The Problem
Mailbox storage limits need to stay consistent with policy, but quotas drift over time. New mailboxes get provisioned with defaults that do not match the intended tier, exception group membership changes, and manual adjustments accumulate. When a mailbox quota is wrong, the user finds out by hitting a limit and filing a ticket, which makes the problem reactive rather than managed. The helpdesk had a more primitive version of a quota script in place, and asked for something more capable.
What I Built
An enhanced monthly enforcement script that compares every mailbox against its intended quota policy and corrects only what has drifted. It handles four categories: standard users, two tiers of raised-limit exceptions, and shared mailboxes. Quota policy definitions live in a single configuration block, so changing a limit is a one-line edit rather than a hunt through the script.
How It Works
- Certificate-based app-only authentication to both Exchange Online and Microsoft Graph, so it runs unattended as a scheduled task with no stored secrets
- Comparison before action: each mailbox is read, its current quota values normalized, and compared against the desired policy. Mailboxes already correct are logged and skipped rather than rewritten, so the script does not generate unnecessary change events across the tenant.
- Value normalization handles the fact that Exchange returns quota values with a byte count appended, which must be stripped before a meaningful comparison can be made
- Four policy categories: standard users, Tier 1 and Tier 2 exception groups resolved from distribution group membership, and shared mailboxes. Room and equipment mailboxes are deliberately excluded.
- Per-mailbox error isolation: a failure on one mailbox is recorded and the run continues, so a single problem account cannot halt enforcement across the tenant
- Full transcript logging plus a timestamped CSV of every change, retained as an audit trail
- HTML email report summarizing total changes, a per-category breakdown, error count, and the specific before-and-after values for each mailbox corrected
- Configurable behavior for periods with no changes, so a quiet month still produces confirmation the run happened
The Tiered Exception Model
Not every user fits the standard limit. The enterprise identifies which roles and users require raised quotas and maintains a template for which tier they belong to. Tier assignment is handled through change management and membership in the corresponding exception group, so the script enforces policy without needing to encode individual decisions.
Impact
- Prevents quota-related helpdesk tickets by correcting drift before users hit a limit
- Keeps quota policy consistent across the entire tenant without manual review
- Makes tier changes a matter of group membership rather than administrative work
- Provides a monthly audit record of every quota change made