This won't make any headlines outside IT. For anyone who has had to find out which printer, line-of-business app or forgotten SaaS tool was still sending mail the old way, it's a welcome change.
What the Change Optics Report does
When Microsoft announces a change that could affect how some messages are sent or delivered, the report gives admins one place to find traffic that may be affected. It doesn't list every message. It shows a sample of your organization's messages that match the pattern Microsoft expects the change to affect. You use those samples to start an investigation, decide where fixes are needed, and check that the affected traffic is dropping before the change lands.
The preview-era Message Center post (MC1301802) said the same thing more bluntly: the report does not modify mail flow, enforcement behavior, or tenant configuration. It is enabled by default for Exchange Online tenants, and there is no impact to users. So it's a diagnostic view, not a control. Nothing in it blocks, fixes or authenticates anything.
Summary: Change Optics shows you trouble that is coming. It doesn't fix that trouble for you.
How it got here: preview to GA
The report first appeared in public preview in the spring. WindowsForum covered the preview launch in April. In that coverage it was described as a place to find messages that match patterns tied to announced service changes, including scenarios that may be throttled or rejected in the future.
Message Center post MC1301802 was published May 5, 2026. It said that the preview would run for at least one month, and that depending on feedback, GA could be announced as early as June 2026. GA actually arrived in mid-October, about four months after that earliest target. Microsoft hasn't said why. It does say preview feedback shaped three changes:
- Clearer descriptions of the report and each scenario.
- Filtering of noisy message types, such as journaling reports, which were cluttering the samples.
- The P1 envelope sender address is now shown, which is the address used for onmicrosoft.com enforcement.
The third change matters most in practice. The P1 envelope sender (the SMTP MAIL FROM) is often different from the P2 From header users see in Outlook. If the report showed only the header address, you could end up investigating a sender that the throttling logic never checks. These changes only affect the report itself. The underlying mail-flow policies are unchanged.
Summary: GA took longer than Microsoft's earliest target. The main improvement is that the report now shows the sender address enforcement actually uses.
Scenario 1: onmicrosoft.com external traffic (OMC)
The first scenario finds messages sent to external recipients from onmicrosoft.com addresses. Microsoft says throttling of this traffic has now rolled out. If your tenant still shows this traffic, you should investigate it and move legitimate senders to a custom domain.
Microsoft Learn's Exchange Online limits page sets out the limits:
| Detail | What Microsoft documents |
|---|---|
| Limit | 100 external recipients per organization in a rolling 24-hour window when sending from default onmicrosoft.com domains |
| Inbound mail | Not affected |
| What senders see when throttled | NDR with code 550 5.7.236 |
| How recipients are counted | After expansion of the original recipients, so groups count by member |
| Rollout start | October 15, 2025 (per Microsoft 365 admin guidance) |
Microsoft's admin documentation also describes onmicrosoft.com as the tenant's fallback domain. It recommends using that domain for testing, not regular email. With a cap of 100 external recipients a day across the whole organization, one misconfigured scan-to-email device or a newsletter sent through a group can use up the allowance by lunchtime. Everyone else using that domain then gets NDRs.
What to do with OMC findings:
- Open the Details view and group the samples by P1 sender. Each distinct address usually points to one app, device, connector or user.
- For each one, decide whether it should move to a custom domain or be retired.
- After you make changes, check the Summary page. Volume in the OMC trend line should fall.
- If users report 550 5.7.236 bounces, start here.
Summary: Throttling of onmicrosoft.com is already enforced. If your tenant still shows OMC traffic, you're dealing with an active problem, not planning for a future one.
Scenario 2: Direct Send traffic (DRS)
The second scenario finds Direct Send messages received by your tenant. Microsoft positions it as preparation for the optional Reject Direct Send setting. Before you turn that setting on, use the report to find legitimate Direct Send senders and make sure they're handled properly.
In general terms, Direct Send lets devices and applications deliver mail straight to Exchange Online mailboxes using the organization's own domain, without authenticating. That is convenient for multifunction printers and on-premises apps. Attackers who spoof internal senders like it for the same reason. Rejecting it closes that hole, but any legitimate sender you haven't found will be rejected as well.
The DRS scenario lets you build a list of legitimate senders first. A sensible order:
- Review the DRS samples and identify each source: scanners, monitoring systems, ERP and CRM notifications, third-party services.
- Separate the known, legitimate flows from the unexpected ones. Treat unexpected internal-looking mail arriving through Direct Send as a possible spoofing lead.
- Move legitimate senders to an authenticated route, typically a properly scoped connector. Base the method on your own environment and Microsoft's current Direct Send guidance.
- Watch the Summary trend until the remaining Direct Send traffic is what you expect. Only then consider enabling rejection.
The report won't turn on Reject Direct Send or authenticate any sender for you. It only shows you the traffic so you can decide.
Summary: DRS is a planning tool. Use it to make Reject Direct Send a planned change rather than a surprise for your helpdesk.
Finding and using the report
In the Exchange admin center, go to:
Reports > Mail flow > Change Optics Report
There are two pages:
- Summary: message-volume trends for each tracked scenario. Use it to see whether your fixes are reducing the traffic over time.
- Details: sample messages for the selected scenario, with the main message properties you need to start investigating. You can export the table. For more detail on a single message, use Message Trace.
Caveats
- Export is limited. It exports only the rows currently loaded in the table, not everything in the selected time range. Microsoft plans to improve this but hasn't given a date. Don't treat an exported file as a complete audit.
- It's a sample, not a census. Microsoft says the report is for spotting sending patterns and scenarios to investigate, not a full message trace. If a sender doesn't appear, that doesn't prove it doesn't exist. Check against your own list of devices and applications.
- No documented prerequisites. The announcement doesn't list licensing, required roles, data retention or how samples are chosen, so check these in your own tenant.
Availability: worldwide only, for now
GA covers Exchange Online tenants in the worldwide environment. The report is not currently available in GCC, GCC High, DoD, or other sovereign clouds, and Microsoft hasn't given a timeline. Government tenants preparing for similar changes will need to rely on Message Trace and their own inventories for now.
Analysis
Microsoft calls Change Optics a framework and plans to add scenarios as future Exchange Online changes come along. That's a good sign. Mail-flow changes such as the onmicrosoft.com cap have often arrived with a Message Center post and little else, leaving admins to guess which systems would break. A standing report tied to each change gives them something to measure.
There are fair criticisms. The OMC scenario reached GA after the throttling it is meant to help with had already taken effect, so for slower tenants it now explains outages rather than preventing them. Export and sampling limits also make it a starting point, not proof that you've finished. Still, it's built in, enabled by default, has no effect on mail flow, and costs nothing. If you manage an Exchange Online tenant, open it now, especially before you turn on Reject Direct Send.