MOERA domains for email
When a organization creates a new tenant in Microsoft 365, an onmicrosoft.com domain (or similar default domain like onmicrosoft.de) is provided. These MOERA (Microsoft Onli...
Updated Mar 30, 2026
Version 9.0
Blog Post
Given the recent M365 Message Center MC1301802 notification "Change Optics report for Exchange Online begins public preview", that states:
At launch, the report includes the following scenarios:
- OMC (onmicrosoft.com external traffic): Identifies onmicrosoft.com traffic being sent externally so organizations can address this usage to avoid throttling.
Given this report information would be useful in identifying email traffic in scope of this "Limiting Onmicrosoft Domain Usage for Sending Emails" change, will this be delayed as the GA for this report is not until after the deadline for the implementation of this change?
SeanMSFT
Microsoft
MicrosoftThere is no delay to MOERA throttling. The report was rushed to provide an additional view for customers yet to be throttled, but was not a prerequisite to prepare for throttling which has successfully rolled out to all but the last group of organisations
Based on review, the OMC report from Change Optics report is not that helpful.
Seems to be tracking Header From *@domain.onmicrosoft.com senders instead of Envelope sender.- Arindam_Thokder
Is it those NDRs or Journaling emails? Or were there some other emails where Header From is *@domain.onmicrosoft.com instead of Envelope sender. Can you tell us how these emails are sent?
Yes, Change Optics shows Internal PostMaster traffic for which MailFrom is blank as under scope of OMC change.
It does not show autoforward where SRS falls back to *.onmicrosoft.com MailFrom.
Interestingly, not even Advanced Hunting shows Outbound Traffic with SenderMailFromDomain has "onMicrosoft.com" properly for autoforward SRS rewrite scenario.EmailEvents
| where Timestamp >= ago(30d) and SenderMailFromAddress has_any ("contoso.mail.onmicrosoft.com", "contoso.onmicrosoft.com")
and not(EmailDirection has_any ("Intra-org","Inbound"))
Combine this with Bookings where after updating PrimarySMTPAddress you need to unpublish and republish all pages to ensure the invites no longer go out with the old *.onmicrosoft.com MailFrom Domain.... And the fact that the unpublish and republish does not really work for an admin with super user setup(FullAccess & SendAs) even after licensing with Bookings service plan.
For a large organization, preparing for this change has been a pain.
Agree, we found the same thing. The change Optics report is not useful. We are using the 'Explorer' feature in the Defender Portal instead to track Envelope Senders using *@domain.onmicrosoft.com externally
