Microsoft 365 · Exchange Online
Exchange Online is the cloud mail platform of Microsoft 365 — mailbox, calendar, contacts as SaaS, with Defender for Office 365 as an integrated security layer and Microsoft Purview for compliance and retention. arades GmbH delivers migration, setup, security hardening, and ongoing monitoring.
Exchange Online at a glance
Exchange Online delivers business mail, calendar, contacts, and tasks as a cloud service. Instead of operating your own Exchange servers, DAGs, patches, and backup strategies, you pay a license per mailbox per month — and get a highly available, globally distributed platform with 50 GB or 100 GB mailboxes.
50 GB (Plan 1) or 100 GB (Plan 2) per mailbox, with online archive (Plan 2 unlimited). Outlook on desktop, web, and mobile — plus modern Outlook features like shared calendars, rooms, and bookings mailboxes.
Shared mailboxes (e.g. info@, service@) without their own license as long as under 50 GB. Distribution groups and Microsoft 365 groups for team mail — managed in the Exchange admin center and the Microsoft 365 admin center.
Mail flow rules, disclaimers, forwarding, SMTP relays, and connectors to third-party systems (e.g. mail-archiving solutions or line-of-business apps). Full control over the mail flow without any own hardware.
License plans
Four paths to an Exchange Online mailbox — from the low-cost Kiosk variant through standalone plans to integrated Microsoft 365 packages.
50 GB mailbox, Outlook on desktop/web/mobile, calendar, contacts, tasks, Exchange Online Protection (anti-spam and anti-malware). Default choice for most mid-market companies without another Microsoft 365 license.
100 GB mailbox plus unlimited online archive, litigation hold, in-place hold, DLP for mail, and advanced compliance features. For regulated industries or power users with high-volume mailboxes.
Most affordable variant for frontline workers (shift, production, field service) with limited mailbox size and web access. Useful for users who need mail only occasionally.
Exchange Online is already included in Microsoft 365 Business Basic, Standard, Premium, and all enterprise plans (E3, E5) — Plan 1 in Business and E3, Plan 2 in E5. The most economical path.
Pricing notice: Microsoft adjusts list prices regularly (currency adjustments, NCE updates, plan restructurings). Figures here are indicative values from May 2026. For current prices including arades CSP conditions, see the License Cost Calculator (licenses.arades.de) ↗ daily.
Hybrid vs. cloud-only
Cloud-only setups are simpler, cheaper, and safer for most mid-market companies. Hybrid setups have their place — as a migration bridge or for special cases.
All mailboxes in the cloud, no own Exchange infrastructure. Identity in Entra ID (with or without hybrid AD sync), MX record on Microsoft Exchange Online Protection. Standard path for mid-market companies without regulatory special requirements.
Mix of cloud mailboxes and on-premises mailboxes with shared mail routing, free/busy sharing, and a unified address list. Useful during migrations or for regulatory requirements on specific mailboxes.
Migration
Exchange migrations have been our core business for over 20 years. Four migration scenarios cover practically any starting point.
Common pitfalls: MX record switch with a coexistence phase, Outlook profile migration, public folder strategy, Autodiscover, SPF/DKIM/DMARC setup. For each point, we have standard solutions ready from many practical engagements.
Security & Defender for Office 365
Phishing, business email compromise, and ransomware almost always come in via email. Exchange Online Protection (EOP) is the baseline — Defender for Office 365 the second layer.
Anti-spam and anti-malware as baseline protection, included in every Exchange Online plan and every Microsoft 365 plan. Sufficient for classic spam/malware threats, but not for targeted phishing campaigns.
~€1.90 / user / month (add-on)
Safe Attachments, Safe Links, anti-phishing with impersonation protection. Included in Microsoft 365 Business Premium and E5. Standard recommendation for every mid-market company.
~€4.60 / user / month (add-on)
Threat Explorer, Attack Simulation, automated investigation & response. Included in Microsoft 365 E5. For compliance-driven industries or companies with a security operations team.
Compliance & retention
Exchange Online integrates with Microsoft Purview for retention, litigation hold, and eDiscovery — the most common compliance topics around email.
arades services around Exchange Online
Six concrete deliverables around Exchange Online — as a discovery spike, fixed-price project, or under an application-care contract.
Cutover, hybrid, or IMAP — migration from Exchange on-premises, Google Workspace, IBM Notes, or classic mail providers to Exchange Online. Including MX switch and Outlook profile migration.
Tenant configuration, mailbox provisioning, transport rules, connectors, public folder strategy, SPF/DKIM/DMARC, Autodiscover. A clean foundation for long-term operation.
Defender for Office 365 setup, Safe Attachments and Safe Links, anti-phishing policies, MFA enforcement for mailbox access, Conditional Access in Entra ID — together with your IT team.
Microsoft Purview retention policies, litigation hold, eDiscovery setup, DLP rules — configured and documented along your industry and compliance requirements.
Ongoing monitoring of mail security, quarantine reviews, reports on phishing attempts and blocked attachments — as part of an application-care contract.
Hybrid Exchange for migration phases or regulatory special cases. Build, operate, planned decommission after a successful cutover — without the hybrid bridge turning into a permanent solution.
Frequently asked questions
Exchange Online Plan 1 is around €4 per mailbox per month (50 GB mailbox, mail, calendar, contacts). Plan 2 is around €8 (100 GB mailbox, in-place hold, unlimited archive, DLP). The Kiosk license for frontline workers at around €2 per user per month is the lowest-cost option — with limited mailbox size and web-only access. Exchange Online is already included in all Microsoft 365 Business and Enterprise plans.
Hybrid Exchange makes sense when migration from Exchange on-premises has to happen in stages, certain mailboxes must remain on-prem for regulatory reasons, or specific SMTP relay scenarios for third-party systems exist. Pure cloud setups are simpler, more economical, and more secure for most mid-market companies — hybrid is the bridge, not the destination. We build hybrid bridges for the migration phase and intentionally tear them down after a successful cutover.
A cutover migration (for small environments under 150 mailboxes) moves all mailboxes in a single step. For larger environments, the migration usually runs as a hybrid migration in waves — using the Hybrid Configuration Wizard, migration batches, and mailbox move requests. MX record switch, Outlook profile migration, public folder strategy, and DNS adjustments (Autodiscover, SPF, DKIM, DMARC) matter. Realistic timeline 4–10 weeks depending on environment size.
Google Workspace migrations typically run via Microsoft Migration Manager with the Google Workspace connector or via third-party tools like BitTitan MigrationWiz. Mail, calendar, and contacts are taken over, while Google Drive content moves in parallel to SharePoint and OneDrive. Key points: domain verification in both tenants, a coexistence phase with dual mail routing, and end-user training — the UX differences between Gmail and Outlook are the real adoption topic.
Exchange Online includes baseline anti-spam and anti-malware (Exchange Online Protection, EOP) — that covers classic spam filtering. Defender for Office 365 Plan 1 (around €1.90 per user/month) adds Safe Attachments, Safe Links, and anti-phishing for business email compromise. Plan 2 (around €4.60) additionally brings Threat Explorer, Attack Simulation, and automated investigation. In Microsoft 365 Business Premium Plan 1 is included, in E5 even Plan 2. For mid-market companies we recommend at least Plan 1 as the standard.
Microsoft Purview retention policies define how long mail is retained and when it's deleted — even when the user actively deletes. In-place hold and litigation hold (Plan 2 / E3) keep mail beyond the retention window for regulatory or legal purposes. eDiscovery (Plan 2 / E3 / E5) allows structured search and export for internal investigations or regulatory inquiries. We configure the policies along your industry and compliance requirements.
Yes — as a Microsoft Licensing Partner and CSP, we provision Exchange Online Plan 1, Plan 2, Kiosk, and all Microsoft 365 plans in which Exchange Online is included. Defender for Office 365 Plan 1 and 2 are available the same way. You see list price and arades price transparently in the License Cost Calculator and get a monthly aggregated invoice in euros.
Free Microsoft 365 trial guidance
arades sets up a test tenant for 3 users, trains your key users, runs weekly office hours — and tells you honestly at the end whether Microsoft 365 is the right fit. Free of charge.
Exchange Online — initial conversation
30-minute initial conversation — we clarify whether it's about a migration from Exchange on-premises, a Google Workspace replacement, Defender for Office setup, or retention policies. Concrete recommendation usually within one business day.
Accompanying services
Engineering projects rarely stand alone — license logic, architecture clarification, quality gates, knowledge transfer, and follow-on operations usually run in parallel. The most common accompanying services we book into discovery spikes, sprint fixed-price, or application-care contracts.
Upfront · Architecture
Before implementation: tenant structure, data model, security concept, integration mapping. The result is an architecture document any engineering team can pick up — including one other than us.
Read more →
Upfront · CSP
Which license bundles for which users, which add-on SKUs are necessary, where you're over- or under-licensed. Sourced as a Microsoft Licensing Partner — with the option to use CSP as a control without margin maximization.
Read more →
During · Quality gate
Independent second opinion during an ongoing implementation project — whether we run it ourselves or another partner does. CMMI-based quality gates, risk reviews, fixed price per gate.
During · Adoption
Not the classic two-day workshop forgotten a week later — but a dynamic learning program over 4–6 weeks with initial training, application phases, and follow-up sessions. Training matrix by role and topic.
Read more →
After · Operations
Post-go-live: a predictable application-care contract with a monthly flat rate, SLA-based. Includes releases, hotfixes, extensions, tenant hardening — and continuous accompaniment rather than mere ticket reaction.
Read more →
After · Knowledge
When the original developers are gone, the previous partner is no longer reachable, or the documentation is outdated — reverse engineering of the existing solution with a documented result: code map, data model, customization inventory.
Read more →
