Who this is for
Solo MSP technicians and small-shop IT admins who administer Microsoft 365 tenants they inherited — often with no documentation and a CEO waiting on an answer. You're comfortable in a portal; this pack gives you the PowerShell route for work that has to be exact: state reads you can quote in a ticket, changes you can verify, evidence you can paste into a close-out.
What's inside
- Runbook 01 — Group mail not delivered. The flagship procedure. Root cause (Member vs. Subscriber — the distinction almost everyone misses), read-only diagnosis, the fix, trace proof, rollback, and how to handle the pre-fix backlog conversation.
- Runbook 02 — Message-trace workflow. The proof standard used across the pack: pinning a case (one sender, one recipient, one subject, one time), reading delivery legs, the quarantine and shared-mailbox branches, and knowing when a trace is conclusive vs. still ambiguous.
- Tenant-identity verification checklist. How to prove — from the connection itself (UPN + TenantId,
Get-OrganizationConfig) — which tenant you are about to change, and how session caching quietly puts you in the wrong one. Includes a tenant-register template. - Close-out templates. Three copy-paste templates: the client-facing summary, the internal ticket note, and the "what was NOT changed" section.
- Four PowerShell scripts (ExchangeOnlineManagement v3+): connect-and-verify-tenant, diagnose-group-delivery (read-only, prints a verdict), fix-group-subscription (read-before-write,
-WhatIfsupport, post-change re-verification), and verify-with-trace (PASS only when the member leg shows Delivered).
The discipline in one screen
- Verify the tenant from the connection, never the label.
- Pin the case before you change anything.
- Read before you write — broken state goes in the ticket first.
-WhatIffirst, every time it exists.- A setting is not proof. A trace is.
- Disconnect when you're done.
Prerequisites
- ExchangeOnlineManagement module, version 3 or later; PowerShell 7 recommended.
- An admin account with the Exchange administrator (or Global administrator) role.
- An outside test mailbox you control — trace proof requires a test sent from outside the tenant.
Scope — honestly stated
Version 1.0 covers group delivery and the trace workflow. It does not cover transport rules, connectors, or DNS (MX/SPF/DKIM/DMARC) faults, distribution-list internals, or third-party filtering in the path — the runbooks branch to those honestly when the evidence points there, rather than letting you force group commands at them. A full shared-mailbox runbook is planned for v1.1; v1.x updates are free to buyers (see Delivery).
Written from field procedure: every command in this pack is the command used on live tenants, generalized so the method — never a client's data — is what you're buying.