Export Exchange Online Archiv Mailbox content using eDiscovery
In this post, I want to share a method with you that can be used to export the content of Exchange Online Archive Mailboxes. We’re using PowerShell and the Compliance Portal to export the content. I will lead you through the process of generating PST Files which will contain the content of archive mailboxes.
Exchange Online Archive Mailboxes
Exchange Online Archive Mailboxes are a kind of secondary mailbox storage. They can be enabled for licensed Exchange Online Mailboxes. Reasons why you have this kind of mailbox could be
you want to clean up your mailbox but not throw away the old stuff
you need to have more than 100GB in a mailbox
you thought that these mailboxes could help you to fulfill your regulatory requirements regarding retention
Other Names for this kind of secondary storage are In-Situ or In-Place Archive.
What’s the Problem
There can be multiple Reasons why you want to get rid of all or single Mailbox Archives. Here are some:
To use an Exchange Mailbox you need to have at least an Exchange Online Plan 1. This is also relevant for shared mailboxes. You might have changed some mailboxes from a user mailbox to a shared mailbox and want to eliminate the license requirement
To keep your mailbox clean an archive mailbox can be a tool. But for some users (I am one of these) secondary storage makes it harder to keep the overview. You might want to reduce your mailboxes to one.
Not every client can work with archive mailboxes (Like Outlook mobile). You might have the requirement to access mailbox content from this affected mailbox
Unfortunately, there is no simple way out. You can hand over the processing to the user and ask him to move the content over to his primary mailbox using Outlook. In single cases, this could be a feasible solution.
A more “enterprisish” solution to move masses of items over to your primary mailbox is using EWS. Michel de Rooij shared this article which shows how to use EWS to move the content: Unarchiving Mailbox Items | EighTwOne (821). This works in general, I already used it in times when I had to operate Exchange Servers. EWS is not fast, depends on client software, and is discontinued in Exchange Online (Retirement of Exchange Web Services in Exchange Online - Microsoft Community Hub). Furthermore, I can’t get used to EWS, but I know how to use compliance tools and PowerShell. eDiscovery, here we go!
Why use eDiscovery
Microsoft Purview eDiscovery is designed to fulfill requirements in legal cases. You can create cases and assign case roles to discover relevant content in multiple Microsoft 365 services. Discovered Data can be handled with different actions like retaining or deletion.
In the past, Exchange Admins used Exchange PowerShell cmdlets like search-mailbox for export tasks like the one I’m describing here. Microsoft has meanwhile disabled the cmdlet in Exchange Online for reasons. Apart from backup methods and single-item export functions, the eDiscovery Tools are the most native way to export large amounts of data from your Tenant.
The eDiscovery Method to export Archive content
To be able to import stuff to your primary mailbox, you need to export it first. That’s what this article is about. The result will be PST-Files for every targeted Archive Mailbox which will contain the content of the related archive mailbox.
Before you start you should ensure that no new content is generated in your archive mailboxes. So you need to inform your users and double-check if there are classic Message Retention Policies (MRM) Policies that create new stuff in the archive mailboxes.
Furthermore, you need an admin account that has an exchange admin and compliance manager role assigned to be able to create the search and export the results.
Next, go on and identify every identity that has an archive mailbox that you want to export and write them down in a .file
You use the CSV to feed the PowerShell script I published here: thinBlog/ArchiveExport/ExportArchiveMailboxContent.ps1 at main · thinformatics/thinBlog (github.com). Now you grab the script and start processing, or you invest a few more minutes to read my explanations about the most relevant parts of the script.
In the first lines, we’re using the ExchangeOnlineManagement Tool to connect against Exchange Online and the Purview Backend. Additionally, we define the path to the CSV and names for the eDiscovery Case that will be used to search and export the relevant content.
The Switch “OneSearchForAll“ determines whether all content is handled in one search, or if a search will be created for every recipient. The export result will be the same in both cases (One PST per User). But if you want to refine the content for specific mailboxes, you should create single searches and set the switch to false. Try it out and choose the method that fits your requirements.
The function “get-ArchiveMailboxFolderIDs“ is a core component of this script. It’s used to crawl an archive mailbox and generate a list of folder IDs. This approach is needed cause we can’t scope an eDiscovery search to archive mailboxes only. So we need to define exactly in which folders we want to search for content. The parameter excludeSystemFolders can be used to exclude Folders that are mostly not relevant for the end users. Kudos again to Tony Redmond for sharing the way to convert the Exchange Folder IDs to the format we need in the eDiscovery query (How to Use a Targeted Collection in a Microsoft 365 Content Search (practical365.com)).
The last part I want to explain is the puzzle piece where we create the eDiscovery search. In this example, we generate one search for every named archive mailbox in the eDiscovery case we’ve deployed before. The Search contains a ContentMatchQuery that’s generated by the function I’ve described above. This query contains all the folderID’s of the mailbox folders that should be exported The search will be started after creation.
When the script is finished, the results are one or more searches in an eDiscovery case. When the search is completed you can start the export of the results. The following screenshot collection will show you what the result looks like in the purview center and how you can start the download of the PST files.
When the export and export-download is finished you will find PST’s for every user in the download location. This picture shows you how it should look like.
You exported the archive mailbox content now. Depending on your use case you can now disable the archive mailboxes &/ import the archive content into the primary mailbox. If you have to import masses of pst’s into masses of mailboxes, you might want to read my series about a PST-based migration approach. It contains all the stuff you need to automate the import. Part 3 should be a good start to the task of importing it: Tenant-to-Tenant – PST based Exchange Migration automation approach – Part III — thinformatics.