Go to the Microsoft 365 Defender portal and under Email & collaboration select Policies & rules > Alert policy.
An alert policy consists of the following settings and conditions.
- Activity the alert is tracking. You create a policy to track an activity or in some cases a few related activities, such a sharing a file with an external user by sharing it, assigning access permissions, or creating an anonymous link. When a user performs the activity defined by the policy, an alert is triggered based on the alert threshold settings.
- Activity conditions. For most activities, you can define additional conditions that must be met to trigger an alert. Common conditions include IP addresses (so that an alert is triggered when the user performs the activity on a computer with a specific IP address or within an IP address range), whether an alert is triggered if a specific user or users perform that activity, and whether the activity is performed on a specific file name or URL. You can also configure a condition that triggers an alert when the activity is performed by any user in your organization. The available conditions are dependent on the selected activity.
You can also define user tags as a condition of an alert policy. This results in the alerts triggered by the policy to include the context of the impacted user. You can use system user tags or custom user tags.
- When the alert is triggered. You can configure a setting that defines how often an activity can occur before an alert is triggered. This allows you to set up a policy to generate an alert every time an activity matches the policy conditions, when a certain threshold is exceeded, or when the occurrence of the activity the alert is tracking becomes unusual for your organization.
If you select the setting based on unusual activity, Microsoft establishes a baseline value that defines the normal frequency for the selected activity. It takes up to seven days to establish this baseline, during which alerts won't be generated. After the baseline is established, an alert is triggered when the frequency of the activity tracked by the alert policy greatly exceeds the baseline value. For auditing-related activities (such as file and folder activities), you can establish a baseline based on a single user or based on all users in your organization; for malware-related activities, you can establish a baseline based on a single malware family, a single recipient, or all messages in your organization.
- Alert category. To help with tracking and managing the alerts generated by a policy, you can assign one of the following categories to a policy.
- Data loss prevention
- Information governance
- Mail flow
- Permissions
- Threat management
- Others
When an activity occurs that matches the conditions of the alert policy, the alert that's generated is tagged with the category defined in this setting. This allows you to track and manage alerts that have the same category setting on the Alerts page in the compliance center because you can sort and filter alerts based on category.
- Alert severity. Similar to the alert category, you assign a severity attribute (Low, Medium, High, or Informational) to alert policies. Like the alert category, when an activity occurs that matches the conditions of the alert policy, the alert that's generated is tagged with the same severity level that's set for the alert policy. Again, this allows you to track and manage alerts that have the same severity setting on the Alerts page. For example, you can filter the list of alerts so that only alerts with a High severity are displayed.
- Email notifications. You can set up the policy so that email notifications are sent (or not sent) to a list of users when an alert is triggered. You can also set a daily notification limit so that once the maximum number of notifications has been reached, no more notifications are sent for the alert during that day. In addition to email notifications, you or other administrators can view the alerts that are triggered by a policy on the Alerts page. Consider enabling email notifications for alert policies of a specific category or that have a higher severity setting.
Reference:
https://docs.microsoft.com/en-us/microsoft-365/compliance/alert-policies?view=o365-worldwide#how-alert-policies-work

Reference:
https://docs.microsoft.com/en-us/microsoft-365/compliance/use-network-upload-to-import-pst-files?view=o365-worldwide

Reference:
https://docs.microsoft.com/en-us/microsoft-365/compliance/enable-archive-mailboxes?view=o365-worldwide
Topic 4, ADatum Corporation
Company Information
ADatum Corporation is a consulting company that has a main office in Montreal.
ADatum has a Microsoft 365 E5 tenant named adatum.com and uses Microsoft Exchange Online for messaging services.
Existing Environment
Mailboxes

Public Folder Mailboxes

Rules

Connectors

Safe Attachments Policies



Groups

Group Membership




Contacts

Allan Deyoung Role Assignments and Mailbox Details

Organization Sharing

Roles

Outlook Web App Policies



Mobile Device Mailbox Policies

No, this does not meet the goal. Creating a mail contact for each mail-enabled public folder in Exchange Online will not ensure that messages can only be delivered to valid recipients, as it does not allow for any filtering or validation of messages. To ensure that messages can only be delivered to valid recipients, you need to configure a connector in Exchange Online to allow only messages from valid senders to be delivered to the mail-enabled public folders.

Reference:
https://docs.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/change-oab-generation-schedule?view=exchserver-2019