How to Track the Processing Done by Exchange Online’s Managed Folder Assistant

MFA and Exchange Online

The Managed Folder Assistant (MFA) is an important component in the application of data governance policies for Exchange Online mailboxes. Not only does MFA apply Exchange mailbox policies to mailboxes, it also applies Office 365 retention policies and DLP policies. And it makes sure that Teams compliance records are cleaned up according to the Teams-only retention policies.

MFA Workcycle

Exchange Online uses a workcycle policy to run MFA. The goal is to process mailboxes at least once weekly. Experience is that MFA usually performs better than this and that you can expect to have mailboxes processed twice a week. However, apart from noticing that some messages have been moved from a folder (perhaps to the Deleted Items folder), there’s no obvious outward sign that MFA has processed a mailbox. Unless that is you look at the mailbox properties, which is where Exchange notes the progress of MFA.

Here’s some PowerShell to create a set of user mailboxes and extract information about MFA processing for each mailbox. The XML properties extracted from the mailbox hold lots of information about the mailbox. All of the MFA-related properties are prefixed with “ELC” (Email Lifecycle Control or some similar meaning), and you can examine the properties to expose other information as you like. In this instance, I’ve grabbed the timestamp for the last time MFA processed the mailbox and the number of messages removed from the mailbox.

$Mbx = Get-Mailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited
$Report = @()
ForEach ($M in $Mbx) {
   $LastProcessed = $Null
   Write-Host "Processing" $M.DisplayName
   $Log = Export-MailboxDiagnosticLogs -Identity $M.Alias -ExtendedProperties
   $xml = [xml]($Log.MailboxLog)  
   $LastProcessed = ($xml.Properties.MailboxTable.Property | ? {$_.Name -like "*ELCLastSuccessTimestamp*"}).Value   
   $ItemsDeleted  = $xml.Properties.MailboxTable.Property | ? {$_.Name -like "*ElcLastRunDeletedFromRootItemCount*"}
   If ($LastProcessed -eq $Null) {
      $LastProcessed = "Not processed"}
   $ReportLine = [PSCustomObject]@{
           User          = $M.DisplayName
           LastProcessed = $LastProcessed
           ItemsDeleted  = $ItemsDeleted.Value}      
    $Report += $ReportLine
  }
$Report | Select User, LastProcessed, ItemsDeleted

No Processing for Small Mailboxes

MFA never processes a mailbox if it holds less than 10 MB of content. The code above checks for these mailboxes and returns “Not processed.” To check the size of a mailbox, run the Get-MailboxStatistics cmdlet and examine the TotalItemSize property:

Get-MailboxStatistics -Identity "imran khan" | Select TotalItemSize

TotalItemSize
-------------
5.723 MB (6,001,249 bytes)


Hopefully this information helps you understand how often MFA processes mailboxes inside your Office 365 tenant.

---

For more information about how the Managed Folder Assistant works, read Chapter 19 of the Office 365 for IT Pros eBook.