy:
Success - Secure password change policy:
Not applied - Reauthentication on sign-in risk policy:
Not applied - Security info registration block policy:
Not applied
This demonstrates that the scope remediation removed the incorrect block without disabling MFA enforcement.
Developer E5 licensing
Effective user license
Status: COMPLETE
The Project 3 License Test account has an active effective license:
- SKU:
DEVELOPERPACK_V2_E5 - SKU ID:
<redacted-sku-id>
The license-details response shows the majority of service plans provisioned successfully. At the captured point in time:
INTUNE_A=PendingInputINTUNE_O365=PendingActivation
These non-final Intune states are documented rather than represented as completed provisioning.
Group assignment
Status: COMPLETE in Microsoft 365 Admin Center / Graph metadata discrepancy documented
Microsoft 365 Admin Center shows:
- Group:
Project 3 E5 Licensing - Type:
Group - Developer E5 product selected
- Group apps and services available for management
- Licensing errors:
0 - Members without licenses:
0
However, Microsoft Graph repeatedly returned:
- Group
assignedLicenses: [] - Group
licenseProcessingState: null - User
assignedByGroup: null
An attempted direct removal of the user license returned the service error that the license was inherited from group membership. Because the Microsoft 365 licensing UI and service behavior contradict the Graph metadata, the discrepancy is preserved as a troubleshooting finding.
Evidence handling
No passwords, tokens, private keys, recovery keys, LAPS passwords, or other secrets are included in this package. Public text derivatives also omit unnecessary tenant-specific UPNs, object identifiers, local workstation paths, and source IP addresses.
Troubleshooting
Sign-in error 53003 traced to an external-identity security-information policy scoped to all users. Restricting scope to guest/external users restored the internal test sign-in while MFA remained effective. A Graph licensing-metadata discrepancy remains documented.
Validation & results
Delivery traces, Defender Explorer, audit logs, successful MFA sign-in evaluation, and effective E5 licensing support the completed lab scope.
Evidence
STRONG — Exchange Online, Defender, Conditional Access, sign-in validation, and Developer E5 licensing evidence are documented.
Skills demonstrated
View the complete capability map →Limitations & claim boundaries
Next milestones
Maintenance-only unless the Microsoft 365 tenant configuration materially changes; preserve the documented Microsoft Graph licensing-metadata discrepancy rather than hiding or overstating it.