How to Track the Processing Done by Exchange Online’s Managed Folder Assistant

Managed Folder Assistant and and Exchange Online

The Managed Folder Assistant (MFA) is an important component in the application of data governance policies for Exchange Online mailboxes. Not only does MFA apply Exchange mailbox policies to mailboxes, it also applies Microsoft 365 retention policies and DLP policies. MFA treats Exchange retention tags and Microsoft 365 retention labels equally, and makes sure that users see a common set of tags for application to mailbox folders and items. Finally, MFA makes sure that Teams compliance records are cleaned up based on the settings in the Teams-only retention policies.

Microsoft 365 uses a different background assistant to process retention policies for non-Exchange workloads.

MFA Workcycle

Exchange Online uses a workcycle policy to run the Managed Folder Assistant. This means that a goal is set (once a week) for the system to process mailboxes. Exchange Online balances the demands of the workcycle policy and available system resources to make sure that MFA meets its workcycle goal. My experience is that MFA usually performs better than the stated goal and that you can expect to have mailboxes processed twice a week.

However, apart from noticing that some messages have been moved from a folder (perhaps to the Deleted Items folder or to an archive mailbox), there’s no obvious outward sign that the Managed Folder Assistant has processed a mailbox. Unless you examine the mailbox properties, which is where Exchange notes details of the processing done by the Managed Folder Assistant.

Here’s some PowerShell to create a set of user mailboxes and extract information about MFA processing for each mailbox. The XML properties extracted from the mailbox hold lots of information about the mailbox. All of the MFA-related properties are prefixed with “ELC” (Email Lifecycle Control or some similar meaning), and you can examine the properties to expose other information as you like. In this instance, I’ve grabbed the timestamp for the last time the Managed Folder Assistant processed the mailbox and the number of messages MFA removed from the mailbox. The output report is sorted by the last processed timestamp. You should see a variety of timestamps because Exchange Online does not process all mailboxes in a tenant at the same time.

[array]$Mbx = Get-ExoMailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited | Sort-Object DisplayName
$MbxReport = [System.Collections.Generic.List[Object]]::new() 
ForEach ($M in $Mbx) {
   $LastProcessed = $Null
   Write-Host ("Processing {0}" -f $M.DisplayName)
   $Log = Export-MailboxDiagnosticLogs -Identity $M.ExternalDirectoryObjectId -ExtendedProperties
   $xml = [xml]($Log.MailboxLog)  
   $LastProcessed = ($xml.Properties.MailboxTable.Property | Where-Object {$_.Name -like "*ELCLastSuccessTimestamp*"}).Value   
   $ItemsDeleted  = $xml.Properties.MailboxTable.Property | Where-Object {$_.Name -like "*ElcLastRunDeletedFromRootItemCount*"}
   If ($LastProcessed -eq $Null) {
      $LastProcessed = "Not processed"}
   $ReportLine = [PSCustomObject]@{
      User          = $M.DisplayName
      LastProcessed = $LastProcessed
      ItemsDeleted  = $ItemsDeleted.Value}      
    $MbxReport.Add($ReportLine)
  }
$MbxReport | Sort-Object {$_.LastProcessed -as [datetime]} -Descending

If a mailbox reports a timestamp from a long time ago, it is probably because the mailbox has dipped under the 10 MB threshold and is therefore no longer a candidate for MFA processing.

No Processing for Small Mailboxes

MFA does not processes a mailbox if it holds less than 10 MB of content. The script shown above checks for these mailboxes and returns “Not processed” when the mailbox diagnostics cmdlet doesn’t return a successful timestamp. Usually, this means that a mailbox is too small for MFA to process. It could also be true that the mailbox was too small the last time MFA checked and subsequently grew past 10 MB and is waiting MFA to return and process the mailbox.

To check the size of a mailbox, run the Get-ExoMailboxStatistics cmdlet and examine the TotalItemSize property:

Get-ExoMailboxStatistics -Identity "imran khan" | Select-Object TotalItemSize

TotalItemSize
-------------
5.723 MB (6,001,249 bytes)


Hopefully this information helps you understand how often the Exchange Managed Folder Assistant processes Exchange Online mailboxes inside your Microsoft 365 tenant.

---

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.