Exchange Online to introduce External Recipient Rate Limit

Hi IanMcDonald In addition to the questions already posed by JSC-HFT about sending all outbound external email via separate security gateways (that’s what we do), I have some additional questions:

1. Does the ERR apply to outbound external emails generated by mailbox level forwarding to external service provider email addresses? E.g. External Sender > Exchange Online Mailbox > ForwardingAddress forward to > External Service Provider Email (e.g. Salesforce, ServiceNow, etc.)

2. Will Microsoft add a report to enable admins to easily identify senders that exceed the ERR? E.g. similar to the existing “mailboxes exceeding receiving limits” report. This is essential for such a major change.

"we are planning a report that will be available by end of 2024 which will detail current volume metrics for the tenant and usage per mailbox and provide other admin optics." 

UNACCEPTABLE... next time please be ready before bothering us operational admin staff. I have no idea if this will impact my users or not and you haven't given me a way to find out. This is exactly the kind of disruptive mess that could be avoided with better planning on Microsoft's part. While its good to give pre-warning, no enforcement should take place until the tools required to determine scope are out AND enough time from that point is given to make a plan. 

Please do better, I am tired of Microsoft whimsically making my life harder in an effort to save themselves money. THE LEAST you could do is give us the tools we need to handle your mood swings. 

What is the best way to identify mailboxes that are sending emails more than 2,000/24 hours over prior to Microsoft enforcing the limit?

IanMcDonald 

"For finding out which of your cloud-hosted mailboxes are sending to over 2,000 external recipients, we are planning a report that will be available by end of 2024 which will detail current volume metrics for the tenant and usage per mailbox and provide other admin optics.""

Reports availabe by the end of 2024 with enforcement starting from July 2025 just isn't good enough. That's not enough time to analyise, determine the appropriate solution for the use cases that are going to fail, and get something submitted, budgeted, and integrated into our existing delivery roadmaps.

You need to give customers more notice when you're making a 5 fold decrease in functionality they're already paying for!

What about senders that are NOT a 'cloud-hosted Mailbox' and are an anonymous sender via connector routing out through M365, e.g. using On-Premise Exchange via hybrid connector. Are you attributing to sending SMTP address and not 'mailbox' -  This needs clarification as your current statements do not fully clarify what would be affected

Will this be enforced if we use a connector to send all external mail through our email security gateway for outbound mail?  We do not send to the internet via Microsoft servers.  We have some apps that are well short of the overall 10,000 messages a day, but more than 2,000 unique external addresses sometimes.

This certainly reinforces then need for my on-prem Exchange environment and puts an end to any further mailbox migrations - which are our highest volume email senders. It may even require that some mailboxes are moved back to on-prem to prevent communication disruptions with customers. I thought MS wanted all of the mailboxes in M365....

I second stukey's question about making a report available. With the exception of the Hot Recipient Report, every MS report that I've reviewed includes a minimum of 7 days of data. If the limit enforcement is for a 24 hour period, then there needs to be a report that aligns with the limit parameters - AND it must be made available WELL IN ADVANCE of any enforcement. 

Adding my name to the list of people who want to know about senders that are NOT a 'cloud-hosted Mailbox' and are an anonymous sender via connector routing out through M365, e.g. using On-Premise Exchange via hybrid connector.

i support with everyone here, it is really not acceptable that MS dont have the tools yet;  this is a disaster to support team like us!!!

IanMcDonald I have to agree with everyone else. It is unacceptable for customers to wait 8 months for the report to be available. The report should have been available as soon as this change was announced. This is the Basic Authentication depreciation all over again. We had to wait years for reporting to identify Basic Auth users. Now, here we are again, waiting for a report that is essential to quantify the impact of this major change on our O365 tenant. This simply isn’t customer focused. It’s customer hostile. Microsoft should immediately delay and reschedule the implementation of this change until the required reporting is available.