Retention Policy
6 TopicsDisable MRM Policy on a mailbox, while leaving In-Place Archiving enabled in Exchange Online?
I have a user whose Exchange Online currently has an MRM retention policy applied, as well as having In-Place Archiving enabled. However, I now want the user to be able to have all their mailbox items, going forward, to remain in their live mailbox, while still keeping the items in the In-Place Archive active and available to them for reference when needed. If I change just the MRM retention policy to "No Policy" for this user's mailbox, will that leave the In-Place Archive active while stopping any new/future items in the user's live mailbox from being automatically moved into the In-Place Archive?375Views0likes1Commentis email item retention age reset after recovering the emails from Recoverable items folder in EXO ?
Suppose an email is 2yrs old and now as per M365 Retention compliance policy ( 2Yrs keep and delete) it was deleted by MRM. the email moved to the Deletions folder in the Recoverable items folder. Now if a user recover the email from Deletions, I assume the email will be deleted again once MRM runs again. Again the user recovers the email from deletions. How long can this go ? MRM removing the email and user recovering the email from deletions ?909Views0likes4CommentsRetention policy to remove older than 30 days items from the Deletd Items folder "doesn't work "
Recently I worked with this scenario and faced the following "issue": After a hybrid Exchange migration, we needed to replicate the onprem retention policies. Basically, enforce a policy that removes all the messages older than 30 days from all the mailboxes Deleted Items folder. That's something quite easy to configure, ( done thousand times ), and will not get deeper in this technical details. The case is that, after the setup, we noticed that many old items, ( even from last year and older ), were still in the user's Deleted Items folder without any action from the policy. Of course that I know that the Managed Folder Assistant, ( in charge to check those policies and apply any action if required ), runs automatically once por week +- and we can force it with the cmdlt: Start-ManagedFolderAssistant <UserEmailAddress> And in order to recalculate all retention tags and apply them to the required folders, we can run: Start-ManagedFolderAssistant <UserEmailAddress> -FullCrawl But even running both commands and waiting more than 48 hours nothing happend. After further investigations and the help of a MS engineer we got the point: The retention age is calculated based on "Date of delivery or creation unless the item was deleted from a folder that does not have an inherited or implicit retention tag. If an item is in a folder that doesn't have an inherited or implicit retention tag applied, the item isn't processed by the MFA and therefore doesn't have a start date stamped by it. When the user deletes such an item, and the MFA processes it for the first time in the Deleted Items folder, it stamps the current date as the start date." How retention age is calculated in Exchange Online | Microsoft Learn In fact, we verified that with some random old messages in some mailboxes and all those had the first MFA run as the start date stamped. After waiting 30 days the messages were correctly deleted. Hope that this helps someone facing the same behavior, avoiding spend so much time as I spent on this 🙂1.2KViews0likes0CommentsHow to "bypass" an Exchange Retention Policy Preservation Lock
I have a scenario with a complete Exchange Retention policy with a preservation lock. As you already know, once a preservation lock is in place, nobody can turn off the policy, delete the policy, or make it less restrictive, ( neither the Global Admin ). Now we need to modify it for a couple of mailboxes, but as those mailboxes, ( like all the mailboxes ), are included in the locked retention policy, there's "no way" to do it. Well, I figured out one chance... 😉 Here starts to play the principles of retention. As the mentioned retention policy is applied to the whole Exchange environment, and as per the principles of retention explicit wins over implicit for deletions, we can create a new policy that applies to the required specific mailboxes in order to delete the content sooner. " If a retention policy for a location uses an adaptive scope or a static scope that includes specific instances (such as specific users for Exchange email) that retention policy takes precedence over a static scope that is configured for all instances for the same location ". Learn about retention policies & labels to retain or delete - Microsoft Purview (compliance) | Microsoft Learn That should solve the issue "bypassing" the locked policy. But note that this principle only takes advatage in the case of deletions. For only retention, that wins always over deletions. Maybe not the best solution, but people should be aware about such kind of things before locking a retention policy. Feel free to let me know your thoughts.1.8KViews0likes0CommentsMS Graph (or alternative) for M365/O365 Retention Policy management
Wondering if anyone is aware of whether we can get API access to the Security and Compliance Center. I'm not even sure what to call it, but I'm in need to manage retention policies that today are managed at https://compliance.microsoft.com, or via Connect-IPPSSession (from the EXO v2 PS module). What I'm trying to avoid is basic authentication with Connect-IPPSSession. I don't see anything for MS Graph from the v1.0/beta references, and I have already asked the Exchange Team in the comments for their blog post about the app-only/certificate authentication addition to Connect-ExchangeOnline (asked if they'll bring the same added functionality to Connect-IPPSSession). My use case is to unattended'ly script the addition/removal of certain users to/from the excluded mailboxes list for a given retention policy. This would be done interactively like this: Connect-IPPSSession <parameters of choice> Set-RetentionCompliancePolicy <policy> -AddExchangeLocationException <one,or,more,users> The reason is that a customer is using a retention policy to ensure their terminating users' mailboxes become Inactive Mailboxes. Since they rely so heavily on Inactive Mailboxes, auto-expanding archives are out of the question (as this takes away recoverability/restorability for Inactive Mailboxes). As a result, many mailboxes are hitting the 100GB Recoverable Items quota. So we have a manual process for now to exclude these mailboxes from the policy, then either wait or rush with Start-ManagedFolderAssistant to see the Recoverable Items consumption go down. We can easily use Connect-ExchangeOnline, Get-EXOMailbox, and Get-EXOMailboxStatistics with an Azure AD app and a certificate to figure out which mailboxes are approaching the 100GB. But we can't do the same with Connect-IPPSSession. I am eagerly awaiting either MS Graph support for this, or for Connect-IPPSSession to be updated. Neither of these things are even announced that I can see.Solved9.1KViews1like17CommentsAnyone knows a way to create a retention policy for EXO Inactive mailboxes?
In the article section of "Inactive mailboxes and Microsoft 365 retention policies" it specifies: You might consider creating a Microsoft 365 retention policy specifically for inactive mailboxes. Here are some reasons for doing this and things to keep in mind. You can configure the retention policy to retain mailbox content only as long as necessary to meet your organization's requirement for former employees. It's a good way to identify inactive mailboxes because the retention policy will only be applied to inactive mailboxes. You are able to quickly identify the retention policy that's assigned to inactive mailboxes in your organization. This makes it easier to change the retention (or deletion) settings if necessary. It will also make it easier to permanently delete an inactive mailbox because you can remove it from the policy by using the Microsoft 365 compliance center. Otherwise, you have to use Exchange Online PowerShell to remove a Litigation Hold from an inactive mailbox or use Security & Compliance Center PowerShell to exclude an inactive mailbox from an organization-wide Microsoft 365 retention policy. If you create a Microsoft 365 retention policy specifically for inactive mailboxes, you can add a maximum of 1,000 mailboxes to the policy. If you're a large organization, you might have to create more than one Microsoft 365 retention policy to use for inactive mailboxes. These are exactly what my organization wants. However, I wonder whether it is possible to create a retention policy targeting all the inactive mailboxes. If so, what are the process to create such a retention policy. This article did not provide any feasible way to create such a policy. Could anyone advise whether it is possible and how this retention policy can be created? In another document It mentions: When you apply the retention settings to All recipients, any inactive mailboxes are included. However, if you change this default and configure specific inclusions or exclusions, inactive mailboxes aren't supported and retention settings won't be applied or excluded for those mailboxes.1.7KViews0likes3Comments