SOLVED

Journaling in O365

%3CLINGO-SUB%20id%3D%22lingo-sub-333892%22%20slang%3D%22en-US%22%3ERe%3A%20Journaling%20in%20O365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-333892%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20there%2C%3CBR%20%2F%3E%3CBR%20%2F%3EI%20have%20a%20continuing%20question%20to%20this.%20So%20I%20guess%20we%20don't%20have%20to%20talk%20about%20that%20selecting%20an%20OnPrem%20mailbox%20is%20no%20option.%20Microsoft%20is%20enforcing%20the%20companies%20so%20vehemently%20to%20migrate%20to%20O365%20that%20all%20customers%20believe%20that%20they%20will%20have%20all%20solutions%20out-of-the-box.%20For%20sure%20they%20are%20planning%20to%20deprovision%20their%20OnPrem%20services%20one%20by%20one.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%20the%20only%20option%20is%20a%20third%20party%20service%20or%20the%20legal%20hold.%20From%20my%20experience%20a%20lot%20of%20companies%20have%26nbsp%3B%20a%20high%20auditing%20acceptability%20with%20journaling%20and%20a%20secure%20(items%20cannot%20be%20deleted%20by%20user)%20archive.%3CBR%20%2F%3E%3CBR%20%2F%3ECan%20I%20achieve%20that%20with%20the%20in-place%20%2F%20litigation%20hold%3F%20For%20a%20good%20reason%20there%20is%20the%20requirement%20that%20a%20user%20cannot%20delete%20emails%20from%20the%20very%20first%20second%2C%20maybe%20in%20his%20view%2C%20but%20not%20in%20the%20backend.%3CBR%20%2F%3E%3CBR%20%2F%3EThat%20would%20mean%20after%20creating%20a%20user%20and%20assigning%20the%20required%20licenses%20I%20would%20set%20the%20in-place%20hold%20immediately.%20What%20about%20storage%20consumption%3F%3CBR%20%2F%3E%3CBR%20%2F%3EThanks%20for%20your%20help.%3CBR%20%2F%3E%3CBR%20%2F%3EKind%20regards%2C%3CBR%20%2F%3EChristian%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-13803%22%20slang%3D%22en-US%22%3ERe%3A%20Journaling%20in%20O365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-13803%22%20slang%3D%22en-US%22%3E%3CP%3EAlthough%20supported%20in%20Office%20365%2C%20Journaling%20is%20a%20legacy%20feature%20typically%20used%20to%20capture%20messages%20from%20the%20transport%20pipeline%20and%20deliver%20them%20to%20an%20archiving%20system%20or%20service.%20In%20Office%20365%2C%20you%20can%20journal%20messages%20to%20an%20SMTP%20address%2C%20typically%20an%20on-premises%20mailbox%20or%20a%20third-party%20archiving%20service.%20You%20cannot%20select%20an%20Office%20365%20mailbox%20as%20the%20journaling%20(target)%20mailbox.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20recommended%20archiving%20solution%20is%20to%20preserve%20message%20in-place%20using%20In-Place%20Hold%20or%20Litigation%20Hold.%20In%20Exchange%20Online%2C%20this%20preserves%20messages%20in%20the%20user's%20primary%20mailbox%20and%20archive.%20See%20%3CSTRONG%3E%3CA%20href%3D%22https%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fdn790612.aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EHold%20in%20Office%20365%3C%2FA%3E%3C%2FSTRONG%3E%20for%20more%20info.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20you%20use%20unified%20hold%20from%20the%20Security%20and%20Compliance%20Center%2C%20you%20can%20preserve%20data%20across%20Exchange%20Online%2C%20SharePoint%20Online%20(including%20OneDrive%20for%20Business%20files)%20and%20Skype%20for%20Business.%20Recently%20announced%20functionality%20also%20allows%20you%20to%20capture%20social%20media%20content%20from%20Facebook%2C%20LinkedIn%20and%20Twitter%20in%20Office%20365.%20All%20archived%20data%20is%20available%20for%20%3CSTRONG%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.office.com%2Fen-us%2Farticle%2FeDiscovery-in-Office-365-143b3ab8-8cb0-4036-a5fc-6536d837bfce%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EeDiscovery%3C%2FA%3E%3C%2FSTRONG%3E.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-13036%22%20slang%3D%22en-US%22%3ERe%3A%20Journaling%20in%20O365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-13036%22%20slang%3D%22en-US%22%3E%3CP%3EYou%20can%20use%20either%20in-place%20or%20litigation%20holds%20to%20retain%20all%20emails%20according%20to%20a%20number%20of%20different%20criteria%20including%20to%2Ffrom%20a%20particular%20user.%20Not%20quite%20the%20same%20as%20journalling%20of%20course%20but%20depending%20on%20your%20requirements%2C%20it%20may%20be%20sufficient.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-9217%22%20slang%3D%22en-US%22%3ERe%3A%20Journaling%20in%20O365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-9217%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20Vasil%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20gather%20by%20your%20response%20that%20there%20is%20no%20newer%20update%20than%20from%20Feb%202015%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20any%20%22in%20place%22%20solution%20to%20capture%20all%20sent%20%2F%20received%20emails%20in%20O365%20to%20use%20eDiscovery%20tools%20on%20that%20is%20in%20the%20Security%20%26amp%3B%20Compliance%20portal%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDoes%20the%20indefinite%20hold%20work%20the%20same%20as%20journaling%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20the%20only%20way%20to%20journal%20with%20O365%20is%20to%20pay%20yet%20another%20vendor%20like%20Symantec%20for%20EV.Cloud%2C%20or%20mimecast%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-9097%22%20slang%3D%22en-US%22%3ERe%3A%20Journaling%20in%20O365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-9097%22%20slang%3D%22en-US%22%3E%3CP%3EJournaling%20is%20available%2C%20but%20you%20cannot%20use%20an%20O365%20mailbox%20for%20the%20target.%20Any%20O365%20mailbox.%20The%20documentation%20is%20here%3A%20%3CA%20href%3D%22https%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fjj898487(v%3Dexchg.150).aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fjj898487(v%3Dexchg.150).aspx%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ELitigation%2FIn-place%20hold%20is%20the%20preferred%20method%2C%20but%20it%20always%20depends%20on%20the%20requirements.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-467452%22%20slang%3D%22en-US%22%3ERe%3A%20Journaling%20in%20O365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-467452%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eis%20it%20possible%20to%20create%202%20journaling%20so%20that%20we%20can%20archive%20to%202%20different%20places%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-473535%22%20slang%3D%22en-US%22%3ERe%3A%20Journaling%20in%20O365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-473535%22%20slang%3D%22en-US%22%3E%3CP%3ENot%20sure%20about%20your%20exact%20scenario%20and%20use%20case%2C%20but%20have%20you%20see%20this%20recent%20third%20party%20assessment%20for%20Exchange%20online%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fuse-exchange-online-to-comply-with-sec-rule-17a-4%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EUse%20Exchange%20Online%20and%20the%20Security%20%26amp%3B%20Compliance%20Center%20to%20comply%20with%20SEC%20Rule%2017a-4%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-9065%22%20slang%3D%22en-US%22%3EJournaling%20in%20O365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-9065%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20All%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%20options%20are%20available%20to%20perform%20Journaling%20within%20O365%20and%20Exchange%20Online%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20see%20that%20E-Discovery%20is%20in%20the%20security%20and%20compliance%20portal%2C%20but%20is%20that%20only%20against%20the%20exchange%20online%20(non-journaled)%20mailboxes%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%20do%20you%20recommend%20for%20journaling%3F%20What%20can%20O365%20E-Discovery%20be%20used%20again%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegards%2C%3C%2FP%3E%3CP%3ERussell%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Hi All,

 

What options are available to perform Journaling within O365 and Exchange Online?

 

I see that E-Discovery is in the security and compliance portal, but is that only against the exchange online (non-journaled) mailboxes?

 

What do you recommend for journaling? What can O365 E-Discovery be used again?

 

Regards,

Russell

7 Replies

Journaling is available, but you cannot use an O365 mailbox for the target. Any O365 mailbox. The documentation is here: https://technet.microsoft.com/en-us/library/jj898487(v=exchg.150).aspx

 

Litigation/In-place hold is the preferred method, but it always depends on the requirements.

Thanks Vasil,

 

I gather by your response that there is no newer update than from Feb 2015?

 

Is there any "in place" solution to capture all sent / received emails in O365 to use eDiscovery tools on that is in the Security & Compliance portal?

 

Does the indefinite hold work the same as journaling?

 

Is the only way to journal with O365 is to pay yet another vendor like Symantec for EV.Cloud, or mimecast?

 

 

You can use either in-place or litigation holds to retain all emails according to a number of different criteria including to/from a particular user. Not quite the same as journalling of course but depending on your requirements, it may be sufficient.

best response confirmed by Deleted
Solution

Although supported in Office 365, Journaling is a legacy feature typically used to capture messages from the transport pipeline and deliver them to an archiving system or service. In Office 365, you can journal messages to an SMTP address, typically an on-premises mailbox or a third-party archiving service. You cannot select an Office 365 mailbox as the journaling (target) mailbox.

 

The recommended archiving solution is to preserve message in-place using In-Place Hold or Litigation Hold. In Exchange Online, this preserves messages in the user's primary mailbox and archive. See Hold in Office 365 for more info.

 

If you use unified hold from the Security and Compliance Center, you can preserve data across Exchange Online, SharePoint Online (including OneDrive for Business files) and Skype for Business. Recently announced functionality also allows you to capture social media content from Facebook, LinkedIn and Twitter in Office 365. All archived data is available for eDiscovery.

Hi there,

I have a continuing question to this. So I guess we don't have to talk about that selecting an OnPrem mailbox is no option. Microsoft is enforcing the companies so vehemently to migrate to O365 that all customers believe that they will have all solutions out-of-the-box. For sure they are planning to deprovision their OnPrem services one by one.

 

So the only option is a third party service or the legal hold. From my experience a lot of companies have  a high auditing acceptability with journaling and a secure (items cannot be deleted by user) archive.

Can I achieve that with the in-place / litigation hold? For a good reason there is the requirement that a user cannot delete emails from the very first second, maybe in his view, but not in the backend.

That would mean after creating a user and assigning the required licenses I would set the in-place hold immediately. What about storage consumption?

Thanks for your help.

Kind regards,
Christian

@Vasil Michev 

 

is it possible to create 2 journaling so that we can archive to 2 different places?

Not sure about your exact scenario and use case, but have you see this recent third party assessment for Exchange online: Use Exchange Online and the Security & Compliance Center to comply with SEC Rule 17a-4