Table of Contents
A Mailbox Property to Track Compliance
While playing with the new PowerShell capability to exclude mailboxes from retention holds, I came upon the EnforcedTimestamps mailbox property, which stores a JSON array of information about timestamps and events. For example:
Get-Mailbox -Identity Marty.King | Select-Object -ExpandProperty EnforcedTimestamps
[{"EventTimestamp":"2025-11-19T05:35:11.7811664Z","EnforcedUntilTimestamp":"2025-11-19T05:30:11.7811664Z","EventType":26},{"EventTimestamp":"2025-09-15T15:32:33.1507615Z","EnforcedUntilTimestamp":"2025-09-15T15:27:33.1507615Z","EventType":26}]
EnforcedTimestamps is not a property that I knew of, so it deserved some investigation. The starting point proved fruitless because Google search doesn’t reveal anything interesting about the topic. However, Microsoft 365 Copilot said:
“The EnforcedTimestamps property in Exchange Online mailboxes uses internal event types to record when compliance-related actions were enforced. These event types are not the same as message tracking log events—they’re specific to retention and hold enforcement.”
I asked Copilot where it found the information, and it replied:
“These mappings come from internal schema references and observed behavior in production tenants, combined with official descriptions of each compliance feature.”
Managed Folder Assistant Processing
After closer examination, it seems like the Managed Folder Assistant adds event and timestamps to mailboxes to help it keep track of the many different kinds of retention, litigation, and eDiscovery holds plus retention labels and Exchange compliance tags that it meets when it performs retention processing for mailboxes. The Managed Folder Assistant operates on a schedule that means each mailbox in the tenant should be processed at least once weekly. During processing, the assistant figures out what mailbox items should be kept and which items can be removed. It does so by resolving all the various holds that exist for the mailbox to ensure that no item is removed if it comes within the scope of a hold. As you’d expect, the assistant retains items based on the longest hold period.
The timestamps written into the mailbox for events helps the Managed Folder Assistant track when retention events happen and for how long the assistant should enforce the effect of the event, if necessary. For instance, if a hold is released from a mailbox, a delay hold stops items being deleted for 30 days to make sure that information isn’t immediately deleted and that administrators can recover if a hold is released in error.
Compliance Events
Without any formal Microsoft documentation, it’s hard to be precise about what each event means and how the timestamps are used by the Managed Folder Assistant. According to Copilot, the following events are recorded:
| Event | Event meaning |
| 1 | Retention hold applied to pause retention processing |
| 2 | Retention hold removed to allow normal retention processing to resume |
| 3 | Litigation hold enforced on mailbox |
| 4 | Litigation hold lifted from mailbox |
| 5 | Delay hold applied (grace period before items are removed) |
| 6 | Delay hold removed |
| 7 | Microsoft 365 retention policy applied to mailbox |
| 8 | Microsoft 365 retention policy removed from mailbox |
| 9 | Retention tag (label) applied to mailbox item |
| 10 | Retention tag (label) removed from mailbox item(s) |
| 11 | Calendar logging disabled |
| 12 | Calendar logging enabled |
| 13 | Mailbox audit enabled |
| 14 | Mailbox audit disabled |
| 15 | Single item recovery disabled |
| 16 | Single item recovery enabled |
| 17 | eDiscovery hold applied to mailbox |
| 18 | eDiscovery hold removed from mailbox |
| 26 | Legacy eDiscovery hold removed from mailbox |
I can’t testify to the accuracy of this information. Even after performing several actions on a mailbox, such as setting litigation hold on and off, or disabling single item recovery, nothing changed in the property. It might be that the Managed Folder Assistant must process the mailbox before the event information is updated. I tried that too by running the Start-ManagedFolderAssistant cmdlet, but nothing happened. Perhaps a specific parameter is required.
In any case, I wrote a script to report the EnforcedTimeStamps information for user mailboxes. You can download the script from GitHub. Figure 1 shows the output. One piece of information I found is that Exchange Online has recorded this information since at least May 2020, so obviously I haven’t been too observant (or curious) in the interim period.
An Exchange Online Secret
It’s always interesting (if a touch frustrating at times) to try and track down undocumented corners of Microsoft 365. I’m sure Microsoft will say that tenants don’t need to understand the function of the EnforceTimeStamps property and they’re probably right. But if that’s the case, why don’t they hide the information deep in the non-IPM part of the mailbox where lots of other internal information is stuffed away?
Learn how to exploit the data available to Microsoft 365 tenant administrators through the Office 365 for IT Pros eBook. We love figuring out how things work.