The honest capability map
| Surface | Authoritative for | Blind spots |
|---|---|---|
| EAC | Day-to-day recipient ops, mail-flow reports, quick rules | Whole property families never rendered; bulk anything |
| EXO PowerShell (V3 module) | EVERYTHING — hundreds of cmdlets are the actual product surface; plans, org config, the settings this curriculum keeps citing | Human ergonomics |
| Graph | Mail/calendar DATA (messages, events — app integration), users/licences | Most EXO admin config has no Graph endpoint — transport rules, connectors, plans are cmdlet-land only |
| Purview/Defender portals | The compliance and security halves that left Exchange years ago | Everyone still looks in EAC first |
Two consequences: automation is PowerShell-first for config (hence the serv365 runner's shape: EXO V3 + certificate app-only + a Get-* allowlist — taught properly in the operations module), and 'the setting isn't in the portal' is normal, not a licensing problem — Get-/Set- is the complete truth; EAC is a viewport.
V3 module facts that matter operationally
REST-backed cmdlets (no WinRM fragility), -EXO-prefixed high-volume variants (Get-EXOMailbox) for bulk reads, certificate app-only for unattended runs (with the CSP-vs-CNG certificate footnote our VERIFY_FIRST history records), RBAC honoured throughout — and the same last-write-wins, cache-lagged surface coexistence as everywhere else. The Teams curriculum's admin-surfaces discipline transfers verbatim: one owner per config area, read before write, export the truth on schedule — which is literally what the nightly scan does.
What to watch (proofs)
- The completeness demo: pick any scanned EXO type (SharingPolicy, EtrLimits...) and hunt its EAC rendering — the misses make the viewport point better than documentation could.
- Session hygiene: Get-ConnectionInformation — auth mode, app vs delegated; the canary line at the top of every automation run.
- Actor attribution: the admin audit log for cmdlet writes — EAC clicks surface as cmdlets too, so one audit stream covers both.
- Module currency: pinned V3 version per runbook vs latest, release notes read before upgrades — removed parameters take scripts down on schedule otherwise.