Office 365 Security & Compliance Retention Policy and recovery times

[Tero Voutilainen (CGI.com)]

Imagine the scenario where company has an Office 365 Security & Compliance Retention Policy with 6 months hold for all modified items and no deletion after the hold set to all O365 workloads (Skype, Exchange, Sharepoint, OneDrive…) organization-wide to all users. 

Now, while the policy is affecting, user “Jon Doe” account is deleted from Azure AD by removing the AD user object from the AADConnect sync scope. 

When will Jon’s Exchange Online mailbox data and OneDrive for Business data be completely deleted from the cloud to the point of no restore available?

[#2]

My own assumptions based on heavy googl... binging:

Mailbox

Mailbox will become Inactive Mailbox because of the Azure AD user account gets deleted and the mailbox is under org-wide retention policy. I assume the user removal is a change to mailbox and it will trigger the countdown of 6 months as per org-wide retention policy. After 6 months the hold no longer keep the Exchange Online from initiating the normal removal process of deleted mailboxes and the mailbox gets removed after the default 30 days mailbox retention period. So is it completely removed after 6 + 1 months... or is that default of 30 days included to the 6 months already?

SharePoint Online/OneDrive for Business

After the Azure AD user object get deleted, the OneDrive Clean Up Job runs, and the user profile is marked for deletion. The profile will be preserved in the database in a deleted state. The default retention period is 30 days but this value can be modified by using the -OrphanedPersonalSitesRetentionPeriod parameter for the Set-SPOTenant cmdlet in the SharePoint Online Management Shell.

The retention period for cleanup of OneDrive begins when a user account is deleted from Azure Active Directory. No other action will cause the cleanup process to occur including disablement of a user account or removal of a user’s license. The personal site (that is, the OneDrive for Business site) for the deleted account is sent to the site collection recycle bin. The site is deleted from the recycle bin according to the site collection recycle bin retention policy, which is 90 days. The site isn't listed in the site collection recycle bin user interface (UI). You can however confirm its presence by using the Get-SPODeletedSite cmdlet for the SharePoint Online Management shell.

Since the user is still under Retention Policy hold for 6 moths the cleanup process can not proceed. Therefore the deletion will occur after 6 months counted from the account deletion date. So I assume the answer would be either 6 + 3 months or 6 months since the 90 days is included to that already.

--

Does someone know if the cleanup periods (in EXO and SPO) are initiated right after the retention hold ends (resulting extra retention of 1 month for mailbox and 3 months for OneDrive)

or

will the default retention period happen while the data is on-hold and the complete removal will occur instantly after the retention hold ends?

[#3]

Your bing-fu yielded the correct results. Just to clarify on the Exchange scenario - the 30 days window is for the soft-deleted scenario. This is the recovery window for all mailboxes, regardless of hold status (Inactive mailbox or not). In your scenario, the 6 months period already includes those 30 days. However, to still give you some time to recover data from the mailbox if needed, it will not be immediately deleted even if the hold expires. It's "marked" for permanent deletion, and will be deleted in the coming days (they haven't specified the exact period). The recover/restore process is the same as for Inactive mailboxes though.