Exchange Admin Center: How to Access & Use the EAC

This is a working reference on the Exchange admin center, maintained by our Exchange admin support team. It covers the access URLs for Exchange Online and on-premises Exchange Server, the permissions required, what each section of the console does, step-by-step instructions for the most common tasks, and when the EAC is not enough and PowerShell is required.

What the Exchange admin center is

The Exchange admin center (EAC) is the web-based management console for Exchange. There are two distinct consoles that share the name:

• EAC in Exchange Online — a cloud portal at admin.exchange.microsoft.com for managing Exchange Online in a Microsoft 365 tenant: mailboxes, groups, mail flow, migration, and reports. Documented at Exchange admin center in Exchange Online.
• EAC in Exchange Server — the on-premises console served from each Exchange 2013/2016/2019/Subscription Edition server through the ECP virtual directory in IIS. Documented at Exchange admin center in Exchange Server.

The EAC replaced two Exchange 2010-era interfaces: the Exchange Management Console (EMC) and the Exchange Control Panel (ECP). The on-premises virtual directory kept the ECP name, which is why the on-prem URL still ends in /ecp.

Access URLs

When opening the Exchange Online EAC by direct URL with a different account than the one currently signed in, Microsoft recommends a private or incognito browser session so the cached credential is not reused.

Permissions required

Access to the Exchange Online EAC requires an administrator role, not a user license. The relevant roles:

• Global Administrator — full access to the EAC and every other admin center.
• Exchange Administrator — full access to the EAC and Exchange Online management; the standard role for Exchange work. Details at About the Exchange administrator role.
• Scoped RBAC roles — Exchange Online uses role-based access control (RBAC) underneath, so role groups such as Recipient Management or View-Only Organization Management expose only a subset of the console. Reference: Permissions in Exchange Online.

What a given account sees in the EAC is determined by RBAC: features the account has no role for are hidden. On-premises Exchange uses the same RBAC model with role groups such as Organization Management.

EAC sections and what each one does

The left navigation of the Exchange Online EAC, per the official feature reference:

Anti-spam, anti-malware, and quarantine management are not in the EAC; they live in the Microsoft Defender portal. Licensing and password resets live in the Microsoft 365 admin center.

Common tasks

Create a mailbox

1. In Exchange Online, new user mailboxes are created by adding a licensed user in the Microsoft 365 admin center (Users > Active users > Add a user); the mailbox is provisioned automatically.
2. The mailbox then appears in the EAC under Recipients > Mailboxes.
3. Open the mailbox entry to set aliases, mailbox delegation, or litigation hold.

Create a shared mailbox

1. Go to Recipients > Mailboxes > Add a shared mailbox.
2. Enter the display name and email address, then create it.
3. Open the new mailbox > Delegation, and add members with Full Access and Send As permissions. No license is needed under 50 GB.

Set forwarding on a mailbox

1. Go to Recipients > Mailboxes and select the mailbox.
2. Open the Mailbox tab > Manage mail flow settings > Email forwarding.
3. Enable forwarding, enter the destination address, and choose whether to keep a copy in the original mailbox. Forwarding to external addresses may also require an outbound spam policy change in the Defender portal.

Create a mail flow rule

1. Go to Mail flow > Rules > Add a rule.
2. Pick a template or start blank, then set the conditions (sender, recipient, subject keywords, message properties).
3. Set the action (append disclaimer, redirect, reject, set header) and any exceptions.
4. Choose enforce or test mode and save. New rules can take up to 30 minutes to apply.

Trace a message

1. Go to Mail flow > Message trace > Start a trace.
2. Enter sender and/or recipient and the time range (up to 10 days for online results; older traces run as downloadable reports covering up to 90 days).
3. Run the trace and open a result row to see each delivery event and the reason for any failure or filtering verdict.

EAC vs Exchange Online PowerShell

The EAC covers day-to-day administration. PowerShell is required when the console is insufficient:

• Bulk operations — changing a setting on hundreds of mailboxes, exporting all forwarding rules, auditing Full Access permissions tenant-wide.
• Settings with no UI — many mailbox and organization parameters are exposed only as cmdlet parameters.
• Automation and reporting — scheduled scripts, CSV exports, and repeatable configuration.
• Precision — a cmdlet states exactly what changed; the EAC sometimes writes several settings behind one toggle.

Setup and usage of the module are covered in our guide to connecting to Exchange Online PowerShell. The on-premises equivalent is the Exchange Management Shell, installed with the Exchange management tools on every server.

Classic EAC retirement

The current Exchange Online EAC at admin.exchange.microsoft.com entered public preview in June 2020 and became generally available worldwide in April 2021. Microsoft announced the retirement of the classic EAC in September 2021, deprecated it for worldwide tenants through 2022, and the classic console was fully retired for worldwide customers effective December 2022. A small set of legacy features that never moved into the main navigation remains reachable under Other features in the new console. The rollout history is tracked on the What's new in the EAC page.

On-premises EAC notes

On Exchange Server, the EAC is served by the ECP virtual directory under the Default Web Site in IIS on each Mailbox server. Practical points:

• The internal URL defaults to the server FQDN + /ecp; the external URL is unconfigured until you set it, publish DNS, and install a matching TLS certificate.
• Find the configured URLs with the Get-EcpVirtualDirectory cmdlet in the Exchange Management Shell.
• External access to the admin surface can be turned off while leaving Outlook on the web users their own Options page.
• In coexistence with an older Exchange version, the mailbox location of the admin account decides which console version loads; appending ?ExchClientVer=15 to the URL forces the newer EAC.

FAQ

What is the URL for the Exchange admin center?

For Exchange Online: https://admin.exchange.microsoft.com (also reachable at admin.cloud.microsoft/exchange, or from the Microsoft 365 admin center under Admin centers > Exchange). For on-premises Exchange Server: https://<ServerFQDN>/ecp, or https://localhost/ecp on the server itself.

What permissions do I need to open the EAC?

The Exchange Administrator or Global Administrator role in Microsoft 365. Scoped RBAC role groups grant partial access; features outside an account's roles are hidden.

Is the classic EAC still available?

No. The classic Exchange Online EAC was retired for worldwide customers effective December 2022. Remaining legacy features are listed under Other features in the current console.

Can everything be done in the EAC?

No. Bulk changes, many mailbox parameters, automation, and detailed auditing require Exchange Online PowerShell or, on-premises, the Exchange Management Shell.