Preserve mailbox data for eDiscovery using inactive mailboxes in Exchange Online
Published Mar 21 2013 04:05 PM 60.6K Views
Microsoft

 

In Exchange Online and Exchange Server 2013, you can use In-Place Hold or Litigation Hold to preserve mailbox content for litigation or investigations. Many organizations also need to preserve mailbox data for users who are no longer in the organization.

In on-premises Exchange deployments, this has typically been done by disabling the Active Directory user account and performing actions such as removing it from distribution groups, preventing inbound/outbound email to and from the mailbox (including setting delivery restrictions and configuring message size limits), hiding the mailbox from the Global Address List (GAL), and also setting an account expiration date on the user account in Active Direcory. Licensing costs are not a concern in this scenario, because you do not need a Client Access License (CAL) for a mailbox that’s no longer active.

In Exchange Online, admins remove mailboxes for departed users. However, once you remove a mailbox, it can no longer be included in In-Place eDiscovey searches (Multi-Mailbox Search in the previous version of the service and in Exchange 2010). Additionally, 30 days after you remove a mailbox, it is permanently deleted from Exchange Online and can no longer be recovered. In-Place eDiscovery requires that the mailbox be active, which means an Exchange Online or Office 365 plan is required for the mailbox for as long as you want to preserve data for eDiscovery.

Note: You can preserve mailbox data offline by exporting it to a PST file using Microsoft Outlook and then remove the mailbox. However, if you need to perform an eDiscovery search, you would need to inject it back to an Exchange Online mailbox.

Inactive Mailboxes

In the new Exchange Online, we’ve introduced the concept of inactive mailboxes to handle departed users. When a user leaves the organization and you need to retain their mailbox data for some time to facilitate eDiscovery (or meet retention or business requirements), you can place the mailbox on In-Place Hold or Litigation Hold before removing the Office 365 user. This preserves the mailbox, but prevents it from sending/receiving messages, hides it from users so it's no longer visible in the GAL and other recipient lists. You can add inactive mailboxes to In-Place eDiscovery searches. After you've made a mailbox inactive, you no longer require an Exchange Online or Office 365 plan for it.

When your eDiscovery, retention or other business requirements are met and you no longer need to preserve the mailbox content, you can remove the mailbox from In-Place Holds or Litigation Hold. After you remove hold, the normal mailbox removal behavior of Exchange Online will resume for the mailbox - which means, if the mailbox was removed more than 30 days ago, it will be permanently deleted. If it was removed less than 30 days ago, it will be permanently deleted after 30 days of removal.

For more details, see Overview of inactive mailboxes (short url: aka.ms/inactivembx) in Exchange Online documentation.

Inactive mailboxes are available in March 2013 in the E3, E4, E5, A3, A4, G and Exchange Online P2 plans.

Note:  An inactive mailbox cannot exist without a Hold. To place a mailbox on hold, you require an Exchange Online Plan 2 license (standalone, or through Office 365 E3 or E5 plans). Customers with an Exchange Online Plan 1 can assign an Exchange Online Archiving (EOA) license to place a mailbox on hold. After you place a mailbox on hold and remove the user account, you can reassign the license. This preserves the mailbox data as long as it remains on hold. See Exchange Online service description for licensing and availability of features.

 

Migrating inactive mailbox data to Exchange Online

If you already have inactive mailboxes in your on-premises Exchange 2010 or Exchange 2013 environment or a third-party archive, you can move the data to inactive mailboxes in Exchange Online by first provisioning an Exchange Online mailbox, which requires a plan subscription, importing the data to the Exchange Online mailbox, placing the user on In-Place Hold or Litigation Hold and then deleting the user account, making it an inactive mailbox. You do not require a plan subscription for that mailbox after you make it inactive. However, you will need a subscription during the provisioning and data import process. If you have a large number of inactive mailboxes, you can provision them in batches using a smaller number of subscriptions. Note, the Product Usage Rights (PUR) states that licenses can only be reassigned once every 90 days.

How long can a mailbox be inactive?

You can preserve data in inactive mailboxes for as long as you need to, based on your organization's retention and eDiscovery requirements. Of course, you would need to continue to be an Office 365/Exchange Online customer.

Do both primary and archive mailboxes become inactive mailboxes?

When you place a mailbox on hold in Exchange, you're actually placing the user on hold. Both primary and archive mailboxes are placed on hold, and become inactive after you remove the Office 365 user. When you use Office 365's eDiscovery tools to search the (now inactive) user, both mailboxes are searched.

How can you remove data from an inactive mailbox?

If you've specified a hold duration using In-Place Hold or Litigation Hold, items older than the hold duration are removed when the Managed Folder Assistant (MFA) processes the mailbox.

Can you search inactive mailboxes using Office 365 eDiscovery tools?

Yes. Inactive mailboxes are visible to Office 365 eDiscovery tools - In-Place eDiscovery in Exchange Online, the eDiscovery Center in SharePoint Online, and eDiscovery or Content Search in the Office 365 Security and Compliance Center (SCC). No additional licenses are required to include inactive mailboxes in eDiscovery searches.

What happens after July 1, 2017, when you'll no longer be able to create new In-Place Holds?

As noted in Inactive mailboxes in Exchange Online and elsewhere in Exchange Online documentation:

On July 1, 2017, you'll no longer be able to create In-Place Holds in Exchange Online (in Office 365 and Exchange Online standalone plans). You'll still be able to modify existing In-Place Holds, and creating new In-Place Holds in Exchange Server 2013 and Exchange hybrid deployments will still be supported. And, you'll still be able to place mailboxes on Litigation Hold. As an alternative to using In-Place Holds, you can use eDiscovery cases or retention policies in the Office 365 Security & Compliance Center.

To make a mailbox inactive, you can use Litigation Hold, eDiscovery cases or Retention Policies in Office 365.

Bharat Suneja

Updates

  • 3/16/2015: Changed the highlighted verbiage (in Migrating section) from "placing the user on In-Place Hold or Litigation Hold and then removing the subscription, making it an inactive mailbox" to "deleting the user account". Added links to In-Place eDiscovey and Litigation Hold.
  • 5/23/2013: Added info about migrating inactive mailbox data to Exchange Online.
  • 6/18/2013: Added note about Product Usage Rights (PUR).
  • 3/5/2014: Added info about how long a mailbox can be inactive and included Litigation Hold.
  • 4/14/2014: Added clarification about how you can remove data from inactive mailboxes (and hold duration specified for In-Place Hold or Litigation Hold has no impact.)
  • 1/27/2016: Updated above clarificaiton about how you can remove data from inactive mailbox to state it is processed by MFA and items older than LitigationHoldDuration are removed. Removed: All content in an inactive mailbox is on hold until you remove the hold from the mailbox.
  • 2/7/2017: Added following Q&A about archive mailboxes: Do both primary and archive mailboxes become inactive mailboxes?
  • 5/22/2017: Added following Q&A about eDiscovery: Can you search inactive mailboxes using Office 365 eDiscovery tools? Added E5 plan to list ("Inactive mailboxes are available in March 2013 in the E3, E4, E5, A3, A4, G and Exchange Online P2 plans").
  • 6/19/2017: Added information regarding changes on July 1, 2017, when you'll no longer be able to create new In-Place Holds.
  • 4/23/2020: Added note about licensing with link to service description and changed "Inactive mailboxes do not require an Exchange Online or Office 365 plan" to "After you've made a mailbox inactive, you no longer require an Exchange Online or Office 365 plan."
12 Comments
Version history
Last update:
‎Apr 23 2020 02:57 PM
Updated by: