Email retention in Microsoft 365: why a mailbox fills up despite the policies
A retention policy in Microsoft Purview and an MRM retention policy in Exchange Online are two different mechanisms, and confusing them is the most common cause of full mailboxes. What each one does, where the space really goes, and how to check it with commands.
Guide Company email Part 4 of 4
- SPF, DKIM and DMARC: a rollout order that does not block your own mail
- Applications that send over plain SMTP: Microsoft 365 options and a local relay
- Quarantine in Exchange Online: who sees a held message and who can release it
- Email retention in Microsoft 365: why a mailbox fills up despite the policies
The customer service team’s shared mailbox approaches its limit, users get warnings, and the administrator is convinced the problem was solved a year ago, because “there is a seven-year retention policy”. The policy exists and works correctly. That is exactly why the usage does not go down: the policy retains every deleted message, and nothing moves older mail to the archive.
In Microsoft 365, mail retention is handled by two mechanisms with similar names and different purposes. A full mailbox despite the policies almost always means one of them is missing, or that a hold is filling a folder the user cannot see.
Two mechanisms with similar names
Retention policies in Microsoft Purview are a compliance tool. They answer the question of how long data must exist and when it may be deleted. They can retain items for a period, delete them after a period, or both. They do not move anything to the archive.
MRM retention policies in Exchange Online (Messaging Records Management) are a mailbox housekeeping tool. They consist of tags, and each tag says what to do with an item after a period: move it to the archive (MoveToArchive) or delete it. A default policy tag (type All) covers the whole mailbox; a retention policy tag covers one default folder, for example Recoverable Items. The policies are applied by the Managed Folder Assistant, which processes each mailbox on a cycle, usually once every few days.
The default MRM policy, assigned to new mailboxes, contains two tags that matter for mailbox size:
Connect-ExchangeOnline
Get-RetentionPolicy -Identity 'Default MRM Policy' |
Select-Object -ExpandProperty RetentionPolicyTagLinks
Get-RetentionPolicyTag |
Where-Object RetentionAction -eq 'MoveToArchive' |
Format-Table Name, Type, RetentionAction, AgeLimitForRetentionName Type RetentionAction AgeLimitForRetention
---- ---- --------------- --------------------
Default 2 year move to archive All MoveToArchive 730.00:00:00
Recoverable Items 14 days move to archive RecoverableItems MoveToArchive 14.00:00:00The first tag moves items older than two years to the archive; the second moves the contents of Recoverable Items after fourteen days. Both work only when the mailbox has an archive enabled.
Purview policies covering Exchange are read in a separate session, in Security & Compliance PowerShell:
Connect-IPPSSession
Get-RetentionCompliancePolicy | Format-Table Name, Enabled, ExchangeLocation
Get-RetentionComplianceRule -Policy 'Mail 7 years' |
Format-List RetentionDuration, RetentionComplianceActionExchangeLocation set to All means a policy for every mailbox, and a RetentionComplianceAction of Keep or KeepAndDelete means a hold: from then on, a user deleting a message frees no space.
| Goal | Mechanism |
|---|---|
| Relieve the primary mailbox by moving older mail | an MRM tag with the MoveToArchive action and an enabled archive |
| Keep mail for a set period for legal reasons | a Purview retention policy with a retain action |
| Delete mail after a set period | a Purview policy with a delete action, or an MRM tag with a delete action |
| Preserve all of one person’s mail during a dispute | Litigation Hold or an eDiscovery case hold |
| Let users recover deleted items | the deleted item retention period (RetainDeletedItemsFor, 14 days by default, 30 at most) |
| Accommodate an archive larger than 100 GB | auto-expanding archiving |
| Empty Recoverable Items while a hold applies | an MRM tag of type RecoverableItems with the MoveToArchive action, and an enabled archive |
Online archive and auto-expanding archiving
The online archive is a second mailbox linked to the primary one. With an Exchange Online Plan 2 licence (also as part of Microsoft 365 E3 and E5) it has 100 GB, and with auto-expanding archiving enabled it grows to 1.5 TB. The archive is enabled with a command that changes the mailbox state immediately:
Enable-Mailbox -Identity service@example.com -Archive
# Irreversible: auto-expanding archiving cannot be switched off later
Enable-Mailbox -Identity service@example.com -AutoExpandingArchiveEnabling the archive moves nothing by itself. The archive is filled by the Managed Folder Assistant according to MRM tags, or by the user dragging folders by hand. After assigning a policy or enabling the archive, processing can be requested straight away: Start-ManagedFolderAssistant -Identity service@example.com. A large mailbox needs several passes, so the effect shows after a few days, not an hour.
An unlicensed shared mailbox has a 50 GB limit. An archive, auto-expanding archiving and Litigation Hold all require assigning it a licence with the appropriate Exchange Online plan or the Exchange Online Archiving add-on.
Recoverable Items and holds
Every mailbox has a Recoverable Items folder, invisible in the client’s normal view. It receives items deleted from Deleted Items and hard-deleted items, and, when the mailbox is on hold, copies of modified and deleted items as well. The subfolders show where the space comes from: Deletions holds ordinary deletions, Purges items removed from the recovery view, Versions copies of changed items, and DiscoveryHolds items preserved by a hold.
A hold is a Purview policy with a retain action, Litigation Hold (LitigationHoldEnabled), an eDiscovery hold, or a retention label applied to an item. The folder has its own quota: RecoverableItemsQuota is 30 GB by default and is raised to 100 GB when the mailbox is placed on hold. Once the quota is exceeded the user cannot delete items, and the DiscoveryHolds subfolder can grow to tens of gigabytes.
Design rules
- Purview is responsible for how long data must exist; MRM is responsible for where it sits in the mailbox. The two are designed separately and documented together.
- Every mailbox on hold has an enabled archive and an MRM policy with a tag of type
RecoverableItems. - Organisation-wide Purview policies are reviewed for mailboxes that do not need them, for example system mailboxes full of notifications.
- Mailbox and Recoverable Items usage is monitored, with an alert at 80 percent of the quota, not at the first rejected message.
Check your own environment
The twenty largest mailboxes with their Recoverable Items size (TotalDeletedItemSize), converted to gigabytes so that sorting is numeric:
Get-EXOMailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox, SharedMailbox |
Get-EXOMailboxStatistics |
Select-Object DisplayName,
@{ n = 'TotalGB'; e = { [math]::Round(([long]("$($_.TotalItemSize)" -replace '^.*\(|[^\d]', '')) / 1GB, 1) } },
@{ n = 'DeletedGB'; e = { [math]::Round(([long]("$($_.TotalDeletedItemSize)" -replace '^.*\(|[^\d]', '')) / 1GB, 1) } } |
Sort-Object TotalGB -Descending | Select-Object -First 20A mailbox whose DeletedGB approaches 30 or 100 has a Recoverable Items problem, not an ordinary mail problem. A TotalGB close to 50 on a shared mailbox means the unlicensed limit is near.
Holds, MRM policy and archive status for a single mailbox:
Get-Mailbox -Identity service@example.com |
Format-List LitigationHoldEnabled, InPlaceHolds, ComplianceTagHoldApplied, DelayHoldApplied,
RetentionPolicy, ArchiveStatus, AutoExpandingArchiveEnabled, RecoverableItemsQuota, RetainDeletedItemsFor
Get-OrganizationConfig | Format-List InPlaceHoldsA non-empty InPlaceHolds (identifiers prefixed with mbx are Purview policies, those prefixed with UniH are eDiscovery holds) or LitigationHoldEnabled set to True means a hold. A hold with ArchiveStatus set to None is a recipe for a full Recoverable Items folder.
How Recoverable Items breaks down into subfolders:
Get-MailboxStatistics -Identity service@example.com |
Format-List DisplayName, TotalItemSize, TotalDeletedItemSize, ItemCount
Get-MailboxFolderStatistics -Identity service@example.com -FolderScope RecoverableItems |
Format-Table Name, FolderAndSubfolderSize, ItemsInFolderAndSubfoldersIf DiscoveryHolds or Versions dominates, the cause is a hold. If Deletions dominates, users delete a lot and the move-to-archive tag is not working. The -Archive parameter gives the same breakdown for the archive.
The date of the Managed Folder Assistant’s last successful run on the mailbox:
$log = Export-MailboxDiagnosticLogs -Identity service@example.com -ExtendedProperties
([xml]$log.MailboxLog).Properties.MailboxTable.Property |
Where-Object Name -like 'ELC*' | Format-Table Name, ValueAn ELCLastSuccessTimestamp a few days old is normal. A date several weeks old means the mailbox is not being processed and the MRM tags are not working, whatever their configuration shows.