Prevent Journaling issues due to Exchange Online mailbox receiving limits

[Scott Schnoll]

As part of our continued efforts to help customers be successful with Exchange Online, Microsoft has detected that some customers are using an unsupported journaling configuration by pointing their journaling alternate mailbox to an Exchange Online mailbox. With the enforcement of mailbox receiving limits as announced in our February blog post, this may result in loss of journaling non-delivery reports, as cloud-hosted mailboxes will be throttled when they exceed the limit of 3600 messages received per rolling hour. We urge all customers to validate their journaling configuration and ensure they will not be affected.

Using an Exchange Online mailbox as a journaling alternate mailbox

Journaling in Exchange Online allows administrators to set an alternate journaling mailbox. This mailbox will accept non-delivery reports (also known as NDRs or bounce messages) if the primary journaling mailbox is unavailable, to catch undelivered journal reports and allow for re-sending when the journaling mailbox becomes available.

As the documentation states, the alternate journaling mailbox cannot be an Exchange Online mailbox. Cloud mailboxes are subject to our Exchange Online service limits and unsuitable for journaling.

How can I tell if I am affected?

Tenant administrators can check their configuration via the classic Exchange admin center. Navigate to the Journal Rules section and find the email address configured for non-delivery reports. If no address is configured or if the address is not an Exchange Online mailbox, administrators do not need to take action. If the address for journaling NDRs is set to an Exchange Online mailbox, administrators need to change this setting in order to avoid impact.

What do I do if I am affected?

Microsoft’s recommendation is to leverage our Microsoft 365 compliance solutions rather than journaling messages to another location. This suite of solutions provides data protection, data loss prevention, and data governance capabilities to meet customers’ diverse regulatory and compliance requirements.

If journaling is still needed, administrators should double check their settings and switch the alternate journaling address to a non-Exchange Online mailbox. Customers are urged to validate their configuration and take action by May 31^st to avoid potential disruption.

Thank you for your attention to this!

The Exchange Transport team and the Microsoft 365 Information Governance team

[sjhudson]

@Scott Schnoll 

Hi Scott, small observation: It does not say in any of the journaling documentation that the ‘journaling alternate mailbox’ is actually used as the sending address for journal reports. While I guess this is pretty obvious, in order to delivery NDRs somewhere, it threw me for a while when I was reconfiguring journaling from Exchange on-premises to Exchange on-line, some years ago!

[Victor_Lea]

@Scott Schnoll question. If one is running the full E5 suite and are making use of the DLP functionality in the Compliance Center with DLP rules. If these DLP rules are sending Incident Reports (with the original item attached) to a shared mailbox, is this in breach of the limits?

[Scott Schnoll]

@Victor_Lea, yes DLP reports would count against the mailbox limits. 

[Scott Schnoll]

@sjhudson, thanks for the comment. I'll see about getting the docs updated.