Delete items in the Recoverable Items folder of cloud-based mailboxes on hold

Important

This article applies only to the classic eDiscovery (Premium) experience. The classic eDiscovery (Premium) experience will be retired in August 2025 and won't be available as an experience option in the Microsoft Purview portal after retirement.

We recommend that you start planning for this transition early and start using the new eDiscovery experience in the Microsoft Purview portal. To learn more about using the most current eDiscovery capabilities and features, see Learn about eDiscovery.

The Recoverable Items folder for an Exchange Online mailbox exists to protect from accidental or malicious deletions. It's also used to store items that are retained and accessed by compliance features, such as holds and eDiscovery searches. However, in some situations organizations might have data that's been unintentionally retained in the Recoverable Items folder that they must delete. For example, a user might unknowingly send or forward an email message that contains sensitive information or information that may have serious business consequences. Even if the message is permanently deleted, it might be retained indefinitely because a legal hold has been placed on the mailbox. This scenario is known as data spillage because data has been unintentionally spilled into Office 365. In these situations, you can delete items in a user's Recoverable Items folder for an Exchange Online mailbox, even if that mailbox is placed on hold with one of the different hold features in Office 365. These types of holds include Litigation Holds, In-Place Holds, eDiscovery holds, and retention policies created in the Microsoft Purview portal.

This article explains how admins can delete items from the Recoverable Items folder for cloud-based mailboxes that are on hold. This procedure involves disabling access to the mailbox and disabling single item recovery, disabling the Managed Folder Assistant from processing the mailbox, temporarily removing the hold, deleting items from the Recoverable Items folder, and then reverting the mailbox to its previous configuration. Here's the process:

Step 1: Collect information about the mailbox

Step 2: Prepare the mailbox

Step 3: Remove all holds from the mailbox

Step 4: Remove the delay hold from the mailbox

Step 5: Delete items in the Recoverable Items folder

Step 6: Revert the mailbox to its previous state

Caution

The procedures outlined in this article will result in data being permanently deleted (purged) from an Exchange Online mailbox. That means messages that you delete from the Recoverable Items folder can't be recovered and won't be available for legal discovery or other compliance purposes. If you want to delete messages from a mailbox that's placed on hold as part of a Litigation Hold, In-Place Hold, eDiscovery hold, or retention policy created in the Microsoft Purview portal, check with your records management or legal departments before removing the hold. Your organization might have a policy that defines whether a mailbox on hold or a data spillage incident takes priority.

Tip

If you're not an E5 customer, use the 90-day Microsoft Purview solutions trial to explore how additional Purview capabilities can help your organization manage data security and compliance needs. Start now at the Microsoft Purview trials hub. Learn details about signing up and trial terms.

Before you delete items

• To create and run a Content Search, you have to be a member of the eDiscovery Manager role group or be assigned the Compliance Search management role. To delete messages, you have to be a member of the Organization Management role group or be assigned the Search And Purge management role. For information about adding users to a role group, see Assign eDiscovery permissions.
• If a mailbox is assigned to an organization-wide retention policy, you have to exclude the mailbox from the policy before you can delete items from the Recoverable Items folder. It may take up to 24 hours to synchronize the policy change, and remove the mailbox from the policy. For more information, see "Organization-wide retention policies" in the Remove all holds from the mailbox section in this article.
• You can't perform this procedure for a mailbox that has been assigned retention settings with a retention policy that's locked by using Preservation Lock. That's because this lock prevents you from removing or excluding the mailbox from the policy and from disabling the Managed Folder Assistant on the mailbox. For more information about locking policies for retention,see Use Preservation Lock to restrict changes to retention policies and retention label policies.
• The procedure described in this article isn't supported for inactive mailboxes. That's because you can't reapply a hold (or retention policy) to an inactive mailbox after you remove it. When you remove a hold from an inactive mailbox, it's changed to a normal soft-deleted mailbox and will be permanently deleted from your organization after it's processed by the Managed Folder Assistant.
• If a mailbox isn't placed on hold (or doesn't have single item recovery enabled), you can delete the items from the Recoverable Items folder. For more information about how to do this, see Search for and delete email messages in your organization.

Step 1: Collect information about the mailbox

This first step is to collect selected properties from the target mailbox that will affect this procedure. Be sure to write down these settings or save them to a text file because you'll change some of these properties and then revert back to the original values in Step 6, after you delete items from the Recoverable Items folder. Here's a list of the mailbox properties you need to collect.

• SingleItemRecoveryEnabled and RetainDeletedItemsFor. If necessary, you'll disable single recovery and increase the deleted items retention period in Step 3.
• LitigationHoldEnabled and InPlaceHolds. You need to identify all the holds placed on the mailbox so that you can temporarily remove them in Step 3. See the More information section for tips about how to identify the type hold that might be placed on a mailbox.

Additionally, you need to get the mailbox client access settings so you can temporarily disable them so the owner (or other users) can't access the mailbox during this procedure. Finally, you can get the current size and number of items in the Recoverable Items folder. After you delete items in the Recoverable Items folder in Step 5, you'll use this information to verify that items were removed.

1. Connect to Exchange Online PowerShell. Be sure to use a user name and password for an administrator account that's been assigned the appropriate management roles in Exchange Online.

2. Run the following command to get information about single item recovery and the deleted item retention period.

   Get-Mailbox <username> | FL SingleItemRecoveryEnabled,RetainDeletedItemsFor
   

   If single item recovery is enabled, you'll have to disable it in Step 2. If the deleted item retention period isn't set for 30 days (the maximum value in Exchange Online), then you can increase it in Step 2.

3. Run the following command to get the mailbox access settings for the mailbox.

   Get-CASMailbox <username> | FL EwsEnabled,ActiveSyncEnabled,MAPIEnabled,OWAEnabled,ImapEnabled,PopEnabled
   

   You'll disable all of these access methods in Step 2.

4. Run the following command to get information about the holds and retention policies applied to the mailbox.

   Get-Mailbox <username> | FL LitigationHoldEnabled,InPlaceHolds
   

   Tip

   If there are too many values in the InPlaceHolds property and not all of them are displayed, you can run the Get-Mailbox <username> | Select-Object -ExpandProperty InPlaceHolds command to display each value on a separate line.

5. Run the following command to get information about any organization-wide retention policies.

   Get-OrganizationConfig | FL InPlaceHolds
   

   If your organization has any organization-wide retention policies, you'll have to exclude the mailbox from these policies in Step 3. It may take up to 24 hours to replicate the change.

   Tip

   If there are too many values in the InPlaceHolds property and not all of them are displayed, you can run the Get-OrganizationConfig | Select-Object -ExpandProperty InPlaceHolds command to display each value on a separate line.

6. Run the following command to determine if a delay hold is applied to the mailbox.

   Get-Mailbox <username> | FL DelayHoldApplied,DelayReleaseHoldApplied
   

   If the value of the DelayHoldApplied or DelayReleaseHoldApplied property is set to True, a delay hold is applied to the mailbox and must be removed. For more information about delay holds, see Step 4: Remove the delay hold from the mailbox.

   If the value of either properties is set to False, a delay hold isn't applied to the mailbox, and you can skip Step 4.

7. Run the following command to get the current size and total number of items in folders and subfolders in the Recoverable Items folder in the user's primary mailbox.

   Get-MailboxFolderStatistics <username> -FolderScope RecoverableItems | FL Name,FolderAndSubfolderSize,ItemsInFolderAndSubfolders
   

   If the user's archive mailbox is enabled, run the following command to get the size and total number of items in folders and subfolders in the Recoverable Items folder in their archive mailbox.

   Get-MailboxFolderStatistics <username> -FolderScope RecoverableItems -Archive | FL Name,FolderAndSubfolderSize,ItemsInFolderAndSubfolders
   

   When you delete items in Step 5, you can choose to delete or not delete items in the Recoverable Items folder in the user's primary archive mailbox. If auto-expanding archiving is enabled for the mailbox, items in an auxiliary archive mailbox won't be deleted.

Step 2: Prepare the mailbox

After collecting and saving information about the mailbox, the next step is to prepare the mailbox by performing the following tasks:

• Disable client access to mailbox so that the mailbox owner can't access their mailbox and make any changes to the mailbox data during this procedure.
• Increase the deleted item retention period to 30 days (the maximum value in Exchange Online) so that items aren't purged from the Recoverable Items folder before you can delete them in Step 5.
• Disable single Item recovery so that items won't be retained (for the duration of the deleted item retention period) after you delete them from the Recoverable Items folder in Step 5.
• Disable the Managed Folder Assistant so that it doesn't process the mailbox and retain the items that you delete in Step 5.

Perform the following steps in Exchange Online PowerShell.

1. Run the following command to disable all client access to the mailbox. The command syntax assumes that all client access methods were enabled on the mailbox.

   Set-CASMailbox <username> -EwsEnabled $false -ActiveSyncEnabled $false -MAPIEnabled $false -OWAEnabled $false -ImapEnabled $false -PopEnabled $false
   

   Note

   It might take up to 60 minutes to disable all client access methods to the mailbox. Note that disabling these access methods won't disconnect the mailbox owner if they are currently signed in. If the owner isn't signed in, they won't be able to access their mailbox after these access methods are disabled.

2. Run the following command to increase the deleted item retention period the maximum of 30 days. This assumes that the current setting is less than 30 days.

   Set-Mailbox <username> -RetainDeletedItemsFor 30
   

3. Run the following command to disable single item recovery.

   Set-Mailbox <username> -SingleItemRecoveryEnabled $false
   

   Note

   It might take up to 240 minutes to disable single item recovery. Don't delete items in the Recoverable Items folder until this period has elapsed.

4. Run the following command to prevent the Managed Folder Assistant from processing the mailbox. As previously explained, you can disable the Managed Folder Assistant only if a retention policy with a Preservation Lock isn't applied to the mailbox.

   Set-Mailbox <username> -ElcProcessingDisabled $true
   

Step 3: Remove all holds from the mailbox

The last step before you can delete items from the Recoverable Items folder is to remove all holds (that you identified in Step 1) placed on the mailbox. All holds must be removed so that items won't be retained after you delete them from the Recoverable Items folder. The following sections contain information about removing different types of holds on a mailbox. See the More information section for tips about how to identify the type hold that might be placed on a mailbox. For more information, see How to identify the type of hold placed on an Exchange Online mailbox.

Caution

As previously stated, check with your records management or legal departments before removing a hold from a mailbox.

Litigation Hold

Run the following command in Exchange Online PowerShell to remove a Litigation Hold from the mailbox.

Set-Mailbox <username> -LitigationHoldEnabled $false

Note

Similar to disabling single item recovery, it might take up to 240 minutes to remove the Litigation Hold. Don't delete items from the Recoverable Items folder until this period has elapsed.

In-Place Hold

Run the following command in Exchange Online PowerShell to identify the In-Place Hold that's placed on the mailbox. Use the GUID for the In-Place Hold that you identified in Step 1.

Get-ComplianceSearch -Identity <hold GUID> | FL Name

After you identify the In-Place Hold, you can use the Exchange admin center (EAC) or Exchange Online PowerShell to remove the mailbox from the hold. For more information, see Create or remove an In-Place Hold.

Retention policies applied to specific mailboxes

Run the following command in Security & Compliance PowerShell to identify the retention policy that is applied to the mailbox. This command will also return any Teams conversation retention policies applied to a mailbox. Use the GUID (not including the mbx or skp prefix) for the retention policy that you identified in Step 1.

Get-RetentionCompliancePolicy <retention policy GUID without prefix> | FL Name

After you identify the retention policy, go to the Data lifecycle management>Microsoft 365>Retention page in the Microsoft Purview portal, edit the retention policy that you identified in the previous step, and remove the mailbox from the list of recipients that are included in the retention policy.

Organization-wide retention policies

Organization-wide, Exchange-wide, and Teams-wide retention policies are applied to every mailbox in the organization. They're applied at the organization level (not the mailbox level) and are returned when you run the Get-OrganizationConfig cmdlet in Step 1. Run the following command in Security & Compliance PowerShell to identify the organization-wide retention policies. Use the GUID (not including the mbx prefix) for the organization-wide retention policies that you identified in Step 1.

Get-RetentionCompliancePolicy <retention policy GUID without prefix> | FL Name

After you identify the organization-wide retention policies, go to the Data lifecycle management>Microsoft 365>Retention page in the Microsoft Purview portal, edit each organization-wide retention policy that you identified in the previous step, and add the mailbox to the list of excluded recipients. Doing this removes the user's mailbox from the retention policy.

Important

After you exclude a mailbox from an organization-wide retention policy, it may take up to 24 hours to synchronize this change and remove the mailbox from the policy.

Retention labels

Whenever a user applies a label that's configured to retain content or retain and then delete content to any folder or item in their mailbox, the ComplianceTagHoldApplied mailbox property is set to True. When this happens, the mailbox is considered to be on hold, as if it was placed on Litigation Hold or assigned to a retention policy.

To view the value of the ComplianceTagHoldApplied property, run the following command in Exchange Online PowerShell:

Get-Mailbox <username> |FL ComplianceTagHoldApplied

After you've identified that a mailbox is on hold because a retention label is applied to a folder or item, you can use the Content search tool in the Microsoft Purview portal to search for labeled items by using the Retention label condition. For more information, see:

• The "Using Content Search to find all content with a specific retention label" section in Learn about retention policies and retention labels

• The "Search conditions" section in Keyword queries and search conditions for Content Search.

For more information about labels, see Learn about retention policies and retention labels.

eDiscovery holds

Run the following commands in Security & Compliance PowerShell to identify the hold associated with an eDiscovery case (called eDiscovery holds) that's applied to the mailbox. Use the GUID (not including the UniH prefix) for the eDiscovery hold that you identified in Step 1. The second command displays the name of the eDiscovery case the hold is associated with; the third command displays the name of the hold.

$CaseHold = Get-CaseHoldPolicy <hold GUID without prefix>

Get-ComplianceCase $CaseHold.CaseId | FL Name

$CaseHold.Name

After you've identified the name of the eDiscovery case and the hold, go to the eDiscovery>eDiscovery page in the Microsoft Purview portal, open the case, and remove the mailbox from the hold. For more information about identifying eDiscovery holds, see the "eDiscovery holds" section in How to identify the type of hold placed on an Exchange Online mailbox.

Step 4: Remove the delay hold from the mailbox

After any type of hold is removed from a mailbox, the value of the DelayHoldApplied or DelayReleaseHoldApplied mailbox property is set to True. This occurs the next time the Managed Folder Assistant processes the mailbox and detects that a hold has been removed. This is called a delay hold and means the actual removal of the hold is delayed for 30 days to prevent data from being permanently deleted from the mailbox. (The purpose of a delay hold is to give admins an opportunity to search for or recover mailbox items that will be purged after a hold is removed.) When a delay hold is placed on the mailbox, the mailbox is still considered to be on hold for an unlimited duration, as if the mailbox was on Litigation Hold. After 30 days, the delay hold expires, and Microsoft 365 will automatically attempt to remove the delay hold (by setting the DelayHoldApplied or DelayReleaseHoldApplied property to False) so that the hold is removed. For more information about a delay hold, see the "Managing mailboxes on delay hold" section in How to identify the type of hold placed on an Exchange Online mailbox.

If the value of the DelayHoldApplied or DelayReleaseHoldApplied property is set to True, run one of the following commands to remove the delay hold:

Set-Mailbox <username> -RemoveDelayHoldApplied

Or

Set-Mailbox <username> -RemoveDelayReleaseHoldApplied

You must be assigned the Legal Hold role in Exchange Online to use the RemoveDelayHoldApplied or RemoveDelayReleaseHoldApplied parameter.

Step 5: Delete items in the Recoverable Items folder

Now you're ready to actually delete items in the Recoverable Items folder by using the New-ComplianceSearch and New-ComplianceSearchAction cmdlets in Security & Compliance PowerShell.

Note

If the mailbox quota is met and the user mailbox is declining emails, you may receive a 554 5.2.0 error when deleting recoverable items. For more information, see "554 5.2.0 STOREDRV.Deliver.Exception" when sending emails in Exchange Online.

Here's an overview of the process to search for and delete items in a user's Recoverable Items folder:

1. Copy the folder IDs for all subfolders in the Recoverable Items folder. Alternatively, you can redirect the output of the script to a text file.

   Here's a list and description of the subfolders in the Recoverable Items folder that you can search and delete items from:

   • Deletions: Contains soft-deleted items whose deleted item retention period hasn't expired. Users can recover soft-deleted items from this subfolder using the Recover Deleted Items tool in Outlook.
   • DiscoveryHolds: Contains hard-deleted items that have been preserved by an eDiscovery hold or a retention policy. This subfolder isn't visible to end users.
   • SubstrateHolds: Contains hard-deleted items from Teams and other cloud-based apps that have been preserved by a retention policy or other type of hold. This subfolder isn't visible to end users.

2. Use the New-ComplianceSearch cmdlet (in Security & Compliance PowerShell) or use the Content search tool in the Microsoft Purview portal to create a content search that returns items from the target user's Recoverable Items folder. You can do this by including the FolderId in the search query for all subfolders that you want to search. For example, the following query returns all messages in the Deletions and eDiscoveryHolds subfolders:

   folderid:<folder ID of Deletions subfolder> OR folderid:<folder ID of DiscoveryHolds subfolder>
   

   Note

   If you use the New-ComplianceSearch cmdlet to search the Recoverable Items folder, be sure to use Start-ComplianceSearch cmdlet to run the search.

3. After you've created a content search and validated that it returns the items that you want to delete, use the New-ComplianceSearchAction -Purge -PurgeType HardDelete command (in Security & Compliance PowerShell) to permanently delete the items returned by the content search that you created in the previous step. For example, you can run a command similar to the following command:

   New-ComplianceSearchAction -SearchName "RecoverableItems" -Purge -PurgeType HardDelete
   

4. A maximum of 10 items per mailbox are deleted when you run the previous command. That means you may have to run the New-ComplianceSearchAction -Purge command multiple times to delete all the items that you want to delete in the Recoverable Items folder. To delete additional items, you first have to remove the previous compliance search purge action. You do this by running the Remove-ComplianceSearchAction cmdlet. For example, to delete the purge action that was run in the previous step, run the following command:

   Remove-ComplianceSearchAction "RecoverableItems_Purge"
   

   After you do this, you can create a new compliance search purge action to delete more items. You'll have to delete each purge action before creating a new one.

   To get a list of the compliance search actions, you can run the Get-ComplianceSearchAction cmdlet. Purge actions are identified by _Purge appended to the search name.

Verify that items were deleted

To verify that you've successfully deleted items from the Recoverable Items folder of a mailbox, use Get-MailboxFolderStatistics cmdlet in Exchange Online PowerShell to check the size and number of items in Recoverable Items folder. You can compare these statistics with the ones you collected in Step 1.

Run the following command in to get the current size and total number of items in folders and subfolders in the Recoverable Items folder in the user's primary mailbox.

Get-MailboxFolderStatistics <username> -FolderScope RecoverableItems | FL Name,FolderAndSubfolderSize,ItemsInFolderAndSubfolders

Run the following command to get the size and total number of items in folders and subfolders in the Recoverable Items folder in the user's archive mailbox.

Get-MailboxFolderStatistics <username> -FolderScope RecoverableItems -Archive | FL Name,FolderAndSubfolderSize,ItemsInFolderAndSubfolders

Step 6: Revert the mailbox to its previous state

The final step is to revert the mailbox back to its previous configuration. 這表示重設您在步驟 2 中變更的屬性，並重新套用您在步驟 3 中移除的保留。 這包括：

• 將刪除的專案保留期限變更回先前的值。 或者，您可以將此設定保留為 30 天，也就是 Exchange Online 的最大值。
• 重新啟用單一項目復原。
• 重新啟用用戶端存取方法，讓擁有者可以存取其信箱。
• 重新套用您移除的保留和保留原則。
• 重新啟用受控資料夾小幫手來處理信箱。

重要事項

建議您在重新套用保留或保留原則 (后等候 24 小時，並確認已就緒) ，然後再重新啟用受管理的資料夾小幫手來處理信箱。

在 Exchange Online PowerShell 中，以指定的順序) 執行下列步驟 (。

1. 執行下列命令，將刪除的專案保留期間變更回其原始值。 這會假設先前的設定小於 30 天;例如，14 天。

   Set-Mailbox <username> -RetainDeletedItemsFor 14
   

2. 執行下列命令以重新啟用單一項目復原。

   Set-Mailbox <username> -SingleItemRecoveryEnabled $true
   

3. 執行下列命令，以重新啟用信箱的所有用戶端存取方法。

   Set-CASMailbox <username> -EwsEnabled $true -ActiveSyncEnabled $true -MAPIEnabled $true -OWAEnabled $true -ImapEnabled $true -PopEnabled $true
   

4. 重新套用您在步驟 3 中移除的保留。 根據保留類型，請使用下列其中一個程式。

   訴訟保留

   執行下列命令以重新啟用信箱的訴訟保留。

   Set-Mailbox <username> -LitigationHoldEnabled $true
   

   原有範圍暫止

   使用 EAC (或 Exchange Online PowerShell) 將信箱新增回 In-Place 保留。

   套用至特定信箱的保留原則

   使用 Microsoft Purview 入口網站將信箱新增至保留原則。 移至 Microsoft Purview 入口網站中的 [ 資料生命週期管理>Microsoft 365>保留 ] 頁面，編輯保留原則，然後將信箱新增至套用保留原則的收件者清單。

   全組織的保留原則

   如果您從原則中排除整個組織或整個 Exchange 的保留原則，請使用 Microsoft Purview 入口網站從排除的使用者清單中移除信箱。 移至 Microsoft Purview 入口網站中的 [ 資料生命週期管理>Microsoft 365>保留 ] 頁面，編輯整個組織的保留原則，然後從排除的收件者清單中移除信箱。 這麼做會將保留原則重新套用至使用者的信箱。

   eDiscovery 案例保留

   使用 Microsoft Purview 入口網站將信箱新增回與電子檔探索案例相關聯的保留。 移至電子檔探索 (Standard) 頁面，開啟案例，然後將信箱新增回保留。

5. 執行下列命令，讓Managed資料夾助理再次處理信箱。 如先前所述，建議您在重新套用保留或保留原則 (之後等候 24 小時，並確認它已就緒) ，然後再重新啟用受控資料夾小幫手。

   Set-Mailbox <username> -ElcProcessingDisabled $false
   

6. 若要確認信箱已還原回先前的設定，您可以執行下列命令，然後將設定與您在步驟 1 中收集的設定進行比較。

   Get-Mailbox <username> | FL ElcProcessingDisabled,InPlaceHolds,LitigationHoldEnabled,RetainDeletedItemsFor,SingleItemRecoveryEnabled
   

   Get-CASMailbox <username> | FL EwsEnabled,ActiveSyncEnabled,MAPIEnabled,OWAEnabled,ImapEnabled,PopEnabled
   

其他相關資訊

下表說明當您執行 Get-Mailbox 或 Get-OrganizationConfig Cmdlet 時，如何根據 InPlaceHolds 屬性中的值來識別不同類型的保留。 如需詳細資訊，請參閱如何識別放置在 Exchange Online 信箱上的保留類型。

如先前所述，您必須先從信箱中移除所有保留和保留原則，才能成功刪除 [可復原的專案] 資料夾中的專案。

保留類型	範例值	如何識別保留
訴訟暫止	True	LitigationHoldEnabled 屬性設定為 True。
原有範圍暫止	c0ba3ce811b6432a8751430937152491	InPlaceHolds 屬性包含放在信箱上之 In-Place 保留的 GUID。 您可以判斷這是 In-Place 保留，因為 GUID 開頭不是前置詞。 您可以在 PowerShell Exchange Online 中使用 Get-ComplianceSearch Cmdlet 來取得信箱上 In-Place 保留的相關信息。
套用至特定信箱Microsoft Purview 入口網站中的保留原則	mbxcdbbb86ce60342489bff371876e7f224 或 skp127d7cf1076947929bf136b7a2a8c36f	當您執行 Get-Mailbox Cmdlet 時， InPlaceHolds 屬性也包含套用至信箱的保留原則 GUID。 您可以識別保留原則，因為 GUID 是以 mbx 前置詞開頭。 如果保留原則的 GUID 開頭為 skp 前置詞，表示保留原則已套用至 商務用 Skype 交談。 若要識別套用至信箱的保留原則，請在安全性 & 合規性 PowerShell 中執行下列命令： Get-RetentionCompliancePolicy <retention policy GUID without prefix> | FL Name 執行此命令時，請務必移除 mbx 或 skp 前置詞。
Microsoft Purview 入口網站中的全組織保留原則	沒有值 或 -mbxe9b52bf7ab3b46a286308ecb29624696 (表示信箱已從全組織的原則)	即使當您執行 Get-Mailbox Cmdlet 時 InPlaceHolds 屬性是空的，信箱仍可能套用一或多個全組織保留原則。 若要確認這一點，您可以Get-OrganizationConfig | FL InPlaceHolds在 Exchange Online PowerShell 中執行 命令，以取得整個組織保留原則的 GUID 清單。 套用至 Exchange 信箱之全組織保留原則的 GUID 開頭 mbx 為 前置詞，例如 mbxa3056bb15562480fadb46ce523ff7b02。 若要識別套用至信箱的全組織保留原則，請在安全性 & 合規性 PowerShell 中執行下列命令： Get-RetentionCompliancePolicy <retention policy GUID without prefix> | FL Name 如果信箱從整個組織的保留原則中排除，當您執行 Get-Mailbox Cmdlet 時，保留原則的 GUID 會顯示在使用者信箱的 InPlaceHolds 屬性中;其由前置詞-mbx識別，例如-mbxe9b52bf7ab3b46a286308ecb29624696
Microsoft Purview 入口網站中的電子檔探索案例保留	UniH7d895d48-7e23-4a8d-8346-533c3beac15d	InPlaceHolds 屬性也包含與 Microsoft Purview 入口網站中可能放在信箱中之電子檔探索案例相關聯之任何保留的 GUID。 您可以判斷這是電子檔探索案例保留，因為 GUID 是以 UniH 前置詞開頭。 您可以使用 Get-CaseHoldPolicy 安全性 & 合規性 PowerShell 中的 Cmdlet 來取得與信箱保留相關聯之電子檔探索案例的相關信息。 例如，您可以執行 命令 Get-CaseHoldPolicy <hold GUID without prefix> | FL Name 來顯示信箱上的案例保留名稱。 執行此命令時，請務必移除 UniH 前置詞。 若要識別與信箱保留相關聯的電子檔探索案例，請執行下列命令： $CaseHold = Get-CaseHoldPolicy <hold GUID without prefix> Get-ComplianceCase $CaseHold.CaseId | FL Name