The news that Microsoft will finally retire the old Exchange Online admin center (inherited from the on-premises server) in 2022 started me thinking about information which Microsoft should expose in the new EAC. Not every tenant administrator likes PowerShell, and even fewer enjoy grappling with the Microsoft Graph APIs. The kind of situation I’m thinking of is where it would be useful to have a GUI to manage data that’s not exposed today. Like inactive mailboxes.
As I pointed out in the article, Microsoft still has work to do to move functionality from the old EAC to wherever it’s going to be in the future. Exchange’s Mailbox Records Management (MRM) is a special concern because some retention operations (like moving messages to archive mailboxes) is unsupported by Microsoft 365 retention policies. Mobile device access policies are another example.
Some Objects Never Featured in the EAC
And then there are some parts of Exchange which have never shown up in EAC. Inactive mailboxes are an example of what I’m thinking of. These objects occur when an administrator deletes a Microsoft 365 account which is still subject to a litigation or eDiscovery hold. In either circumstance, the mailbox of the now-deleted account holds information which might be needed, so Exchange Online keeps the mailbox in an inactive state. The contents are online, indexed, and discoverable (including non-user data like Teams compliance records), but the mailbox is inaccessible to users unless it is restored. Microsoft created inactive mailboxes to allow tenants to retain Exchange Online user mailboxes for eDiscovery without being connected to a licensed account. This problem doesn’t arise on-premises, which is why inactive mailboxes never appeared in the old EAC.
Inactive mailboxes remain online until the last hold elapses. At this point, the Managed Folder Assistant removes the mailbox. The hold might be:
An Exchange Online litigation hold (on the whole mailbox).
A Microsoft 365 retention policy (which could be scoped to cover the entire mailbox).
A hold placed by a retention label.
A hold placed by a Core or Advanced eDiscovery case.
In addition, some old holds from Exchange eDiscovery might still be in place. Microsoft deprecated these holds in 2020, but the nature of eDiscovery is that some cases last a long time.
Management of Inactive Mailboxes
Inactive mailboxes don’t need a lot of management unless you want to recover data from an inactive mailbox or restore the inactive mailbox to a new mailbox. Apart from that, inactive mailboxes are self-managing and remain in place until the holds supporting their status expire. Note that the Managed Folder Assistant continues to process inactive mailboxes and will remove items which are not needed by the holds in place.
It’s reasonable to ask administrators to use PowerShell to preform infrequent tasks like recovery and restore of inactive mailboxes. What’s less acceptable is the invisibility of inactive mailboxes across the Microsoft 365 administrative interfaces. That’s excepting PowerShell, because you can always run the Get-ExoMailbox cmdlet to return the set of inactive mailboxes, like this:
Get-ExoMailbox –InactiveMailboxOnly -Properties WhenSoftDeleted | Sort WhenSoftDeleted -Descending | Format-Table DisplayName, WhenSoftDeleted
DisplayName WhenSoftDeleted
----------- ---------------
Jack Smith 17/06/2021 15:37:53
Sanjay Patel 26/11/2020 14:10:56
Nancy Anderson 03/10/2020 13:14:05
Boris Johnstone 29/05/2020 09:23:00
Sanjoyan Mustafi 12/05/2020 15:33:08
Kerry Jones 12/05/2020 15:12:03
John Hubbard 12/05/2020 15:12:02
The WhenSoftDeleted property tells us when Exchange Online put the mailbox in that state. After a mailbox spends 30 days in a soft-deleted state, Exchange Online will remove it permanently. That is, unless a hold exists on the mailbox, in which case it becomes inactive. All of the mailboxes listed above are well past the 30-day soft-deletion period, so the holds on the mailboxes must still be active.
Inactive Mailboxes in the Purview Compliance Portal
A change which I recently noticed is the addition of an inactive mailboxes listing under Retention in the Data Lifecycle section of the Microsoft Purview Compliance portal. The case for inclusion here rather than the new EAC is that inactive mailboxes are more important to compliance than day-to-day operations. It’s a reasonable position.
Apart from acknowledging this as a starting point, it’s hard to get excited about the listing because it’s currently not very functional. You can see a list of inactive mailboxes and select a mailbox to view its properties. Unfortunately, the set of properties shown is limited (Figure 1) and you can’t do anything with a selected mailbox.
Figure 1: Inactive mailboxes listing in the Microsoft Purview compliance portal
It would be nice if Microsoft allowed administrators to use the new GUI to:
Update the display name of an inactive mailbox (the Set-Mailbox -InactiveMailbox command only updates the LitigationHoldEnabled and LitigationHoldDuration parameters for inactive mailboxes. I like to mark inactive mailboxes by updating their display name (as in Figure 1). Unfortunately, I often forget, and once the mailbox becomes inactive, its display name cannot be changed.
Recover an inactive mailbox.
Restore an inactive mailbox.
Report the holds which make a mailbox inactive.
Release a litigation hold.
Exclude the mailbox from retention policies (so that the hold doesn’t apply).
I don’t advocate releasing inactive mailboxes from eDiscovery holds as investigators often run eDiscovery cases and administrators might be unaware of the reasons for holds placed on mailboxes.
In any case, the new page in the Purview Compliance portal is a start. Let’s hope Microsoft expands its functionality to make it easier to manage inactive mailboxes.
Make sure that you’re not surprised about changes which appear inside Office 365 applications by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers stay informed.
Is there a way to grant a junior admin access to view the list of Inactive Mailboxes in Purview without granting them the Global Admin, Global Reader, or Compliance Admin role?
Maybe by creating a custom role. I haven’t played with this to see if it is possible. All you need to do is make sure that the role can run Get-ExoMailbox -InactiveMailboxOnly
{"id":null,"mode":"button","open_style":"in_modal","currency_code":"EUR","currency_symbol":"\u20ac","currency_type":"decimal","blank_flag_url":"https:\/\/office365itpros.com\/wp-content\/plugins\/tip-jar-wp\/\/assets\/images\/flags\/blank.gif","flag_sprite_url":"https:\/\/office365itpros.com\/wp-content\/plugins\/tip-jar-wp\/\/assets\/images\/flags\/flags.png","default_amount":100,"top_media_type":"featured_image","featured_image_url":"https:\/\/office365itpros.com\/wp-content\/uploads\/2022\/11\/cover-141x200.jpg","featured_embed":"","header_media":null,"file_download_attachment_data":null,"recurring_options_enabled":true,"recurring_options":{"never":{"selected":true,"after_output":"One time only"},"weekly":{"selected":false,"after_output":"Every week"},"monthly":{"selected":false,"after_output":"Every month"},"yearly":{"selected":false,"after_output":"Every year"}},"strings":{"current_user_email":"","current_user_name":"","link_text":"Virtual Tip Jar","complete_payment_button_error_text":"Check info and try again","payment_verb":"Pay","payment_request_label":"Office 365 for IT Pros","form_has_an_error":"Please check and fix the errors above","general_server_error":"Something isn't working right at the moment. Please try again.","form_title":"Office 365 for IT Pros","form_subtitle":null,"currency_search_text":"Country or Currency here","other_payment_option":"Other payment option","manage_payments_button_text":"Manage your payments","thank_you_message":"Thank you for supporting the work of Office 365 for IT Pros!","payment_confirmation_title":"Office 365 for IT Pros","receipt_title":"Your Receipt","print_receipt":"Print Receipt","email_receipt":"Email Receipt","email_receipt_sending":"Sending receipt...","email_receipt_success":"Email receipt successfully sent","email_receipt_failed":"Email receipt failed to send. Please try again.","receipt_payee":"Paid to","receipt_statement_descriptor":"This will show up on your statement as","receipt_date":"Date","receipt_transaction_id":"Transaction ID","receipt_transaction_amount":"Amount","refund_payer":"Refund from","login":"Log in to manage your payments","manage_payments":"Manage Payments","transactions_title":"Your Transactions","transaction_title":"Transaction Receipt","transaction_period":"Plan Period","arrangements_title":"Your Plans","arrangement_title":"Manage Plan","arrangement_details":"Plan Details","arrangement_id_title":"Plan ID","arrangement_payment_method_title":"Payment Method","arrangement_amount_title":"Plan Amount","arrangement_renewal_title":"Next renewal date","arrangement_action_cancel":"Cancel Plan","arrangement_action_cant_cancel":"Cancelling is currently not available.","arrangement_action_cancel_double":"Are you sure you'd like to cancel?","arrangement_cancelling":"Cancelling Plan...","arrangement_cancelled":"Plan Cancelled","arrangement_failed_to_cancel":"Failed to cancel plan","back_to_plans":"\u2190 Back to Plans","update_payment_method_verb":"Update","sca_auth_description":"Your have a pending renewal payment which requires authorization.","sca_auth_verb":"Authorize renewal payment","sca_authing_verb":"Authorizing payment","sca_authed_verb":"Payment successfully authorized!","sca_auth_failed":"Unable to authorize! Please try again.","login_button_text":"Log in","login_form_has_an_error":"Please check and fix the errors above","uppercase_search":"Search","lowercase_search":"search","uppercase_page":"Page","lowercase_page":"page","uppercase_items":"Items","lowercase_items":"items","uppercase_per":"Per","lowercase_per":"per","uppercase_of":"Of","lowercase_of":"of","back":"Back to plans","zip_code_placeholder":"Zip\/Postal Code","download_file_button_text":"Download File","input_field_instructions":{"tip_amount":{"placeholder_text":"How much would you like to tip?","initial":{"instruction_type":"normal","instruction_message":"How much would you like to tip? Choose any currency."},"empty":{"instruction_type":"error","instruction_message":"How much would you like to tip? Choose any currency."},"invalid_curency":{"instruction_type":"error","instruction_message":"Please choose a valid currency."}},"recurring":{"placeholder_text":"Recurring","initial":{"instruction_type":"normal","instruction_message":"How often would you like to give this?"},"success":{"instruction_type":"success","instruction_message":"How often would you like to give this?"},"empty":{"instruction_type":"error","instruction_message":"How often would you like to give this?"}},"name":{"placeholder_text":"Name on Credit Card","initial":{"instruction_type":"normal","instruction_message":"Enter the name on your card."},"success":{"instruction_type":"success","instruction_message":"Enter the name on your card."},"empty":{"instruction_type":"error","instruction_message":"Please enter the name on your card."}},"privacy_policy":{"terms_title":"Terms and conditions","terms_body":null,"terms_show_text":"View Terms","terms_hide_text":"Hide Terms","initial":{"instruction_type":"normal","instruction_message":"I agree to the terms."},"unchecked":{"instruction_type":"error","instruction_message":"Please agree to the terms."},"checked":{"instruction_type":"success","instruction_message":"I agree to the terms."}},"email":{"placeholder_text":"Your email address","initial":{"instruction_type":"normal","instruction_message":"Enter your email address"},"success":{"instruction_type":"success","instruction_message":"Enter your email address"},"blank":{"instruction_type":"error","instruction_message":"Enter your email address"},"not_an_email_address":{"instruction_type":"error","instruction_message":"Make sure you have entered a valid email address"}},"note_with_tip":{"placeholder_text":"Your note here...","initial":{"instruction_type":"normal","instruction_message":"Attach a note to your tip (optional)"},"empty":{"instruction_type":"normal","instruction_message":"Attach a note to your tip (optional)"},"not_empty_initial":{"instruction_type":"normal","instruction_message":"Attach a note to your tip (optional)"},"saving":{"instruction_type":"normal","instruction_message":"Saving note..."},"success":{"instruction_type":"success","instruction_message":"Note successfully saved!"},"error":{"instruction_type":"error","instruction_message":"Unable to save note note at this time. Please try again."}},"email_for_login_code":{"placeholder_text":"Your email address","initial":{"instruction_type":"normal","instruction_message":"Enter your email to log in."},"success":{"instruction_type":"success","instruction_message":"Enter your email to log in."},"blank":{"instruction_type":"error","instruction_message":"Enter your email to log in."},"empty":{"instruction_type":"error","instruction_message":"Enter your email to log in."}},"login_code":{"initial":{"instruction_type":"normal","instruction_message":"Check your email and enter the login code."},"success":{"instruction_type":"success","instruction_message":"Check your email and enter the login code."},"blank":{"instruction_type":"error","instruction_message":"Check your email and enter the login code."},"empty":{"instruction_type":"error","instruction_message":"Check your email and enter the login code."}},"stripe_all_in_one":{"initial":{"instruction_type":"normal","instruction_message":"Enter your credit card details here."},"empty":{"instruction_type":"error","instruction_message":"Enter your credit card details here."},"success":{"instruction_type":"normal","instruction_message":"Enter your credit card details here."},"invalid_number":{"instruction_type":"error","instruction_message":"The card number is not a valid credit card number."},"invalid_expiry_month":{"instruction_type":"error","instruction_message":"The card's expiration month is invalid."},"invalid_expiry_year":{"instruction_type":"error","instruction_message":"The card's expiration year is invalid."},"invalid_cvc":{"instruction_type":"error","instruction_message":"The card's security code is invalid."},"incorrect_number":{"instruction_type":"error","instruction_message":"The card number is incorrect."},"incomplete_number":{"instruction_type":"error","instruction_message":"The card number is incomplete."},"incomplete_cvc":{"instruction_type":"error","instruction_message":"The card's security code is incomplete."},"incomplete_expiry":{"instruction_type":"error","instruction_message":"The card's expiration date is incomplete."},"incomplete_zip":{"instruction_type":"error","instruction_message":"The card's zip code is incomplete."},"expired_card":{"instruction_type":"error","instruction_message":"The card has expired."},"incorrect_cvc":{"instruction_type":"error","instruction_message":"The card's security code is incorrect."},"incorrect_zip":{"instruction_type":"error","instruction_message":"The card's zip code failed validation."},"invalid_expiry_year_past":{"instruction_type":"error","instruction_message":"The card's expiration year is in the past"},"card_declined":{"instruction_type":"error","instruction_message":"The card was declined."},"missing":{"instruction_type":"error","instruction_message":"There is no card on a customer that is being charged."},"processing_error":{"instruction_type":"error","instruction_message":"An error occurred while processing the card."},"invalid_request_error":{"instruction_type":"error","instruction_message":"Unable to process this payment, please try again or use alternative method."},"invalid_sofort_country":{"instruction_type":"error","instruction_message":"The billing country is not accepted by SOFORT. Please try another country."}}}},"fetched_oembed_html":false}
Is there a way to grant a junior admin access to view the list of Inactive Mailboxes in Purview without granting them the Global Admin, Global Reader, or Compliance Admin role?
Maybe by creating a custom role. I haven’t played with this to see if it is possible. All you need to do is make sure that the role can run Get-ExoMailbox -InactiveMailboxOnly