Export Office 365 Mailbox Hold Report Using PowerShell

Organizations undergoing the investigation and compliance regulation processes preserve the mailbox contents (such as email, calendar, or notes) related to ongoing or upcoming legal proceedings. Users can have several holds on a mailbox and cannot delete the mailboxes placed on hold. Identifying the type of hold is the primary activity in performing any mailbox hold operations.

The authorized administrators are responsible for end-to-end management of mailboxes on holds. Using specific automated methods to analyze the status of the mailbox hold processes can support the administrators greatly.

Widely used mailbox holds methods are Litigation Holds, In-Place Holds, and Retention Holds. The administrator monitors status of these holds with complicated efforts for a variety of reasons. Few are listed below.

1. To reduce license cost– You can remove the holds on the unused inactive mailboxes.
2. To reduce the storage– The admins plan on revising the hold duration and removing the high-storage consuming mailboxes under hold.
3. To ensure the mailbox’s contents related to the legal proceeding are preserved permanently.
4. On identifying multiple holds, the admins can suggest the best hold techniques and update the hold setting if required.
5. Having the mailbox hold duration data (start and end date), the administrators maintain the time-based mailbox holds easily.

The permitted administrators (e.g., Global, Exchange, Compliance and so on.,) can view the status of mailbox holds. Further, you should have specific administrative roles to access the mailbox hold (e.g., Global, Legal, Discovery, Mailbox Search). Make sure that you have the necessary permissions to place a mailbox on hold.

Using UI: You can view the mailbox holds in the Exchange Online Admin Center (EAC). Follow the navigations below.

• Find all Litigation holds: In the EAC, go to ‘Recipients’ and click on ‘Mailboxes’. Click on ‘Choose columns’ and select ‘Litigation hold enabled’. You can see the hold status. The Major user complaint here is, you cannot find status and hold details as an aggregated report anywhere in the EAC.
• View all In-Place holds: Viewing and managing In-Place hold in EAC is obsolete after the launch of new Compliance eDiscovery features.
• Find the Retention holds: In the EAC, it is impossible to view the mailboxes under retention hold.

Using PowerShell: You can use the PowerShell cmdlets Get-Mailbox to view the holds placed on the mailboxes. However, despite using PowerShell with multiple filtering conditions, you will not get clear idea about the mailbox holds (e.g., GUID will not disclose the In-Place Hold’s Type directly).

To overcome all the UI and PowerShell impossibilities and limitations, we designed the All-in-One script ‘MailboxHoldReport.ps1’. We can discuss the script’s functionalities in detail now.

Script Highlights:

• Generates 4 different mailbox holds reports.
• Automatically installs the Exchange Online module upon your confirmation when it is not available in your machine.
• Shows list of the mailboxes with all the active holds information for each mailbox.
• Shows the mailboxes with litigation hold enabled along with hold duration and other details.
• Displays in-place hold applied mailboxes.
• Lists mailboxes that are placed on retention hold and their retention policy.
• Supports both MFA and Non-MFA accounts.
• Exports the report in CSV format.
• Scheduler-friendly. You can automate the report generation upon passing credentials as parameters.

Download Script: MailboxHoldReport.ps1

The admin can quickly identify the mailboxes with holds in their organization using the report data. In addition, the detailed attributes in each report aids in tracking the existing hold policies and reconstruct the mailbox hold settings. We have outlined the steps for supplying inputs and generating reports below.

With a simple execution format, you can get below mentioned 4 different mailbox holds reports.

• Report on Mailboxes under Hold(s)
• Litigation Holds Report
• In-Place Holds Report
• Retention Holds Report

We have outlined the steps for supplying inputs and generating reports below.

You can have different types of holds placed on a single mailbox to meet the compliance regulations, legal and investigations procedures. The administrators find difficulties in relating the list of mailboxes hold placed on each mailbox and collecting the unique properties of each hold type. You can refer to the active holds report and get all the mailbox holds information quickly.

With the simple execution format and the mailbox holds details, you can also view the archive mailboxes status and ‘ComplianceTagHoldApplied’ status.

Sample Output:

The administrators are responsible for the mailbox storage management, recovering deleted items, and preserving contents deleted by users. Using our script, you can identify the status and all significant details of the litigation hold. You can use the report to analyze the litigation holds properties and revise the litigation hold policies to align with the organization’s needs.

Use the switch param ‘LitigationHoldsOnly’ to get all the mailboxes with the litigation hold. You will get the report with all the litigation holds specific attributes like ‘LitigationHoldOwner,’ LitigationHoldDuration’, and ‘LitigationHoldDate’.

Sample Output:

The administrator places mailboxes with multiple In-Place holds when a mailbox is subject to various legal investigations. Using our In-Place hold report, the administrators can identify the mailboxes without holds and enable the holds appropriately. Also, the administrator can use the report to ensure that the email content is retained in an immutable way, free from automated deletion mechanisms (e.g., MRM) and user deletion interferences.

Use the switch param ‘InPlaceHoldsOnly’ to get the mailboxes with In-Place holds. If you have multiple In-Place holds, you will get the exact count and in-place hold types like ‘Specific location Retention Policy, In-Place, eDiscovery Case’, in the report as shown in the image.

Sample Output:

The retention holds can be configured to retain mailbox items belongs to the Exchange Online, Microsoft 365 Groups, and Teams. The administrator can suspend the processes of MRM by the managed assistant for the mailboxes by enabling retention holds. The retention hold report helps to identify the mailboxes with retention holds, retention policy, and the hold’s end date for each mailbox.

Use the switch param ‘RetentionHoldsOnly’ to get the list of retention hold enabled mailboxes. The ‘Retention Policy Tag’ in the report gives the abstract description of the hold, ‘Start Date for Retention Hold’ and ‘End Date for Retention Hold’ exposes the retention hold’s duration.

Sample Output:

Since most of the mailbox holds are permanent, you can schedule the PowerShell script to monitor the mailbox hold status in detail. To schedule the execution, you can use both MFA and non-MFA accounts.

To use the non-MFA admin accounts, try the format below.

If the admin account has MFA, then they cannot use it directly for scheduling. Instead, you have to disable MFA based on the Conditional Access Policy to make it work.

Administrators of other management groups can also use this report more effectively to maintain the mailboxes. Find below the additional uses.

• Change the hold duration for an inactive mailbox.
• Delete an inactive mailbox when no holds are required.
• Enable archive mailboxes for the mailboxes under hold.
• Identifies the end date of the holds and update the hold duration.
• Identifies the compliance tag hold status to understand the retention label’s performance.

Monitoring mailbox holds through EAC & PowerShell can present several challenges, and a few of the downsides are time-consuming, error-prone, lack automation, and provide limited visibility into an organization’s compliance status.

To overcome the challenges associated with monitoring mailbox holds, consider using AdminDroid Microsoft 365 reporter, which provides detailed mailbox hold reports by beating the limitations of native Office 365 reports and aids in simplifying the compliance management process.

AdminDroid Exchange Online reporting tool goes beyond the basics and provides clear-cut mailbox reports on litigation hold, retention hold, and in-place hold with a more granular view of hold duration, owner, hold date, etc. Further, you can even drill down to specific Exchange Online mailbox details such as the start & end date of the retention period, mailbox type, department, and more.

Overall, whether you’re a small business or a large enterprise, AdminDroid Microsoft 365 reporting tool can help you manage your Exchange Online environment more efficiently and effectively. It offers a lot more than basic mailbox reports, which provide clear-cut insights into mailbox retention policies and mailbox activities and help to ensure compliance with legal requirements.

• AdminDroid is an intuitive Office 365 reporting tool that offers over 1800+ all-in-one reports, with smart AI-powered graphical analytics, and sleek comprehensive dashboards for widespread visibility on every other Office 365 service.
• AdminDroid is now furnished with better alerting capabilities, delegation, advanced scheduling, advanced filtering, etc.,

Don’t settle for limited reports that leave you in the dark about potential risks and compliance issues! Try the free 15-day premium edition of AdminDroid to explore its features & functionalities!

The native Office 365 Reporting tool does only 10% of reporting,

and AdminDroid does another 90%!

We hope this blog is useful to get mailbox holds status. If there is still something unclear to you, please leave a comment, and we will address your questions.