The EXO signal set (four classes, mail edition)
- Service health: Exchange advisories (scan leg) — 'is it them', first.
- Quality/deliverability: the BUILT telemetry — latency percentiles (trace concept), NDR-reason trends (ledger), outbound-reputation smoke (5.7.7xx + restricted-sender events), deferral trends. Exchange gives you nothing here out of the box; you construct it from traces + reports.
- Config drift: the scanned 40+ types diffed — the posture-drift watchlist, alerting.
- Change-from-Microsoft: MC posts verdicted against your EXO config (EWS/SMTP-AUTH/POP clocks) — the site's core loop.
The canaries worth building
- Auth-failure canary: legacy-auth / basic-SMTP failure trends — catches BOTH the attack (credential stuffing) and the retirement casualty (December's doomed scanner) in one signal.
- Delivery canary: scheduled test-mails through each path with trace verification — the SBA-drill logic for mail; advisory-beating detection of quiet path breaks.
- The persistence trio (BEC): inbox-rule-create / forwarding-change / oauth-grant — security alerts that are also mail-flow events.
Routing
A PAGE for 'how's mail flowing', a PING only for 'act now' (reputation smoke, the trio, a canary failing, a watchlist drift) — to the owner who can act. Mail generates a lot of noise; disciplining it is the whole game.
What to watch (proofs)
- Coverage honesty: which classes you actually monitor — most estates have (1) by accident; the gap is the backlog.
- Canary liveness: last-green timestamps — a dead canary monitors nothing.
- Alert-to-action ratio per signal — the pruning and fatigue metric.
- The correlation payoff: a deliverability dip against drift + MC verdicts on one timeline (Pulse) — mail's root-cause-in-minutes.