Exchange monitoring for on-premises and hybrid environments
Exchange monitoring checks the health of the Exchange servers you run on-premises: mailbox servers and databases, mail flow and transport queues, database copies in a DAG, client access, and the certificates and connectors that link Exchange to Microsoft 365. It also tests Outlook from remote sites, so you see what users there see.
Exchange environment
- Mail flow
- OK
- DAG replication
- Lagging
- Client access
- 1 slow
- Certificates
- 18 days
- Until expiry
Mailbox servers
| Server | Role | Copy queue | Status |
|---|---|---|---|
| MBX1 | Mailbox | 0 | Healthy |
| MBX2 | Mailbox | 214 | Lagging |
| MBX3 | Mailbox | 0 | Healthy |
Transport queue, last 24 h
| 00:00 | 3 |
|---|---|
| 02:00 | 2 |
| 04:00 | 2 |
| 06:00 | 3 |
| 08:00 | 4 |
| 10:00 | 9 |
| 12:00 | 14 |
| 14:00 | 21 |
| 16:00 | 5 |
| 18:00 | 6 |
| 20:00 | 4 |
| 22:00 | 3 |
Example data, for illustration only
Why it matters
Why does Exchange still need close watching?
Exchange Server keeps running mail for organisations that need it on-premises, for data location, regulation or a hybrid set-up. The current period adds risk on top.
-
End of support for 2016 and 2019
Exchange Server 2016 and 2019 have reached end of support. Microsoft's paid extended security updates for them run only until the end of October 2026, with no further updates after that.
-
The move to Exchange SE
Moving to Exchange Server Subscription Edition (SE) means an in-place upgrade or a mailbox migration, depending on where you start. Old and new servers then run side by side, when problems are easiest to miss.
-
Hybrid links
In a hybrid set-up, an expired certificate or a failed connector on-premises can stop mail flow and calendar sharing with Exchange Online, even when the cloud side is healthy.
What we monitor
What should you monitor on Exchange Server?
We monitor the Exchange Server versions you run, on-premises and hybrid. Each area below is covered by a monitoring tool that we select, implement and support with your team.
Mailbox servers and mail flow
Spot a filling disk or a growing queue before mail stops.
A database disk fills up, or messages pile up in a transport queue, and the first sign is a user asking why mail has not arrived. Exchange server monitoring checks disks and capacity, database health and performance, and mail flow inside the organisation, to and from the internet and to and from Exchange Online, with an alert when a transport queue grows.
What it covers
- Disk space and capacity on each server
- Database health and performance
- Internal, internet and cloud mail flow
- Transport queue length
- Server resources: CPU and memory
How we deliver it
- We review your servers and agree thresholds with your messaging team.
- Alerts point to the server, the database or the queue at fault.
- History is kept, so a slow trend shows before it becomes an outage.
- Your admins learn to read the dashboards and act on them.
Messages in the transport queue
| 08:00 | 4 |
|---|---|
| 09:00 | 11 |
| 10:00 | 9 |
| 11:00 | 7 |
| 12:00 | 14 |
| 13:00 | 46 |
| 14:00 | 21 |
| 15:00 | 6 |
Client access
Outlook, Outlook on the web and mobile mail work on every namespace.
Users reach Exchange through several protocols and namespaces, and one of them can fail while the others look fine. Monitoring measures client load by protocol and runs a test per protocol and namespace: Outlook on the web, Exchange ActiveSync for mobile devices, and Outlook over MAPI over HTTP, the default connection protocol in current Exchange versions. Microsoft plans to remove Outlook Anywhere (RPC over HTTP) from Exchange SE, with no date set, so its remaining use is worth tracking.
What it covers
- Client load by protocol
- A test for each namespace
- Outlook on the web
- Exchange ActiveSync
- Outlook over MAPI over HTTP
- Remaining Outlook Anywhere use
How we deliver it
- We map your namespaces and protocols with your team.
- Each one gets its own test and alert.
- A failure points to the protocol and the server involved.
- Usage reports show which clients need attention before an upgrade.
Client access tests
- Outlook on the web Passing
- Exchange ActiveSync Passing
- MAPI over HTTP Slow, 2.4 s
- Outlook Anywhere 37 clients left
High availability and DAG
Passive database copies keep up, and failovers land where you planned.
A database availability group (DAG) keeps copies of mailbox databases on several Mailbox servers. If a passive copy falls behind, it is less ready to take over when the active copy fails. Exchange DAG monitoring watches replication health, copy queue length and replay queue length, which show whether passive copies keep up, and database activation preferences. It also collects the alerts of Managed Availability, Exchange's built-in monitoring and recovery.
What it covers
- Replication health of each database copy
- Copy queue length and replay queue length
- Mounted and passive copies, server by server
- Activation preferences after a failover
- Managed Availability alerts
How we deliver it
- We review your DAG layout and activation preferences with you.
- Queue thresholds are agreed with your messaging team.
- A copy that falls behind raises an alert naming its server and database.
- After a failover, you see whether databases are back where you planned.
Database copies
- DB01 on MBX1 Mounted
- DB01 on MBX2 Healthy
- DB02 on MBX2 Copy queue 214
- DB02 on MBX3 Healthy
Exchange hybrid
Mail flow between Exchange and Exchange Online keeps working.
Exchange hybrid depends on pieces that fail quietly: certificates, connectors, AD FS or pass-through authentication. Exchange hybrid now needs a dedicated hybrid app in Microsoft Entra ID, tied to the Exchange Auth certificate, which must be renewed before it expires. Exchange hybrid monitoring tests mail flow in both directions, checks connectors and sign-in components, and raises an alert on certificate expiry well before the date.
What it covers
- Certificate expiry, including the Exchange Auth certificate
- Hybrid mail flow in both directions
- Send and receive connectors
- AD FS or pass-through authentication
How we deliver it
- We list every certificate and connector with your team.
- Certificate alerts go out well before expiry.
- A hybrid failure points to the component involved, on-premises or in the cloud.
- We help you plan certificate renewals and hybrid changes.
Hybrid checks
- Mail flow to Exchange Online
- Mail flow from Exchange Online
- AD FS sign-in
- Exchange Auth certificate, 18 days left
Outlook from remote sites
See Outlook the way users in a remote office see it.
A server can look healthy while users in a branch office wait for Outlook. A probe installed on a workstation at that site repeats Outlook actions on a schedule, such as opening the mailbox and sending a message, and measures how long each one takes. Results are compared site by site, so a local network problem stands out from an Exchange problem.
What it covers
- Probes on workstations at the sites you choose
- Outlook actions repeated on a schedule
- Response time by site
- Network issues told apart from server issues
How we deliver it
- We choose the sites with you.
- We install the probes with your local IT team.
- Alerts go to the team in charge of that site.
- Results feed the reports agreed with you.
Outlook response time by site (ms)
- Head office: This week 820, Usual 790
- Branch A: This week 1150, Usual 840
- Branch B: This week 2900, Usual 900
- Branch C: This week 960, Usual 950
Reports for planning
Know what to clean up and what to plan before a migration.
Before an upgrade or a move to Exchange Online, you need to know what you have. Reports cover availability and SLA, database distribution and size, patch levels by server, mailbox growth, inactive mailboxes, unused distribution lists, public folders nobody opens, ActiveSync devices and the Outlook versions in use.
What it covers
- Availability and SLA
- Database distribution and size
- Patch levels by server
- Mailbox size and growth
- Inactive mailboxes and unused distribution lists
- Public folders not opened recently
- ActiveSync devices and Outlook versions
How we deliver it
- We agree with you which reports each team receives.
- Reports are scheduled and exported.
- Before a migration, we go through the clean-up list with you.
Servers and patch levels
| Server | Role | Patch level | Status |
|---|---|---|---|
| MBX1 | Mailbox, DAG member | Current | Healthy |
| MBX2 | Mailbox, DAG member | Current | Healthy |
| MBX3 | Mailbox, DAG member | One update behind | Update due |
| EDGE1 | Edge Transport | Current | Healthy |
Examples
Examples of Exchange alerts we configure
| Alert | Why it matters | Typical severity |
|---|---|---|
| Database disk running out of space | When the disk is full, the database goes offline and its users lose access to their mailboxes. | High |
| Certificate close to expiry | An expired certificate can break client access, mail flow or the hybrid link. | High |
| Transport queue above its threshold | Messages wait instead of being delivered, often the first sign of a mail flow problem. | High |
| Copy queue or replay queue growing | A passive copy is falling behind, so it is less ready to take over if the active copy fails. | Medium |
| Protocol test failing on one namespace | Some users lose Outlook, Outlook on the web or mobile mail while others are fine. | Medium |
| Server behind on security updates | Known vulnerabilities stay open until the update is installed. | Medium |
Examples. Rules and thresholds are agreed with your team.
From the console
Which checks can you run by hand?
We know what monitoring tools check because we run the same checks by hand. Two Microsoft cmdlets and Microsoft's HealthChecker script, for Exchange Server on-premises, run in the Exchange Management Shell. Monitoring covers the same ground continuously, keeps the history and alerts on it.
Database copy health on one server
PowerShellGet-MailboxDatabaseCopyStatus -Server MBX1 | Format-ListManaged Availability health
PowerShellGet-ServerHealth -Identity MBX1Configuration check
PowerShell.\HealthChecker.ps1 -Server MBX1MBX1 is an example server name.
How it works
How Exchange monitoring is put in place
Fast and done right: ready-made tooling, tested starting thresholds and runbooks your team keeps.
- Step 1
Review
We review your Exchange environment with your team: servers, DAGs, namespaces, hybrid links and certificates.
- Step 2
Connect
The monitoring tool is installed and connected, with the permissions your security team approves.
- Step 3
Baseline
Thresholds start from tested defaults and are adjusted to your normal load.
- Step 4
Alert
Alerts go to the people who run Exchange, naming the server and the component involved.
- Step 5
Report
Dashboards for each team and scheduled reports for planning.
Dashboards
A dashboard for each team
Each team sees what it needs to act on, from the same data.
-
Helpdesk
Exchange, the network or the user's device? A first answer before escalating.
-
Messaging and UC team
Servers, databases, queues and hybrid links, with the history behind each alert.
-
NOC
Availability at a glance, alerts by severity and the component at fault.
-
Management
Availability against SLA, trends and upgrade plans, in plain language.
FAQ
Exchange monitoring questions, answered.
What should you monitor on Exchange Server?
Five areas: mailbox servers and mail flow (disks, databases, transport queues), client access (each protocol and namespace), high availability (DAG replication, copy and replay queues, Managed Availability alerts), hybrid links (certificates, connectors, sign-in) and the experience of users at remote sites. Reports on patch levels, mailbox growth and unused objects help you plan.
Which Exchange versions do you cover?
The versions in use in your organisation, on-premises and hybrid. We review your environment before we start.
What changes with Exchange Server Subscription Edition (SE)?
Exchange SE has been available since 1 July 2025 and follows Microsoft's Modern Lifecycle Policy. Exchange 2019 servers on CU14 or CU15 can be upgraded in place; Exchange 2016 needs a mailbox migration.
Exchange Server 2016 and 2019 reached end of support on 14 October 2025, and paid extended security updates run only until the end of October 2026, with no further updates after that. We watch old and new servers during the move, when problems are easiest to miss.
Can you monitor Exchange hybrid and Exchange Online together?
Yes. Synthetic tests check mail flow between Exchange Server and Exchange Online in both directions, along with connectors, sign-in components and certificates. Exchange Online itself is covered by Microsoft 365 monitoring.
Hybrid set-ups are changing: rich coexistence now needs a dedicated hybrid app in Microsoft Entra ID, and hybrid organisations must move it to Microsoft Graph, which requires Exchange SE. We check these links before and after each change.
How do you test Outlook from remote offices?
A probe is installed on a workstation at each site you choose. It repeats Outlook actions on a schedule and measures how long each one takes, so you see Exchange the way users at that site see it, and can tell a local network problem from a server problem.
What reports help an Exchange migration?
Database distribution and size, mailbox growth, inactive mailboxes, unused distribution lists, public folders nobody opens, ActiveSync devices and the Outlook versions in use. Together they show what to clean up before you move, and which clients need attention.
Do you replace Managed Availability?
No. Managed Availability is Exchange's built-in monitoring and recovery: probes measure, monitors judge health, responders recover or escalate. Monitoring collects its alerts next to the other checks, keeps the history and sends each alert to the right team.
How long does it take to set up?
It depends on your environment, so we do not quote a fixed timeline. We move quickly with ready-made tooling, tested starting thresholds and runbooks, and we take the time to review your servers and agree alerts with your team.
Talk to us about your Exchange servers.
Tell us which Exchange servers you run and how they connect to Microsoft 365. We will explain which tool fits and how we would put it in place with your team.