Email mailboxes have long been the primary repository for work-related emails (and attachments) and calendaring information.
Some of these emails may have been copied to electronic document and records management (EDRM) systems or saved to network drives. Very often some form of mailbox archiving was introduced to help reduce storage by moving inactive content to a separate email archive system. Recovering those archiving emails (for the purpose of migrating the mailbox to Exchange Online for example) is known as ‘rehydration’.
Exchange Online mailboxes remain unchanged in terms of being the primary storage for emails and calendaring information.
However, they now contain a LOT more content compared with their on-prem predecessors. A lot of this additional content is stored in hidden folders that cannot be accessed from the email client user interface (UI) – Outlook, even by admins.
This post describes the range of content that may be found in Exchange Online mailboxes. Credit to the team at Practical365, the authors of the definitive and authoritative guide to Microsoft 365 ‘Office 365 for IT Pros’ for insights into this subject.
Initial overview
The content of this post is based on an analysis of my Exchange Online mailbox in a Microsoft 365 Dev environment. This mailbox contains a relatively small volume of incoming or sent emails as it is not used for work purposes. The mailbox also contains, in hidden folder, compliance copies of MS Teams chat and private channel messages.
Both the emails in the visible part of Outlook and the Teams messages in hidden folders are subject to separate Microsoft 365 retention policies.
For the purpose of this post I initially ran the following PowerShell command after connecting to Exchange Online. This command retrieves the details of all mailboxes, the total items, size, and item count.
Get-Mailbox –RecipientType UserMailbox | Get-MailboxStatistics | Sort ItemCount | Format-Table DisplayName, TotalItemSize, ItemCount -AutoSize
According to the above command, my Dev mailbox contains 591 items with a total size of 69.12 MB. It is the largest mailbox (out of 25) in my tenant.
I can get a lot more detail about the mailbox, including a range of settings and the size of each folder, by running the following command:
Get-ExoMailboxFolderStatistics -Identity mailboxname
Content accessible via Outlook
The second PowerShell command above indicates the following content is stored in the visible folders in my mailbox:
- Emails:
- Inbox: 219 items
- OutOfOffice: 120 items
- Sent items: 49 items
- Drafts: 5 items
- Deleted Items: 6 items
- Deletions: (2 items)
- Junk email: 0 items
- Contacts: 0 items
- Journal: 0 items
- Archive: 0 items
- Calendar-related elements, including the ‘To-Do’ option for personal tasks that also brings in any tasks assigned via Planner in a Microsoft 365 Group.
- Calendar: 10 visible items, 15 total
- AllToDoTasks: 2 items
Interestingly, if an email user deletes emails from their Inbox, they are moved to the ‘Deleted Items’ folder. If the end-user deletes them there, they are moved to the ‘Deletions’ (Recoverable Items) folder. If they are deleted from there AND are subject to an active retention policy, they end up in the hidden Purges folder – see below.
Content not accessible via Outlook
The amount of non-accessible content in individual Exchange Online mailboxes can be quite surprising. To quote from ‘Office 365 for IT Pros’ (October 2022 edition): ‘Microsoft does not document how Exchange or other workloads use the items in hidden folders, so a little guesswork is necessary’.
The following PowerShell script can provide some insight into this hidden content (first 300 folders only, there are a LOT of folders).
Get-ExoMailboxFolderStatistics -Identity mailboxname -FolderScope NonIPMRoot | Sort ItemsInFolder -Descending | Select -First 300 | Format-Table -Property @{e=”Name”; width=30}, @{e=”FolderSize”; Width=30}, ItemsInFolder
Here are some key points from the above:
- Audits (audit records that are copied to the Unified Audit logs): 721 items
- TeamsMeetings: 77 items. These relate to actual Teams meetings scheduled via my calendar.
- DiscoveryHolds: 45 items.
- TeamsMessagesData: 39 items. These are the ‘compliance copies’ of Teams chats that are subject to a retention policy.
- Purges (7 items). This is where any deleted emails that are subject to retention policies remain stored. It is the Exchange equivalent of the SharePoint/OneDrive Preservation Hold Library.
- ApplicationDataRoot: 0 items. According to ‘Office 365 for IT Pros’, this folder contains at least two guid-named folders that store (a) Forms data as PDFs and responses to forms as CSV files, and (b) Sway files in html format. Again, according to the book, ‘files are attached to emails to avoid the need to create extract MAPI message classes’. However, my mailbox shows ‘0 items’ against this folder, despite having a number of Forms.
Archived content
Exchange mailboxes may also be used to store archived content through the use of data connectors set up in the Compliance admin center. These connectors allow organisations archive content from a range of systems such as the following:
- Bloomberg Message
- Facebook business pages
- LinkedIn company pages
- MS SQL Databases
- Salesforce
- ServiceNow
- Slack
- Telegram
- Webex
- Workplace from Facebook’
- YouTube
- Zoom
Learn more about connectors for third-party data on this Microsoft site.
Implications for records managers
As noted above, Exchange Online mailboxes contain a mix of email-type content as well as additional content stored in hidden folders. While it may be possible to recover a mailbox from a backup, it is not currently possible to restore Teams content to Teams because the Teams content in the mailbox is a copy from the actual Teams database.
While emails can be copied to SharePoint so they can be stored in the context of other records, in practice a LOT of content/records will remain in mailboxes. In this context, it is worth reading NARA’s Bulletin 2013-02 ‘Guidance on a New Approach to Managing Email Records‘ which describes the ‘Capstone’ approach to email records ‘… developed in recognition of the difficulty in practicing traditional records management on the overwhelming volume of email that Federal agencies produce.’ At least one Australian jurisdiction has now included this approach in its advice to State records managers (see ‘Manage your records and Microsoft 365′ published in July 2021, accessed 13 November 2022).
If deployed, Microsoft 365 retention policies must be created separately for:
- Exchange Online mailboxes. The policy will cover the visible email content (and attachments) of personal mailboxes. Organisations following the US Capstone approach may have at least two retention policies for senior Executives (permanent retention) and everyone else (e.g., 7 years retention). Records managers will need to consider what happens to the content of these mailboxes at the end of the retention period and, especially if the entire mailbox is required for the retention period or just those items still subject to a retention period. Note that the retention policy does NOT apply any kind of tag to the email content, a Managed Folder Assistant (MFA) regularly reviews the content to identify if any content is still subject to a policy.
- Microsoft 365 Groups. This policy will cover both the email content and content stored in the Group’s SharePoint site. Again, the policy does not tag individual items but works on the basis of whether individual items meet the criteria for retention via the MFA process.
- Microsoft Teams chats. Compliance copies are stored in a hidden folder in the personal mailboxes of all participants. If any Teams content has a retention period that is longer than anything else in the mailbox, the mailbox will be retained for the longest period.
- Microsoft Teams private channel posts. Compliance copies are stored in a hidden folder in the personal mailboxes of all members of the private channel.
- Microsoft Teams channel posts. Compliance copies are stored in a hidden folder in the Group’s Exchange Online mailbox.
Note that any content shared or stored in the ‘Files’ tab of Teams is actually stored in either OneDrive (for chats), or the Group’s SharePoint site (for channels). A Microsoft 365 Group retention policy will apply to the Group’s SharePoint site but OneDrive’s require a separate policy.
As long as emails and Teams chats/channel messages are subject to retention policies, this content can be discovered (and the results exported) via the Content Search or eDiscovery section of the Microsoft Purview Compliance admin center.
Feature image: Pexels
Records about the world 
2 thoughts on “What is stored in an Exchange Online mailbox?”