Table of Contents
Set-Mailbox can Remove Retention Holds from Exchange Online Mailboxes
In 2019, I wrote about the ability to exclude inactive mailboxes from organization retention holds through the ExcludeFromOrgHolds and ExcludeFromAllOrgHolds parameters for the Set-Mailbox cmdlet. Exchange Online retains inactive mailboxes until the last hold is released, and some inactive mailboxes were lingering because of holds that could be removed without compromising any compliance requirement. The parameters allowed administrators to exclude inactive mailboxes from organization retention holds, meaning that Exchange Online could then remove the mailboxes if no further hold remained in place.
However, a bunch of other kinds of holds can prevent Exchange Online from removing inactive mailboxes, including eDiscovery holds, litigation holds, retention policies applied at the mailbox level, and the presence of Microsoft 365 retention labels or Exchange compliance tags within the mailbox. Then there’s temporary delay holds and delay release holds and maybe even “orphan” holds where policies have been removed but holds remain in place. All in all, removing everything that could stop Exchange Online deleting an inactive mailbox is a complex business.
The ExcludeFromAllHolds Parameter
Which brings us to the December 10 announcement of the ExcludeFromAllHolds parameter, which is designed to remove some of the blocking holds for inactive mailboxes (and inactive mailboxes too). which is designed to remove some of the holds that block the removal of inactive mailboxes (and inactive mailboxes too). The new capability covers removal of holds imposed by organization retention policies, user-level retention policies, retention labels and compliance tags, and delay holds. The remaining hold types, like eDiscovery or litigation holds, exist for compliance purposes rather than retention processing, and are out of scope. The feature is also described in MC1194077 and Microsoft 365 roadmap item 537204.
Importantly, removing mailboxes from retention processing does not affect Microsoft 365 retention policies or Exchange Online MRM policies. Instead, mailboxes are marked with an exclusion so that when the Managed Folder Assistant applies retention to the mailboxes, it knows that specific policies should be excluded from its calculations. The presence of exclusions is noted in a mailbox’s InPlaceHolds property, where the identifiers for the excluded policies are marked with a -mbx prefix.
Tracking down holds that apply to mailboxes is simple enough. Discovering if labels or tags are used within a mailbox is difficult. For that reason, Microsoft provides the RemoveComplianceTagHoldApplied switch to only remove holds imposed by retention labels and compliance tags.
Set-Mailbox -Identity Marty.King -RemoveComplianceTagHoldApplied -ProvideConsent
The ProvideConsent switch must be used with active mailboxes as an acknowledgement that removing holds might result in data being removed from the mailbox. The switch isn’t needed with inactive mailboxes.
Testing Removing Holds
My tenant (small and mostly used for testing) reports 51 inactive mailboxes. Some of the mailboxes are user mailboxes, some are shared mailboxes. Many of the mailboxes have exclusions created for organization-wide policies and remain in place because of some other hold. Because I clean up eDiscovery cases regularly, most of the inactive mailboxes remain due to the presence of retention labels or compliance tags in the mailbox.
[array]$InactiveMailboxes = Get-ExoMailbox -InactiveMailboxOnly -ResultSize Unlimited -Properties WhenCreated | Sort-Object WhenCreated -Descending $InactiveMailboxes.count 51
Releasing Retention Holds to Remove an Inactive Mailbox
Here’s an example of removing holds from an inactive mailbox. First, we check what holds exist. Apart from one “Uni” (eDiscovery) hold, the other seven holds are prefixed with “mbx,” so they refer to Microsoft 365 retention policies applied to mailboxes. However, there’s a minus sign preceding each prefix, so that means that these are holds that the mailbox is excluded from.
Get-Mailbox -InactiveMailboxOnly -Identity TPerham | Select-Object -ExpandProperty InPlaceHolds -mbx95c7ff3a9a344cb49b4116180c9e975a -mbx85eb38087b2642619b79161788f5b81b -mbxf6a1654abdba4712a43c354e28a4d56c -mbx703105e3b8804a1093bb5cb777638ea8 -mbxc1e2d6f1785d4bf8a7746a26e58e5f66 -mbx9696959111f74ecda8a40aef97edd2c2 -mbx19200b9af08442529be070dae2fd54d3 UniH4001d1c2-9438-4e46-9d14-80207a8099e9
Let’s go ahead and run Set-Mailbox to remove the holds:
Set-Mailbox -Identity TPerham -ExcludeFromAllHolds WARNING: Excluding 1 organization-level policies from mailbox Soft Deleted Objects\TPerham: mbx1c33dc0f078f4d12b7299c8a5b748708:3 WARNING: Excluding 4 user-level policies from mailbox Soft Deleted Objects\TPerham: UniH4001d1c2-9438-4e46-9d14-80207a8099e9, 4001d1c2-9438-4e46-9d14-80207a8099e9, 1c33dc0f-078f-4d12-b729-9c8a5b748708, d3330e0c-9e7b-45f5-8986-a274589ecef9 WARNING: Successfully excluded mailbox Soft Deleted Objects\TPerham from 5 holds. Added 10 exemption entries.
If we check the mailbox again, the number of hold exclusions has grown to 10. The eDiscovery hold is still in place, so the mailbox remains in an inactive state.
Get-Mailbox -InactiveMailboxOnly -Identity TPerham | Select-Object -ExpandProperty InPlaceHolds -mbxd3330e0c9e7b45f58986a274589ecef9 -mbx4001d1c294384e469d1480207a8099e9 -mbx1c33dc0f078f4d12b7299c8a5b748708 -mbx95c7ff3a9a344cb49b4116180c9e975a -mbx85eb38087b2642619b79161788f5b81b -mbxf6a1654abdba4712a43c354e28a4d56c -mbx703105e3b8804a1093bb5cb777638ea8 -mbxc1e2d6f1785d4bf8a7746a26e58e5f66 -mbx9696959111f74ecda8a40aef97edd2c2 -mbx19200b9af08442529be070dae2fd54d3 UniH4001d1c2-9438-4e46-9d14-80207a8099e9
If the cmdlet can remove all holds, the inactive mailbox becomes a soft-deleted mailbox and will eventually be removed. Here’s an example of when an inactive mailbox is excluded from all holds and becomes a soft-deleted mailbox:
Set-Mailbox -Identity Ann.Conroy -ExcludeFromAllHolds
WARNING: Excluding 1 organization-level policies from mailbox Soft Deleted Objects\f8b863a0-01fc-4c2e-beff-eb64484cc83d: mbx1c33dc0f078f4d12b7299c8a5b748708:3
WARNING: Excluding 2 user-level policies from mailbox Soft Deleted Objects\f8b863a0-01fc-4c2e-beff-eb64484cc83d: 1c33dc0f-078f-4d12-b729-9c8a5b748708, d3330e0c-9e7b-45f5-8986-a274589ecef9
WARNING: Successfully excluded mailbox Soft Deleted Objects\f8b863a0-01fc-4c2e-beff-eb64484cc83d from 3 holds. Added 2 exemption entries
Get-Mailbox -SoftDeletedMailbox -Identity Ann.Conroy | Format-List DisplayName, IsInactiveMailbox, WasInactiveMailbox, InPlaceHolds
DisplayName : Ann Conroy (GM Datacenters)
IsInactiveMailbox : False
WasInactiveMailbox : True
InPlaceHolds : {-mbxd3330e0c9e7b45f58986a274589ecef9, -mbx1c33dc0f078f4d12b7299c8a5b748708}
I wrote a script (available from GitHub) to clean up the set of inactive mailboxes by excluding all holds. The script reduced the number of inactive mailboxes from 51 to 12, all of which are held by an eDiscovery case.
Removing Holds from Group Mailboxes and Other Objects
The article describes how to exclude holds for deleted group mailboxes and other objects. However, but I hit issues with some group mailboxes. The error seems misleading because litigation hold was not enabled for the mailbox.
Set-Mailbox -Identity euroengage -GroupMailbox -ExcludeFromAllHolds -InactiveMailbox Set-Mailbox: ||You cannot change any setting except LitigationHoldEnabled and LitigationHoldDuration on an inactive mailbox.
Need to Test Removing Holds
As you’ve probably guessed, there’s no UX for this feature. Everything is done through PowerShell.
Obviously, any time that a hold expires or otherwise loses its grip over retained data, the risk exists that a background process will clean up and remove data permanently. For this reason, it’s wise to test features like the ExcludeAllHolds parameter to make sure it does what you think it should do and is then incorporated into tenant mailbox management processes with the approval of compliance managers.
Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.