0:00–0:20
Review
0:20–0:35
Tenant tidy
0:35–1:40
Assessment
1:40–2:00
Debrief
0:00 – 0:20
Review · 20 min
Week 3 consolidation — the complete email stack
Connect the four days of email infrastructure work into one mental model. Not re-teaching — mapping the layers.
- The complete email stack diagram — draw on the board and leave up: DNS (MX, SPF, DKIM, DMARC) → Exchange Online Protection (anti-spam, anti-malware, connection filter) → Defender for Office 365 (Safe Attachments, Safe Links, anti-phishing) → Transport rules (disclaimers, policy enforcement) → Mailbox delivery. Ask: "Which layer would stop a spoofed email? Which would stop a malicious attachment? Which would stop an auto-forwarding data leak?"
- Mail flow troubleshooting methodology — walk through the systematic approach: start with Message Trace (did the message arrive at Exchange Online?), then DNS health (are the MX, SPF, DKIM records correct?), then transport rules (did a rule block or redirect it?), then mailbox state (is the mailbox provisioned and not over quota?). This is the methodology students will use in the assessment.
- 5 minutes open Q&A — concepts only, not assessment answers
Instructor note: Before the session, pre-seed the assessment scenario: delete the MX record or change its value in one student's DNS zone (or introduce a deliberate misconfiguration in a transport rule). Students must diagnose and fix a real problem, not a hypothetical one. Alternatively, use a fabricated scenario on the assessment sheet with a consistent set of symptoms students investigate in their own tenant context.
0:20 – 0:35
Tenant tidy · 15 min
Final self-audit before assessment
- All DNS records healthy (green) in the admin centre DNS health view — MX, SPF, DKIM, DMARC, Autodiscover
- DKIM status showing Enabled (not CNAMEMISSING) in the EAC
- DMARC TXT record confirmed in MXToolbox
- All three shared mailboxes and three resource mailboxes present in the EAC
- All five transport rules present and enabled in Mail flow → Rules
- All five Defender policies present — anti-spam, anti-phishing, Safe Attachments, Safe Links confirmed
- Lab Journal entries complete for Days 1–4
Assessment boundary: At 0:35 no further tenant changes are permitted unless directed by the assessment sheet. Students work from the current state of their tenant.
0:35 – 1:40
Assessment · 65 min
Week 3 assessment — the Lakeview Logistics mail delivery failure
Students receive the assessment sheet describing a multi-symptom mail delivery problem at Lakeview Logistics. They must diagnose the root cause using Message Trace, DNS tools, and EAC inspection, remediate the issue, then complete a transport rule design challenge and written analysis.
| Section | What is assessed | Marks |
|---|
| Section A — Diagnosis |
Students use Message Trace, MXToolbox, and the EAC DNS health view to identify two separate mail delivery issues described in the scenario. Each issue requires navigating to a specific location and recording what they find. |
25 pts |
| Section B — Remediation |
Students take corrective action for each identified issue — fixing a DNS record, adjusting a transport rule, or correcting a mailbox configuration. Each action is documented with navigation path and before/after state. |
25 pts |
| Section C — Transport rule design challenge |
Given a business requirement, students design and build a new transport rule — defining the correct condition, exception, and action. Then answer an analysis question about rule interaction and priority. |
25 pts |
| Section D — Written analysis |
Two written questions requiring students to explain a mail flow concept, justify a design decision, or analyse a scenario. Closed-notes. Assesses understanding, not recall. |
25 pts |
Instructor note: The scenario involves two issues: Issue 1 — outbound email from Lakeview Logistics is failing SPF checks at receiving servers (either the SPF record has been modified or DKIM was never fully activated). Issue 2 — a transport rule is incorrectly blocking internal Finance emails. Students must identify both using the available tools, fix both, and then design a new rule. Pre-seeding Issue 2 in student tenants (modifying the Finance CC rule to accidentally catch internal mail) makes Section B a live remediation exercise.
1:40 – 2:00
Debrief · 20 min
Assessment debrief & Week 4 preview
- Walk through Section A — what Message Trace shows for a failed delivery vs a successful one, and which DNS record failure produces which symptom
- Discuss Section C rule designs as a class — surface the range of approaches and why some condition/exception combinations are more robust than others
- Ask: "Looking at the full email stack we built this week — what is the single weakest point if an attacker is targeting Lakeview Logistics via email?" — prime Week 7 thinking (answer: users clicking links despite Safe Links, or social engineering bypassing all technical controls)
- Week 4 preview: Email infrastructure is complete. Week 4 moves into SharePoint Online and OneDrive — the file storage and collaboration layer. Students configure site architecture, the permissions model, external sharing controls, and OneDrive policies. The Microsoft 365 Group created in Week 1 (with its auto-provisioned SharePoint site) becomes the starting point.
Assessment rubric — marking guidance
| Criterion | Full marks | Partial | No marks |
|---|
| Section A — Diagnosis | Both issues identified, correct tool used for each, navigation path recorded, finding described accurately | One issue identified correctly, or both found but tool/path missing | Neither issue identified, or wrong tool used |
| Section B — Remediation | Both issues corrected, before/after state documented, verified as resolved | One issue corrected, or both corrected but not verified | Neither issue corrected |
| Section C — Rule design | Correct condition, exception, and action — rule builds and fires correctly on test. Analysis question answered correctly with reasoning. | Rule condition correct but exception or action wrong, or analysis partial | Rule fundamentally incorrect or not built |
| Section D — Written | Both questions answered directly with accurate technical content and clear reasoning | One answered well, one partially or one fundamentally wrong | Both answered incorrectly or not attempted |
Learning outcomes — by end of Week 3, students can…
Diagnose mail delivery failuresUse Message Trace, MXToolbox, and the EAC DNS health view systematically to identify root cause
Remediate email configurationFix DNS records, transport rules, and mailbox settings to resolve delivery failures
Design transport rulesWrite rules with correct conditions, exceptions, and actions for a given business requirement
Explain the email stackMap each layer of the email infrastructure and describe what each one protects against