Data immutability and Office 365 tenant lifecycle


One of the more common questions about Office 365 has been – what happens to my data after my organization’s Office 365 subscription ends? The most common answer circulated in the community refers to a grace period of 30 days, during which you can still retrieve your data.

The answer’s not wrong, but here’s some more detail about the tenant lifecycle after an Office 365 subscription is cancelled, as it relates to the organization’s data.

During the first 30 days after an Office 365 subscription ends, the Office 365 tenant account is in this grace period, known as expired state. During this period, users can still access data. If the subscription ended unintentionally, a rare event I’d argue given the many alerts you get to prevent termination of subscription due to issues such as non-payment, this is a good time to set things right.

After 30 days, the tenant account enters disabled state for 90 days. During this period, users no longer have access to data. The admin can still log in, backup data if required, or reactivate the subscription. At the end of the disabled state, which is 120 days after your subscription has expired, the account enters the deprovisioning state. This is when the data – from user accounts to email data and documents, is deleted permanently.

State of subscription When What happens
Expired 1-30 days
after end of subscription
All users have access
Disabled 31-120 days
after end of subscription
Admin has access
Admin can reactivate and backup data
Deprovisioned After 120 days
of end of subscription
All customer data is deleted
(User data, documents, email, including mailboxes on hold and inactive mailboxes)
Expedited deprovisioning Within 3 days
of end of subscription
All customer data is deleted
(User data, documents, email, including mailboxes on hold and inactive mailboxes)

See What happens to my data and access when my Office 365 for business subscription ends? in Office 365 documentation for details.

There are a few compliance-related questions arising out of end of subscription.

  1. 1. How quickly will you delete data after my organization’s Office 365 service ends?
    Some time after 120 days. The jobs that delete data do so based on service load. You can expect data to be permanently deleted in a reasonable timeframe after the 120 days have elapsed.

  2. 2. How can I ensure my organization’s Office 365 data is deleted quickly after service ends?
    Many security and compliance-minded organizations want to ensure there’s no residual data in a cloud service after they end service. Office 365 customers can request expedited deprovisioning by calling Support. Expedited deprovisioning ensures your data is deleted within 3 days.

  3. 3. Is data immutability maintained after service ends? (In other words, are mailboxes placed on In-Place Hold or Litigation Hold retained after service ends?)
    By far one of the most frequently asked questions. Data immutability refers to the ability to preserve data – in essence, protecting it from destruction and tampering. See links to additional resources on Immutability, In-Place Hold and Litigation Hold below.
     
    No. Microsoft’s responsibility as a service provider ends after your service ends, which is when you stop being a customer/subscriber of the service. As noted above, data is permanently deleted when your tenant account enters the deprovisioning state, within a reasonable time after 120 days of end of subscription, or within 3 days if you request expedited deprovisioning. Mailboxes placed on In-Place Hold or Litigation Hold, including inactive mailboxes, are also deleted as part of deprovisioning.

Immutability in Office 365 and Exchange

Since publishing this post, I've received some questions about how we achieve immutability in Office 365 and Exchange. Check out the following resources for answers:

Bharat Suneja

Comments (7)
  1. Thank you for posting this, we get this question fairly often.

  2. Anon-1 says:

    The REAL question is who Control/Own your Company’s Data in Office 365 Public Cloud. The ANSWER is, if you do NOT hold your Data On-Premises, you do NOT Control/Own your Data in Office 365 Public Cloud :-)

  3. What about backups?

  4. Brenton Foggo says:

    Does this also apply to when the users subscription ends or account is removed as they have left the organisation

  5. Bharat Suneja [MSFT] says:

    @Brenton Foggo: No, this is for the entire organziation.

    When a user leaves the organization:

  6. Ivan.Basov says:

    Thanks for your explanation.

  7. Varun Malhotra says:

    Thanks

Comments are closed.