Thursday, March 8, 2018

Extending Exchange Online Deleted Items retention period

Many people are unaware of the fact that ALL (yes, I said ALL) Exchange Online plans are configured by default, to ONLY retain deleted items for 14 days. Yes, I said ALL Exchange Online plans, and I quote:

“How long deleted items are kept in the Deletions folder depends on the deleted item retention period that is set for the mailbox. An Exchange Online mailbox keeps deleted items for 14 days, by default. Use the Exchange Management Shell, as shown above, to change this setting, to increase the period up to a maximum of 30 days.”

this is from:

https://technet.microsoft.com/en-us/library/dn163584(v=exchg.160).aspx

You will also note that you can extend this to a maximum of 30 days using PowerShell, which is exactly what you should do IMMEDIATLY you add a user account I would suggest.

To do this you firstly need to connect to Exchange Online using PowerShell. Then to view the current retention periods run the following:

image

that should then display something like:

image

As you can see from the above, all the mailboxes listed are currently only set to a MAXIMUM of 14 days for retention (which is the default).

To extend this to the maximum of 30 days for ALL plans, execute the following command:

image

Now when you re-examine all the deletion period for all mailboxes you should see:

image

they have all been extended to the maximum of 30 days, which should make everyone much happier and provide you the ability to recovered deleted email data out to the maximum period of 30 days for ALL plans. After 30 days however, the deleted data will still be purged and unrecoverable.

If you wish to retain deleted email data beyond the maximum 30 days that can be provisioned generally you’ll need to add the legal hold service to the mailbox and ENABLE it! The legal hold service is available on Exchange Online Plan 2 mailboxes, E3 and E5 suites typically.

To my way of thinking, extending the deleted item retention period of all mailboxes in a tenant is something that should be done immediately and using the above PowerShell commands it is really easy to do. So there should be NO excuse!