Manage journaling in Exchange Online

Article
02/22/2023

This article shows you how to perform basic tasks related to managing the older compliance feature of journaling in Exchange Online. They're necessary only if you have to store email outside Exchange Online. Make sure you're aware of the limitations and considerations of this older feature before you configure any new journaling rules.

What do you need to know before you begin?

Estimated time to complete each procedure: 5 minutes.
You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the "Journaling" entry in the Feature permissions in Exchange Online article.
Currently, you can use either the Microsoft Purview compliance portal or the Classic Exchange admin center (EAC) to manage journaling in Exchange Online.
You need to have a journaling mailbox and an alternate journaling mailbox configured. For more information, see Configure Journaling in Exchange Online.
In Exchange Online, there's a limit to the number of journal rules that you can create. For details, see Journal, Transport, and Inbox rule limits.

Tip

Having problems? Ask for help in the Exchange forums. Visit the forums at Exchange Online or Exchange Online Protection. If you're having trouble with the JournalingReportDNRTo mailbox, see Transport and Mailbox Rules in Exchange Online don't work as expected.

Create a journal rule

Important

If your organization is set up in a hybrid deployment, you must configure any journaling rules twice; once in on-premises Exchange Server and an identical rule in Exchange Online. If you don't, some messages might not be journaled.

Use the Purview compliance portal to create a journal rule

In the Microsoft Purview compliance portal, navigate to Solutions > Data lifecycle management > Exchange (legacy) > Journal rules, and then select + New rule.
On the Define journal rule settings page, provide a name for the journal rule and then complete the following fields:
- Send journal reports to: Type the address of the journaling mailbox that will receive all the journal reports.
  
  Note
  
  You can also type the display name or alias of a mail user or a mail contact as the journal mailbox. In this case, journal reports will be sent to the external email address of the mail user or mail contact. But as previously explained, the external email address of a mail user or mail contact can't be the address of an Exchange Online mailbox.
- Journal rule name: Enter the name of this new journal rule.
- Journal messages sent or received from: Specify the recipient that the rule will target. You can either apply the rule to all messages, or select a specific recipient.
- Type of message to journal: Specify the scope of the journal rule. You can journal all messages regardless of origin or destination, internal messages only, or external messages only.
Select Next, review the settings, and then Submit to create the journal rule.

Use the classic EAC to create a journal rule

In the Classic EAC, navigate to Compliance management > Journal rules, and then click Add .
In Journal rule, provide a name for the journal rule and then complete the following fields:
- If the message is sent to or received from: Specify the recipient that the rule will target. You can either select a specific recipient or apply the rule to all messages.
- Journal the following messages: Specify the scope of the journal rule. You can journal only the internal messages, only the external messages, or all messages regardless of origin or destination.
- Send journal reports to: Type the address of the journaling mailbox that will receive all the journal reports.
  
  Note
  
  You can also type the display name or alias of a mail user or a mail contact as the journal mailbox. In this case, journal reports will be sent to the external email address of the mail user or mail contact. But as previously explained, the external email address of a mail user or mail contact can't be the address of an Exchange Online mailbox.
Click Save to create the journal rule.

Use Exchange Online PowerShell to create a journal rule

This example creates the journal rule Discovery Journal Recipients to journal all messages sent from and received by the recipient user1@contoso.com.

New-JournalRule -Name "Discovery Journal Recipients" -Recipient user1@contoso.com -JournalEmailAddress "Journal Mailbox" -Scope Global -Enabled $True

How do you know this worked?

To verify that you have successfully created the journal rule, do one of the following:

From the admin portal you used to create the journaling rule, verify that the new journal rule you created is listed on the Journal rules tab.
From Exchange Online PowerShell, verify that the new journal rule exists by running the following command (the example below verifies the rule created in Exchange Online PowerShell example above):
```
Get-JournalRule -Identity "Discovery Journal Recipients"
```

View or modify a journal rule

Use the Purview compliance portal to view or modify a journal rule

In the Microsoft Purview compliance portal, navigate to Solutions > Data lifecycle management > Exchange (legacy) > Journal rules.
In the list view, you'll see all the journal rules in your organization.
Select the rule you want to view or modify, and select Edit.
On the Define journal rule settings page, modify the settings you want, select Next, and Submit. For more information about the settings, see the previous procedure to create a journal rule.

Use the classic EAC to view or modify a journal rule

Sign in to the Classic EAC and navigate to Compliance management > Journal rules.
In the list view, you'll see all the journal rules in your organization.
Double-click the rule you want to view or modify.
In Journal Rule, modify the settings you want. For more information about the settings in this dialog box, see the previous procedure to create a journal rule.

Use Exchange Online PowerShell to view or modify a journal rule

This example displays a summary list of all journal rules in the Exchange organization:

Get-JournalRule

This example retrieves the journal rule Brokerage Journal Rule, and pipes the output to the Format-List command to display rule properties in a list format:

Get-JournalRule -Identity "Brokerage Journal Rule" | Format-List

If you want to modify the properties of a specific rule, you need to use the Set-JournalRule cmdlet. This example changes the name of the journal rule JR-Sales to TraderVault. The following rule settings are also changed:

Recipient
JournalEmailAddress
Scope

Set-JournalRule -Identity "JR-Sales" -Name TraderVault -Recipient traders@woodgrovebank.com -JournalEmailAddress tradervault@woodgrovebank.com -Scope Internal

How do you know this worked?

To verify that you have successfully modified a journal rule, do one of the following:

From the admin portal where you modified the journal rule, on the Journal rules tab, double-click the rule you modified and verify your changes were saved.
From Exchange Online PowerShell, verify that you modified the journal rule successfully by running the following command. This command will list the properties you modified along with the name of the rule (the example below verifies the rule modified in Exchange Online PowerShell example above):
```
Get-JournalRule -Identity "TraderVault" | Format-List Name,Recipient,JournalEmailAddress,Scope
```

Enable or disable a journal rule

Important

When you disable a journal rule, the journaling agent will stop journaling messages targeted by that rule. While a journal rule is disabled, any messages that would have normally been journaled by the rule aren't journaled. Make sure that you don't compromise the regulatory or compliance requirements of your organization by disabling a journaling rule.

Use the Microsoft Purview compliance portal to enable or disable a journal rule

In the Microsoft Purview compliance portal, navigate to Solutions > Data lifecycle management > Exchange (legacy) > Journal rules.
In the list view, next to the rule's name, select the check box and then select Disable or Enable to enable the rule or disable the rule.

Use the classic EAC to enable or disable a journal rule

In the Classic EAC, navigate to Compliance management > Journal rules.
In the list view, in the On column next to the rule's name, select the check box to enable the rule or clear it to disable the rule.

Use Exchange Online PowerShell to enable or disable a journal rule

This example enables the rule Contoso.

Enable-JournalRule -Identity "Contoso Journal Rule"

This example disables the rule Contoso.

Disable-JournalRule -Identity "Contoso Journal Rule"

How do you know this worked?

To verify that you have successfully enabled or disabled a journal rule, do one of the following:

From the Microsoft Purview compliance portal, view the list of journal rules and use the Status column to confirm whether the rule is enabled (On) or disabled (Off).
From the Classic EAC, view the list of journal rules check the status of the check box in the On column.
From Exchange Online PowerShell, run the following command to return a list of all journal rules in your organization along, including their status:
```
Get-JournalRule | Format-Table Name,Enabled
```

Remove a journal rule

Use the Microsoft Purview compliance center to remove a journal rule

In the Microsoft Purview compliance portal, navigate to Solutions > Data lifecycle management > Exchange (legacy) > Journal rules.
In the list view, select the rule you want to remove, and then select Delete.

Use the classic EAC to remove a journal rule

In the Classic EAC, navigate to Compliance management > Journal rules.
In the list view, select the rule you want to remove, and then click Delete .

Use Exchange Online PowerShell to remove a journal rule

This example removes the rule Brokerage Journal Rule.

Remove-JournalRule -Identity "Brokerage Journal Rule"

How do you know this worked?

To verify that you have successfully removed the journal rule, do one of the following:

From the admin portal you used, verify that the rule you removed is no longer listed on the Journal rules tab after you've refreshed the page.
From Exchange Online PowerShell, run the following command to verify that the rule you removed is no longer listed:
```
Get-JournalRule
```