{"id":7835,"date":"2022-01-21T03:15:55","date_gmt":"2022-01-21T03:15:55","guid":{"rendered":"https:\/\/www.insentragroup.com\/us\/?p=7835"},"modified":"2022-01-25T03:42:17","modified_gmt":"2022-01-25T03:42:17","slug":"has-your-company-removed-all-unwanted-message-data","status":"publish","type":"post","link":"https:\/\/www.insentragroup.com\/us\/insights\/geek-speak\/modern-workplace\/has-your-company-removed-all-unwanted-message-data\/","title":{"rendered":"Has your company removed all unwanted message data?"},"content":{"rendered":"\n<p>Working with a client recently an issue was noted when performing a content search within Microsoft\u2019s Compliance Centre. Inactive mailboxes that were thought to be deleted from the environment were showing in the \u201cChoose Users\u201d filter in content search.<\/p>\n\n\n\n<p>It is normal to see inactive accounts in the \u201cChoose Users\u201d filter of the content search, however in this situation the mailboxes did not have an Azure Active Directory (AAD) identity (account) and had been deleted before the retention policies being removed.<\/p>\n\n\n\n<p>Using the Compliance Centre PowerShell to remove policies from the affected mailboxes was not possible as the AAD Identity no longer exists. &nbsp;<\/p>\n\n\n\n<p>In this case where there is an inactive (or soft deleted) mailbox in Exchange Online, the retention is still in place and the user identity has been removed from Azure Active Directory (AAD), the following process can be used to retire the data.<\/p>\n\n\n\n<p>Minimum Requirements:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Exchange Online PowerShell (Reference step 1 below)<\/li><li>Organisation Management permission<\/li><li>Case Management (to test content search)<\/li><\/ul>\n\n\n\n<h3 style=\"padding-bottom: 15px; margin-bottom: 30px; margin-top: 40px; border-bottom: 1px solid #F37237; color: #F37237;\"><span>Step 1: Connecting to Exchange Online via PowerShell<\/span><\/h3>\n\n\n\n<p>Connection can be achieved by importing the <a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/exchange\/connect-to-exchange-online-powershell?view=exchange-ps\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Exchange Online PowerShell<\/a> module and using the following syntax to connect.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Connect-ExchangeOnline -UserPrincipalName &lt;UPN of an Exchange Administator<\/code><\/pre>\n\n\n\n<h3 style=\"padding-bottom: 15px; margin-bottom: 30px; margin-top: 40px; border-bottom: 1px solid #F37237; color: #F37237;\"><span>Step 2: Identity Preparation<\/span><\/h3>\n\n\n\n<p><strong>Note:<\/strong> If there is only one (1) inactive mailbox to process, take note of the Primary SMTP address and move on to step 3.<\/p>\n\n\n\n<p>To generate a list of Inactive mailboxes run<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-Mailbox -InactiveMailboxOnly | select PrimarySMTPAddress | export-csv c:\\temp\\InactiveUsers.csv <\/code><\/pre>\n\n\n\n<p>This will output a list of inactive users to the Temp folder on the C drive (please note you need create a temp folder if one does not exist)<\/p>\n\n\n\n<p>After the CSV export has been completed navigate to the file location and open the CSV. Remove any address that is not required and set the column header to PrimarySMTPAddress (case sensitive). Save and Close the CSV.<\/p>\n\n\n\n<h3 style=\"padding-bottom: 15px; margin-bottom: 30px; margin-top: 40px; border-bottom: 1px solid #F37237; color: #F37237;\"><span>Step 3: Update Mailbox to remove all Retention Policies<\/span><\/h3>\n\n\n\n<p>To remove retention policies from a single user run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Set-Mailbox &lt; PrimarySMTPAddress of inactive mailbox&gt; -ExcludeFromAllOrgHolds<\/code><\/pre>\n\n\n\n<p>To remove retention policies for multiple users, copy and save this PowerShell script to import users from the CSV previously created.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Open PowerShell ISE editor, copy and paste the below text<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>$inputfile\t= \"C:\\temp\\InactiveUsers.csv\"\n\nImport-Csv $inputfile | foreach {\n\n  Write-Host \"Removing Retention Holds: \" -NoNewline; Write-Host $_.PrimarySMTPAddress -foregroundcolor $fc\n  Set-Mailbox $_.PrimarySMTPAddress -ExcludeFromAllOrgHolds\n  Write-Host \"Completed: \" -NoNewline; Write-Host $_.PrimarySMTPAddress -foregroundcolor $fc\n} \n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>Save the file to the c:\\temp folder naming it UpdateRetentionHolds.ps1<\/li><li>In the PowerShell prompt navigate to the file in the temp folder<\/li><li>type .\\UpdateRetentionHolds.ps1 and press Enter<\/li><\/ul>\n\n\n\n<p>This will import the csv and remove any retention holds for the Primary SMTP Addresses listed in the CSV. The script above confirms when the actions have completed successfully.<\/p>\n\n\n\n<h3 style=\"padding-bottom: 15px; margin-bottom: 30px; margin-top: 40px; border-bottom: 1px solid #F37237; color: #F37237;\"><span>Step 4: Check and Remove delay holds on a Mailbox<\/span><\/h3>\n\n\n\n<p>The DelayHold and DelayReleaseHold flags on the mailbox may still be set to true. Which effectively means data within the mailbox can be retained for 30 days until an automated process is run to set the flags to false. By setting the flags to false the mailbox and data can be permanently deleted without waiting.<\/p>\n\n\n\n<p>To check if the DelayHold and DelayReleaseHold flags are set to false this command can be run.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-Mailbox &lt;PrimarySMTPAddress&gt; -InactiveMailboxOnly | FL *HoldApplied* <\/code><\/pre>\n\n\n\n<p>The &lt;PrimarySMTPAddress&gt; can be left out in the above command which will display all Inactive mailboxes and the hold statuses.<\/p>\n\n\n\n<p>To set the DelayHold and DelayReleaseHold flags to false these commands can be run for a single user:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Set-Mailbox &lt;PrimarySMTPAddress&gt; -InactiveMailboxOnly  -RemoveDelayHoldApplied\nSet-Mailbox &lt;PrimarySMTPAddress&gt; -InactiveMailboxOnly -RemoveDelayReleaseHoldApplied\n<\/code><\/pre>\n\n\n\n<p>Alternatively the same CSV process in step 3 can be deployed to process multiple Inactive mailboxes<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Open PowerShell ISE editor, copy and paste the below text<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>$inputfile\t= \"C:\\temp\\InactiveUsers.csv\"\n\nImport-Csv $inputfile | foreach {\n\n  Write-Host \"Removing Delay Holds: \" -NoNewline; Write-Host $_.PrimarySMTPAddress -foregroundcolor $fc\n  Set-Mailbox $_.PrimarySMTPAddress -InactiveMailboxOnly  -RemoveDelayHoldApplied\n  Set-Mailbox $_.PrimarySMTPAddress -InactiveMailboxOnly -RemoveDelayReleaseHoldApplied\n  Write-Host \"Delay holds removed for: \" -NoNewline; Write-Host $_.PrimarySMTPAddress -foregroundcolor $fc \n} \n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>Save the file to the c:\\temp folder naming it RemoveDelayHolds.ps1<\/li><li>In the PowerShell prompt navigate to the file in the temp folder<\/li><li>type .\\RemoveDelayHolds.ps1 and press Enter<\/li><\/ul>\n\n\n\n<p>This will import the csv and set DelayHold and DelayReleaseHold flags to false for the Primary SMTP Addresses listed in the CSV. The script above confirms when the actions has completed successfully.<\/p>\n\n\n\n<h3 style=\"padding-bottom: 15px; margin-bottom: 30px; margin-top: 40px; border-bottom: 1px solid #F37237; color: #F37237;\"><span>Step 5: Permanently Remove the mailbox from the Environment<\/span><\/h3>\n\n\n\n<p>Once the inactive mailbox has had the retention policies and delay holds removed it is ready for permanent deletion. <\/p>\n\n\n\n<p>As with the previous step this can be achieved singularly.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Remove-Mailbox -Identity &lt;PrimarySMTPAddress&gt;  -PermanentlyDelete <\/code><\/pre>\n\n\n\n<p>or with the CSV import process<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Open PowerShell ISE editor, copy and paste the below text<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>\n$inputfile\t= \"C:\\temp\\InactiveUsers.csv\"\n\nImport-Csv $inputfile | foreach {\n\n  Remove-Mailbox -Identity $_.PrimarySMTPAddress -PermanentlyDelete \n  Write-Host \"Mailbox permanently Deleted: \" -NoNewline; Write-Host $_.PrimarySMTPAddress -foregroundcolor $fc \n} \n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>Save the file to the c:\\temp folder naming it RemoveMailbox.ps1<\/li><li>In the PowerShell prompt navigate to the file in the temp folder<\/li><li>type .\\RemoveMailbox.ps1 and press Enter<\/li><\/ul>\n\n\n\n<h3 style=\"padding-bottom: 15px; margin-bottom: 30px; margin-top: 40px; border-bottom: 1px solid #F37237; color: #F37237;\"><span>Step 6: Confirm Inactive mailbox is not searchable<\/span><\/h3>\n\n\n\n<p>Now that the inactive mailbox has been removed, the Compliance Centre content search will not show the inactive mailbox in the filter criteria. This can be tested by logging into the Compliance Center and<a href=\"https:\/\/docs.microsoft.com\/en-us\/microsoft-365\/compliance\/content-search?view=o365-worldwide\" target=\"_blank\" rel=\"noreferrer noopener nofollow\"> setting up a content search<\/a>.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img fetchpriority=\"high\" decoding=\"async\" width=\"1024\" height=\"517\" src=\"https:\/\/www.insentragroup.com\/us\/wp-content\/uploads\/sites\/21\/2022\/01\/image-90-1024x517.png\" alt=\"\" class=\"wp-image-7841\" srcset=\"https:\/\/www.insentragroup.com\/us\/wp-content\/uploads\/sites\/21\/2022\/01\/image-90-1024x517.png 1024w, https:\/\/www.insentragroup.com\/us\/wp-content\/uploads\/sites\/21\/2022\/01\/image-90-300x151.png 300w, https:\/\/www.insentragroup.com\/us\/wp-content\/uploads\/sites\/21\/2022\/01\/image-90-768x388.png 768w, https:\/\/www.insentragroup.com\/us\/wp-content\/uploads\/sites\/21\/2022\/01\/image-90.png 1036w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>When setting up the content search toggle on Exchange Mailboxes Location and select \u201cChoose Users\u201d. This will open a pane in the right side of the web browser where you can enter the primary smtp address of the removed accounts, the results of the filter will be blank.<\/p>\n\n\n\n<p>Knowing what data the business has and where it is stored is crucial as data that is no longer legitimately required can impact businesses. Fundamentally, processes need to be refined and updated as new technology is adopted, Insentra can help businesses with <a href=\"https:\/\/www.insentragroup.com\/us\/services\/advisory-services\/\" target=\"_blank\" rel=\"noreferrer noopener\">advisory services<\/a> which analyse, report and advise on planning.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Working with a client recently an issue was noted when performing a content search within Microsoft\u2019s Compliance Centre. Inactive mailboxes that were thought to be deleted from the environment were showing in the \u201cChoose Users\u201d filter in content search. It is normal to see inactive accounts in the \u201cChoose Users\u201d filter of the content search,&hellip; <a class=\"more-link\" href=\"https:\/\/www.insentragroup.com\/us\/insights\/geek-speak\/modern-workplace\/has-your-company-removed-all-unwanted-message-data\/\">Continue reading <span class=\"screen-reader-text\">Has your company removed all unwanted message data?<\/span><\/a><\/p>\n","protected":false},"author":99,"featured_media":7849,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[19],"tags":[],"class_list":["post-7835","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-modern-workplace","entry"],"_links":{"self":[{"href":"https:\/\/www.insentragroup.com\/us\/wp-json\/wp\/v2\/posts\/7835","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.insentragroup.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.insentragroup.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.insentragroup.com\/us\/wp-json\/wp\/v2\/users\/99"}],"replies":[{"embeddable":true,"href":"https:\/\/www.insentragroup.com\/us\/wp-json\/wp\/v2\/comments?post=7835"}],"version-history":[{"count":9,"href":"https:\/\/www.insentragroup.com\/us\/wp-json\/wp\/v2\/posts\/7835\/revisions"}],"predecessor-version":[{"id":7860,"href":"https:\/\/www.insentragroup.com\/us\/wp-json\/wp\/v2\/posts\/7835\/revisions\/7860"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.insentragroup.com\/us\/wp-json\/wp\/v2\/media\/7849"}],"wp:attachment":[{"href":"https:\/\/www.insentragroup.com\/us\/wp-json\/wp\/v2\/media?parent=7835"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.insentragroup.com\/us\/wp-json\/wp\/v2\/categories?post=7835"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.insentragroup.com\/us\/wp-json\/wp\/v2\/tags?post=7835"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}