In Praise of Inactivity - Why Exchange Online inactive mailboxes are so valuable
Inactive mailboxes are only available inside Exchange Online and don’t exist outside Office 365. Litigation or in-place holds keep inactive but soft-deleted mailboxes in a state in which their data is easily accessible for compliance and recordkeeping purposes. Don’t let that hold go, though, because if you do, inactive mailboxes will disappear faster than you might think.
Say Goodbye to Traditional PC Lifecycle Management
Traditional IT tools, including Microsoft SCCM, Ghost Solution Suite, and KACE, often require considerable custom configurations by T3 technicians (an expensive and often elusive IT resource) to enable management of a hybrid onsite + remote workforce. In many cases, even with the best resources, organizations are finding that these on-premise tools simply cannot support remote endpoints consistently and reliably due to infrastructure limitations.
I wonder whether the Microsoft folks who made the decision to introduce the inactive mailboxes feature to Office 365 had any notion of quite how important and popular the feature might be. What’s for sure is that inactive mailboxes are used extensively and have become the lynchpin of Microsoft’s “bring the data home” campaign because they provide customers with a no-cost method to retain legacy data for as long as required.
Inactive mailboxes are very much a creature of the cloud, where accounts are licensed and paid for on a monthly basis. They don’t exist on-premises because they are not required. No one except the administrators of an on-premises Exchange organization dictate how long mailboxes are retained after an employee leaves the company or passes on. It’s a sad fact of life that the death of an employee is something that companies have to deal with, including the retention of important corporate information that might exist in their mailbox.
How Inactive Mailboxes Work
The basics of inactive mailboxes are simple. An Office 365 account is created as usual and a license that includes Exchange Online is assigned to the account. Data accrues in the mailbox (primary and/or archive) through normal user activity or through a deliberate migration action such as importing a legacy email archive or PSTs. The next step is to place a litigation hold (sometimes called a legal hold) or in-place hold on the mailbox to ensure that content cannot be removed.
The big difference between a litigation hold and an in-place hold is that a litigation hold preserves everything in a mailbox, whereas an in-place hold is associated with a search that determines what content is preserved. Of course, the search used for an in-place hold could cover everything in a mailbox, in which case its effect is equivalent to a litigation hold. Both types of hold support time-based retention, which means that the information subject to the hold is retained for a set period. After the hold period expires, the information is removed from the mailbox.
The default hold period is unlimited, which means that content is held indefinitely. To set an indefinite litigation hold, you can run the following PowerShell command (the hold duration can be adjusted afterward):
[PS] C:\> Set-Mailbox -Identity TRedmond -LitigationHoldEnabled $True
After the hold is established, the Office 365 account associated with the mailbox is then deleted, which releases the requirement to pay for an Office 365 license. However, because a hold is in place, Exchange Online recognizes that it cannot delete the mailbox and therefore regards it as being inactive. In technical terms, the mailbox is “soft deleted” in whatever database it belongs to, which means that the data in the mailbox remains intact and the mailbox can be recovered if necessary. If the hold is subsequently removed, the mailbox is hard-deleted and permanently removed from the database.
To confirm which inactive mailboxes exist within a tenant, you can run the following PowerShell command:
[PS] C:\> Get-Mailbox -InactiveMailboxOnly
Because it doesn’t appear in Exchange Online address lists, an inactive mailbox effectively disappears from the sight of other users. In addition, new mail can’t be delivered to an inactive mailbox. However, all of the data held in inactive mailboxes remains indexed and available in Exchange databases. As such, the inactive mailboxes are fully discoverable and data can be recovered from the mailboxes through eDiscovery searches (both Exchange Online searches and the content searches that are managed through the Office 365 Security and Compliance Center).
Recovering or Restoring Inactive Mailboxes
The most obvious use for inactive mailboxes is to preserve information in the mailboxes of employees who leave an organization. An inactive mailbox can be restored to good health in two ways. First, you can recover data from an inactive mailbox and make it a fully functional mailbox again. A new mailbox is created using the content of the inactive mailbox. When this happens, the inactive mailbox is removed from the system. You might use this method if you wanted to provide a new employee with the information that a previous employee who held their responsibilities had accumulated. Typically, the new employee would review the recovered information and discard anything that is not useful. Recovery of an inactive mailbox also accommodates the scenario when someone who has left the organization returns because they’ve discovered that the grass is not greener on the other side of the hill.
The second approach to is restore an inactive mailbox to an existing mailbox. In effect, this is a merge of the content held in the inactive mailbox with the content that already exists in another mailbox. To avoid confusion between the items that were present before the merge and the set introduced by the merge, you can specify a target folder to act as the root for the merged items. If you don’t do this, the items from the inactive mailbox are merged into folders that exist in the target mailbox. For instance, any items in the Inbox in the inactive mailbox will be moved into the Inbox in the target mailbox. As you can imagine, the result is likely to be confusing, so it’s usually best to make sure that a target folder is specified for the merge.
The big difference between the two methods is that the inactive mailbox is retained after a restore.
Using Inactive Mailboxes as Targets for Legacy Email Archive Migrations
As noted in another article, moving legacy email archive data into Office 365 to form one cohesive repository can be challenging. Inactive mailboxes can play a role in imports because it is possible to use regular mailboxes as the target for ingestion of data from legacy archives and then, once the import is validated to be successful, to transform those mailboxes into inactive mailboxes.
Microsoft definitely did not have such an approach in mind when they made inactive mailboxes available within Office 365. However, it’s a fact of life that legacy email archive data has been extracted from systems such as Veritas Enterprise Vault and now resides quite happily inside inactive mailboxes. The danger of using inactive mailboxes in this way is that an administrator might inadvertently remove the hold that preserves their status and so give Exchange Online the signal to hard-delete the mailboxes. Remember, Microsoft uses Native Data Protection for Exchange Online and doesn’t have backups, so once a mailbox is hard-deleted, it stays deleted and cannot be recovered. For this reason, shared mailboxes are the preferred target for migrations of this kind.
Will Microsoft Charge for Inactive Mailboxes?
Some commentators have speculated that Microsoft will backtrack on their current stance and attempt to impose licensing for inactive mailboxes. Although nothing is certain, I think that this course of action is unlikely. Forcing tenants to pay even a nominal license for inactive mailboxes would be horribly unpopular with customers. The inevitable pushback would probably make whatever revenue is generated unpalatable for Microsoft.
In any case, although they might have to pay for the storage required for inactive mailboxes, it’s a minor rounding error in the context of Office 365. In addition, the more data that customers have within Office 365, the less likely they are to move anywhere else because of the cost and complexity involved in exporting data from multiple Office 365 repositories.
It’s easy to transform “real” mailboxes into inactive mailboxes by putting them on hold and deleting the associated Office 365 account. It’s also relatively straightforward to recover or restore an inactive mailbox. On the downside it’s equally easy to forget why a hold exists and remove it, causing some inactive mailboxes to be deleted. But overall, when used and managed properly, inactive mailboxes provide significant functionality to Office 365 tenants by allowing the data they contain to be retained ad infinitum without incurring the cost of even the most basic Office 365 license.
Follow Tony on Twitter: @12Knocksinna.
Want to know more about how to manage Office 365? Find what you need to know in “Office 365 for IT Pros”, the most comprehensive eBook covering all aspects of Office 365. Available in PDF and EPUB formats (suitable for iBooks) or for Amazon Kindle.