Hello everyone, We have some emails from a specific senders, that users sharing a shared mailbox deleted. The problem is when we needed the said email, more than 30 days had passed so we couldn't recover it. I tried searching online and got confused over Retention policies and tags and thought of asking here. My goal is not to place the whole mailbox in a Retention policy (as the emails from the sender we want to preserve sends to multiple shared mailboxes), but rather make these emails able to recovered even after 1 year. It would also help if I could disable the "purge" option from the deleted folder but this for another issue. So any of you can share a detail explanation of how to achieve this? Thank you all in advance.

The easiest solution is to place the shared mailbox on hold. Microsoft 365 retention policies can be used to achieve the same, and allow more customizability, but are a bit harder to configure. As for disabling the "purge" option, there is no way to do that for a user that has been granted Full access permissions. You will be able to restrict it if you leverage folder-level permissions instead, but that's a hassle to configure. Also have in mind that both litigation hold and retention policies require Exchange Online Plan 2 license on the mailbox.

Retain emails from a specific sender in the Recovered Folder for more than 30 days

Accepted answer

Vasil Michev 97,231 Reputation points MVP

2024-05-15T06:51:02.5233333+00:00

The easiest solution is to place the shared mailbox on hold. Microsoft 365 retention policies can be used to achieve the same, and allow more customizability, but are a bit harder to configure.

As for disabling the "purge" option, there is no way to do that for a user that has been granted Full access permissions. You will be able to restrict it if you leverage folder-level permissions instead, but that's a hassle to configure.

Also have in mind that both litigation hold and retention policies require Exchange Online Plan 2 license on the mailbox.
Please sign in to rate this answer.

1 person found this answer helpful.
Αγριανίτης, Νίκος 20 Reputation points

2024-05-15T07:04:17.3066667+00:00

From what I've searched online, I figured the best approach would be the In-Place Hold, add the shared mailboxes I need to apply it, add the sender and I'm just having a little trouble configuring the subject:"string" with the KQL syntax..

We have Exchange Online Plan 2 , so it won't be a problem

Vasil Michev 97,231 Reputation points MVP

2024-05-15T07:18:57.8+00:00

In-place hold is just the "targeted" version of lithold, but yes, it will also work. I'd still recommend putting the whole mailbox on hold, but if that's not something you want to do, either In-place hold or Microsoft 365 retention policy would do. Do make sure you are specific with your query though, as otherwise messages will not be retained.

Here's the list of keywords you can leverage: https://learn.microsoft.com/en-us/purview/ediscovery-keyword-queries-and-search-conditions#searchable-email-properties

In your scenario, you'd probably want to use something like "from:user@domain.com". Subject is something that will vary from message to message, so be careful if adding such clause.

Αγριανίτης, Νίκος 20 Reputation points

2024-05-15T07:23:42.5866667+00:00

Thanks for the response,

There is a searchbox to add the sender so no syntax is needed there, The subject of the emails I want to retain is always the same, so I guess its I'll make some tests.

One last thing I'd like to clarify, as per Microsoft instructions on setting up In-Place hold:

"On the In-Place Hold settings page, click the Place content matching the search query in selected sources on hold check box and then select one of the following options:

Hold indefinitely: Place items returned by the search on an indefinite hold. Items on hold will be preserved until you change the hold duration, remove the mailbox (or public folders) from the search, or remove the search.

Specify number of days to hold items relative to their received date: Hold items for a specific period. For example, you can use this option if your organization requires that all messages be retained for at least seven years. You can use a time-based In-Place Hold along with a retention policy to make sure items are permanently deleted in seven years. "

It says that that the content of the search is placed in hold. Will this hold also automatically applied on emails that are received after the In-Place Hold is setup?

Or its only applied to current mailbox contents?

Vasil Michev 97,231 Reputation points MVP

2024-05-15T08:40:44.9366667+00:00

It will apply to newly received messages as well. It will not affect any newly created mailboxes however, if that's a requirement you should use M365 retention policies instead.
Sign in to comment

Share via

Retain emails from a specific sender in the Recovered Folder for more than 30 days

0 additional answers