Retention policy and hard delete

[Kamran Ahmed]

Hello,

We have a Hybrid setup with Exchange 2013 Servers. I have created an Email Retention Policy to my O365 tenant in Security and Compliance to keep emails forever. My question is if a mailbox is hard deleted in O365 can i recover this? Since the retention policy is applied to the Mailbox i'm guessing i won't be allowed to delete this?

Thanks

[#2]

Hey Kamran,

It sounds to me like you are trying to do what Litigation hold does through a retention policy, and they are not the same thing.

If you want to prevent users from deleting any email, you need to have E3 or higher licensing, and put those users (or all users) under litigation hold. A retention policy will just keep the mail from being removed by other means (such as an MRM) but wont protection you completely in the same way a Legal/Lit hold would.

Adam

[#3]

So what is the purpose of having a retention policy and why does it have the option to keep emails for 7 years/forever?

[#4]

What Adam is referring to is the "old", Exchange-style retention policies. If you have configured a retention policy via the Security and compliance center, the mailbox and any content subject to the policy will be preserved for the selected duration. In case the entire mailbox object is removed, it will still be preserved as "Inactive" mailbox. Review the documentation for more details: https://support.office.com/en-us/article/overview-of-retention-policies-5e377752-700d-4870-9b6d-12bf...

[#5]

Thanks Vasil, i thought this might be case.
How can i test this? Since our setup is Hybrid i have to delete the AD Object on-premises, wait for AAD to sync and remove the Object from Office 365 which then will soft delete the mailbox. If i then initiate hard-delete how do i recover the mailbox?

[#6]

I also found this when researching it which may be helpful in your case - https://www.codetwo.com/admins-blog/office-365-litigation-hold-vs-retention-policy/

It has a nice comparison table and everything.

Digging in more i only found the generic, when legal matters are going on do litigation hold, for company wide stuff retention policy's.

So i think you should be find doing a retention policy, just note it can take up to 24 hours to be in effect.

Thanks for the call out @Vasil Michev

[#7]

Hey Karam,

I would do your testing with test data, as to be sure you dont lose anything. Also remember you need to give the retention policy a good 24 hours to be sure its in place.

If this functions like the litigation/legal hold, a deleted mailbox that was being preserved will show up as an inactive mailbox. You just follow the restore process:

https://support.office.com/en-us/article/restore-an-inactive-mailbox-in-office-365-97e06a7a-ef9a-4ce...

Hope this helps!

Adam

[#8]

Thanks Adam.

The article covers inactive mailbox that remains in the Office 365 recycle bin for 30 days (soft-delete), if the retention policy is applied and an admin hard-deletes (permanent) the mailbox how can be recover this?

[#9]

Hey @Kamran Ahmed,

Sorry if I did not explain this well, but if you have a mailbox under litigation hold and it is hard deleted, it actually remains as an inactive mailbox. So you can follow the restore process in the article and find any of those mailboxes to restore.

As i said, assuming the retention hold is the same way, you could do that again. When the policy (or in my experience the lit hold) is in place, even if you have the perception of a hard delete, it will remain in the inactive mailbox list.

Alternatively, you could use the ediscovery to do a search and export all the content into a PST file that way. I have never done whole mailboxes this way, as i have always been able to do inactive mailbox restores with long ago deleted lit hold boxes.

Hope that helps to clarify why i gave you that article :)

Adam 

[#10]

I will test this in my test environment and let you know the outcome. Thanks for the prompt response.

[#11]

Awesome please do, I would love to know if it works the same as Litigation hold did :)