Customizable Recipient Limits in Exchange Online

Microsoft has about 258 million paid seats for Office 365, The Verge reported in April 2020. As a “shared medium” for a lot of organizations around the globe, it should be clear that there must be limits in the Microsoft 365 ecosystem, e. g. message size limits or Teams member limits. In this blog we'll cover recipient limits in Exchange Online.

Exchange Online Protection Default Limits

Exchange Online Protection (EOP) is the cloud-based filtering services which protect your organization from malicious messages. Besides filtering, EOP is the first hop within Exchange Online when it comes to email messages. In other words, it acts like an smtp gateway.

Although there are special limits for different subscription models (like the maximum mailbox size depends on the license used), the recipient limits within EOP are the same. We distinguish between two different limits:

• Receiving limits: applies to the number of messages that a user, group, or public folder can receive per hour. The maximum receiving limit is 3,600 messages per hour.
• Sending limits: applies to the number of recipients, number of messages, and number of recipients per message that a user can send from their mailbox.
  • Recipient rate limit: applies per-user to all outbound and internal messages sent from an Exchange Online mailbox. This value can prevent users and applications from sending large volumes of messages. The maximum recipient rate limit is 10,000 recipients per day.
  • Recipient limit: the maximum number of recipients per message in the To:, Cc:, and Bcc: fields. The maximum recipient limit 1,000 recipients.
  • Recipient proxy address limit: the maximum number of additional proxy addresses a mailbox can have. The maximum recipient proxy address limit is 400.
  • Message rate limit: the maximum number of messages a user can send from their Exchange Online mailbox within a specific period. The message rate limit is 30 messages per minute.

Exchange Online Customizable Recipient Limits

Like in the Exchange on-premises version, since 1997 have been able to configure the recipient limit on a per-user basis to avoid potential spam messages, rogue employees, or hacked email accounts. Exchange Online Protection already includes default limits which are mentioned in the last section above, but email admins can use custom limits to improve the security posture of their organization as well.

These limits can be configured in four different ways:

• Remote PowerShell for single mailboxes, multiple mailboxes, and for mailbox plans.
• Classic Exchange Admin Center (EAC) for single mailboxes.
• Modern Exchange Admin Center (EAC) for single and multiple mailboxes.
• Tenant-level settings

Exchange Online Customizable Tenant-level Recipient Limits

In August 2020, Microsoft introduced the capability to modify a tenant-wide recipient limit with Remote PowerShell. The property MaxRecipientEnvelopeLimit on the TransportConfig objects can be used to configure the tenant-wide recipient limit:

The value “Unlimited” under the transport config means it falls back to the maximum recipient limit EOP offers by default (a maximum of 1,000 recipients as mentioned above). As like in Exchange on-premises, the tenant-level value is used if the mailbox setting is “Unlimited”. If the mailbox setting is a numeric value, it is authoritative.

Example:

Summary

ENow's Office 365 solution has a wide variety of built in Office 365 reports ranging from: traffic, storage & usage, client access, app specific reports (Teams, OneDrive, etc), license adoption, license management, and more! These reports can easily be customized to meet your organizations needs. 

Given the breadth of Office 365 and each organizations unique reporting needs, we realize it would be nearly impossible to make every report imaginable out of the box. With that said, we have built in PowerShell component with the ability to store your own reports directly to the console.