mailboxes of leavers in exchange online

[CB1]

What are the potential risks and impacts (if any) in leaving mailboxes relating to leavers in an exchange online database long after the leaver left employment with the organisation? Do you work to any particular standard retention period of mailboxes for leavers, e.g. 1 month post leave date before deletion? For what purposes do you keep the mailboxes for a period of time before deletion out of interest? 

Is there any logical reason why you would want to keep the mailboxes in Exchange Online for employees who left several months/even years previously that need to be considered? 

[#2 · Accepted solution]

Hi @CB1,

let me try to summarize your questions:

Reasons for Retaining Former Employees' Mailboxes in Exchange Online:

1. Legal Compliance:
   Organizations may need to retain emails for a specific period to comply with industry and jurisdictional regulations.
2. Data Preservation:
   Important information in former employees' mailboxes may be needed in the future.
3. Investigation and Auditing:
   Inactive mailboxes can be searched for eDiscovery purposes.

Risks and Impacts of Retaining Mailboxes:

1. Storage Quota:
   Admin intervention may be needed for mailboxes nearing their storage limit, affecting email functionality.
2. Security Risks:
   Compromised user accounts can lead to unauthorized access to shared mailboxes.
3. Data Management Complexity:
   Keeping many inactive mailboxes can make data management more challenging.

Standard Retention Period:

The standard retention period varies, but the best practice is leaving professional email accounts open for one to three months after termination, based on the employee's role.

You can use this articles for more information:
Learn about inactive mailboxes | Microsoft Learn

practical365.com

You’ve got mail – applying GDPR principles to leavers’ inboxes (EU) | Employment Law Worldview

Please click Mark as Best Response & Like if my post helped you to solve your issue.
This will help others to find the correct solution easily. It also closes the item.

If the post was useful in other ways, please consider giving it Like.

Kindest regards,

Leon Pavesic
(LinkedIn)

[#3]

@CB1 

This topic related to account on boarding and off boarding, and yes mapped with retention period which related to compliance and security concern.

This all depend on organization say an example only 90days, even active account for a US based company I worked while 3 months in general, but all talking about once account disabled or deleted.

Hope this help