- Retention is a feature of Exchange Online that allows you to preserve data for a certain period of time, regardless of whether users delete or modify it.
- If you want to delete some data that is under retention in Exchange Online, you can use the Search-Mailbox cmdlet in PowerShell with the -DeleteContent switch to delete the matching data from the mailbox or mailboxes.
- You should always be careful and double-check your commands before executing them, as deleting data in retention is irreversible.
If you use Exchange Online, you may have encountered a situation where you need to delete some data that is under retention. For example, you may want to free up some storage space, or you may want to remove some sensitive or outdated information. However, deleting data in retention is not as straightforward as deleting regular data. In this blog post, we will explain what retention is, why it exists, and how you can delete data in retention in Exchange Online.
Table of Contents
What is retention and why does it exist?
Retention is a feature of Exchange Online that allows you to preserve data for a certain period of time, regardless of whether users delete or modify it. Retention policies can be applied to mailboxes, folders, or individual items. Retention policies can also be configured to automatically delete data after a specified period of time.
The main purpose of retention is to comply with legal or regulatory requirements, such as the General Data Protection Regulation (GDPR) or the Sarbanes-Oxley Act (SOX). Retention policies can help you ensure that you have the necessary data to respond to litigation requests, audits, or investigations. Retention policies can also help you manage your data lifecycle and reduce the risk of data loss or leakage.
How to delete data in retention in Exchange Online
If you want to delete some data that is under retention in Exchange Online, you have two options:
- You can wait until the retention period expires and the data is automatically deleted by the system.
- You can use the Search-Mailbox cmdlet in PowerShell to delete the data manually.
The first option is simple but may not be feasible if you need to delete the data urgently or if the retention period is too long. The second option requires some technical skills and permissions, but it gives you more control and flexibility over the deletion process.
Here are the steps to use the Search-Mailbox cmdlet to delete data in retention in Exchange Online:
Step 1: Connect to Exchange Online PowerShell. You need to have the Mailbox Import Export role assigned to your account. You can follow this guide to learn how to connect and assign roles.
Step 2: Identify the mailbox or mailboxes that contain the data you want to delete. You can use the Get-Mailbox cmdlet to list all the mailboxes in your organization, or use filters to narrow down your search.
Step 3: Identify the search query that matches the data you want to delete. You can use keywords, dates, senders, recipients, or other criteria to specify your query. You can also use logical operators like AND, OR, and NOT to combine multiple criteria. You can find more details about the syntax and examples of search queries here.
Step 4: Run the Search-Mailbox cmdlet with the -DeleteContent switch to delete the matching data from the mailbox or mailboxes. You can also use the -Force switch to suppress any confirmation prompts. For example, this command will delete all messages with the word “confidential” in the subject line from John’s mailbox:
Search-Mailbox -Identity "John" -SearchQuery 'Subject:"confidential"' -DeleteContent -ForceYou can also use the -EstimateResultOnly switch to get an estimate of how many items will be deleted before actually deleting them. For example, this command will show how many messages with the word “confidential” in the subject line are in John’s mailbox:
Search-Mailbox -Identity "John" -SearchQuery 'Subject:"confidential"' -EstimateResultOnlyFrequently Asked Questions
Question: What is the difference between retention and deletion policies?
Answer: Retention policies and deletion policies are both types of policies that can be applied to Exchange Online data. However, they have different effects:
- Retention policies preserve data for a specified period of time, regardless of whether users delete or modify it. Retention policies can also automatically delete data after a specified period of time.
- Deletion policies only delete data after a specified period of time. They do not preserve data if users delete or modify it before the deletion period.
Question: How can I check which retention policy is applied to a mailbox or an item?
Answer: You can use the Get-RetentionPolicy cmdlet to list all the retention policies in your organization and their settings. You can also use the Get-RetentionPolicyTag cmdlet to list all the retention tags that are part of a retention policy and their settings.
To check which retention policy is applied to a mailbox, you can use the Get-Mailbox cmdlet with the -RetentionPolicy parameter. For example, this command will show which retention policy is applied to John’s mailbox:
Get-Mailbox -Identity "John" -RetentionPolicyTo check which retention tag is applied to an item, you can use the Get-RetentionComplianceItem cmdlet with the -Identity parameter. For example, this command will show which retention tag is applied to a message with the ID 1234567890:
Get-RetentionComplianceItem -Identity 1234567890Question: How can I change the retention policy or retention tag for a mailbox or an item?
Answer: To change the retention policy for a mailbox, you can use the Set-Mailbox cmdlet with the -RetentionPolicy parameter. For example, this command will apply the retention policy named “Policy1” to John’s mailbox:
Set-Mailbox -Identity "John" -RetentionPolicy "Policy1"To change the retention tag for an item, you can use the Set-RetentionComplianceItem cmdlet with the -Identity and -RetentionTag parameters. For example, this command will apply the retention tag named “Tag1” to a message with the ID 1234567890:
Set-RetentionComplianceItem -Identity 1234567890 -RetentionTag "Tag1"Conclusion
Deleting data in retention in Exchange Online can be a challenging task, but it is possible with the right tools and knowledge. By using the Search-Mailbox cmdlet in PowerShell, you can delete data in retention manually and quickly. However, you should always be careful and double-check your commands before executing them, as deleting data in retention is irreversible.
We hope this blog post has helped you understand how to delete data in retention in Exchange Online. If you have any questions or feedback, please leave a comment below.
Disclaimer: This blog post is for informational purposes only and does not constitute legal or professional advice. You should always consult with your own legal or IT experts before making any decisions regarding data retention or deletion. We are not responsible for any damages or losses caused by following or not following the instructions in this blog post.