Email is the only IT service every person in the organisation uses daily, and at the same time the main attack vector. I write about filtering and quarantine in Exchange Online, about SPF, DKIM and DMARC without breaking your own deliverability, about applications that still send mail over plain SMTP, and about how to tell users what they cannot see.
A retention policy in Microsoft Purview and an MRM retention policy in Exchange Online are two different mechanisms, and confusing them is the most common cause of full mailboxes. What each one does, where the space really goes, and how to check it with commands.
A strict policy published in one day ends with your own invoices and notifications being rejected. The rollout stages with ready-made DNS records, DKIM configuration in Exchange Online and commands to verify each step.
A message caught by a filter does not always generate a notification. Whether the user ever finds out, and whether they can release it, depends on the quarantine policy assigned to the mechanism that caught it.
Older applications, printers and scripts send mail to port 25 with no encryption and no authentication. A comparison of the ways to connect them to Microsoft 365 and a Postfix relay configuration that replaces twenty exceptions.