An Exchange Online mailbox is the store of email, calendar, contacts, and tasks for one Entra ID user (or for a shared mailbox). Outlook, Outlook on the web, and mobile mail apps are clients. They are not the mailbox.
How you choose a Microsoft 365 plan and how you cut over DNS during a migration sit in the plan article. How receiving servers trust your domain is SPF, DKIM, and DMARC. This guide is the mailbox itself.
User mailbox, address, and alias
A licensed user gets one primary mailbox. The primary SMTP address is the From address others will usually see (jane@company.com). An alias (proxy address) is another address that delivers into the same mailbox (jane.tan@company.com, sales-jane@company.com). Adding an alias does not create a second inbox.
Send as and send on behalf are permissions on a mailbox. They let another person send with that address. They are not aliases. A staff member who “uses” info@ should have permission on the info mailbox, not an alias on their own mailbox that hides who owns the mail.
A user can have a mailbox without being an Exchange Administrator. The role is only for people who change mail flow and other people’s mailboxes.
What happens when a message arrives
- DNS points the domain’s mail exchanger at Exchange Online
- Exchange accepts the message for a primary address or an alias
- Optional transport rules may inspect, redirect, or add a disclaimer
- The message is stored in the target mailbox
- Each client the user opens syncs that one store
Clients, devices, and retention
Several devices can open the same mailbox. They should use modern authentication (sign-in through Entra ID), not an app password leftover from legacy IMAP, if you want MFA to apply.
Deleted items go to Deleted Items, then to Recoverable Items for a period, then they follow the retention settings on the mailbox. That is not a company backup product by itself. Litigation hold and retention policies are extra controls an admin turns on.
Calendar and rooms are mailboxes too. A meeting room is usually a resource mailbox, not a licensed person.
Size quotas exist. A mailbox at the quota stops receiving mail. That looks like “email is down” to the user.
What this page does not cover
It does not walk a DNS cut-over. It does not compare Business vs Enterprise SKUs. It does not replace the SPF/DKIM guide. Hybrid Exchange (some mailboxes still on a server in the office) is a separate architecture; most SMEs on Microsoft 365 are cloud-only.
A practical example
A company creates a new mailbox every time someone wants a second address. Three people have hr@ as an alias on their own mailboxes, and none of them see the same thread. The revision keeps one HR shared mailbox, gives the three people send-as and full access, and leaves personal aliases only for name variants of the same person.
Key takeaways
- The mailbox is the store. Outlook is a client.
- An alias delivers to the same mailbox. It is not a second inbox.
- Send-as is a permission. Shared work addresses belong on a shared mailbox.
- Several devices should sign in to one mailbox with modern authentication.
FAQ
Can two people share one user mailbox instead of a shared mailbox?
They can, and it causes audit and licence confusion. Use a shared mailbox or a Microsoft 365 group for shared addresses.
Why did a message arrive for an old address?
That old address is still an alias, or a transport rule still redirects it. Removing a person does not always remove every proxy address.
Do we need Exchange Admin to add an alias?
Someone with a mail-recipient role or Exchange Admin does. The mailbox owner cannot always add their own aliases, by design.