Export Office 365 Mailbox Hold Report Using PowerShell
Organizations undergoing the investigation and compliance regulation processes preserve the mailbox contents (such as email, calendar, or notes) related to ongoing or upcoming legal proceedings. Users can have several holds on a mailbox and cannot delete the mailboxes placed on hold. Identifying the type of hold is the primary activity in performing any mailbox hold operations.
The authorized administrators are responsible for end-to-end management of mailboxes on holds. Using specific automated methods to analyze the status of the mailbox hold processes can support the administrators greatly.
Why Admins Need to Identify the Type of Hold Placed on an Exchange Online Mailbox?
Widely used mailbox holds methods are Litigation Holds, In-Place Holds, and Retention Holds. The administrator monitors status of these holds with complicated efforts for a variety of reasons. Few are listed below.
- To reduce license cost– You can remove the holds on the unused inactive mailboxes.
- To reduce the storage– The admins plan on revising the hold duration and removing the high-storage consuming mailboxes under hold.
- To ensure the mailbox’s contents related to the legal proceeding are preserved permanently.
- On identifying multiple holds, the admins can suggest the best hold techniques and update the hold setting if required.
- Having the mailbox hold duration data (start and end date), the administrators maintain the time-based mailbox holds easily.
View Mailbox Holds Status in Exchange Online
The permitted administrators (e.g., Global, Exchange, Compliance and so on.,) can view the status of mailbox holds. Further, you should have specific administrative roles to access the mailbox hold (e.g., Global, Legal, Discovery, Mailbox Search). Make sure that you have the necessary permissions to place a mailbox on hold.
Using UI: You can view the mailbox holds in the Exchange Online Admin Center (EAC). Follow the navigations below.
- Find all Litigation holds: In the EAC, go to ‘Recipients’ and click on ‘Mailboxes’. Click on ‘Choose columns’ and select ‘Litigation hold enabled’. You can see the hold status. The Major user complaint here is, you cannot find status and hold details as an aggregated report anywhere in the EAC.
- View all In-Place holds: Viewing and managing In-Place hold in EAC is obsolete after the launch of new Compliance eDiscovery features.
- Find the Retention holds: In the EAC, it is impossible to view the mailboxes under retention hold.
Using PowerShell: You can use the PowerShell cmdlets Get-Mailbox to view the holds placed on the mailboxes. However, despite using PowerShell with multiple filtering conditions, you will not get clear idea about the mailbox holds (e.g., GUID will not disclose the In-Place Hold’s Type directly).
To overcome all the UI and PowerShell impossibilities and limitations, we designed the All-in-One script ‘MailboxHoldReport.ps1’. We can discuss the script’s functionalities in detail now.
- Generates 4 different mailbox holds reports.
- Automatically installs the Exchange Online module upon your confirmation when it is not available in your machine.
- Shows list of the mailboxes with all the active holds information for each mailbox.
- Shows the mailboxes with litigation hold enabled along with hold duration and other details.
- Displays in-place hold applied mailboxes.
- Lists mailboxes that are placed on retention hold and their retention policy.
- Supports both MFA and Non-MFA accounts.
- Exports the report in CSV format.
- Scheduler-friendly. You can automate the report generation upon passing credentials as parameters.
Download Script: MailboxHoldReport.ps1
Mailbox Hold Report – Script Execution Overview
The admin can quickly identify the mailboxes with holds in their organization using the report data. In addition, the detailed attributes in each report aids in tracking the existing hold policies and reconstruct the mailbox hold settings. We have outlined the steps for supplying inputs and generating reports below.
With a simple execution format, you can get below mentioned 4 different mailbox holds reports.
- Report on Mailboxes under Hold(s)
- Litigation Holds Report
- In-Place Holds Report
- Retention Holds Report
We have outlined the steps for supplying inputs and generating reports below.
List All Office 365 Mailbox in Holds:
You can have different types of holds placed on a single mailbox to meet the compliance regulations, legal and investigations procedures. The administrators find difficulties in relating the list of mailboxes hold placed on each mailbox and collecting the unique properties of each hold type. You can refer to the active holds report and get all the mailbox holds information quickly.
With the simple execution format and the mailbox holds details, you can also view the archive mailboxes status and ‘ComplianceTagHoldApplied’ status.
Litigation Hold Report in Office 365:
The administrators are responsible for the mailbox storage management, recovering deleted items, and preserving contents deleted by users. Using our script, you can identify the status and all significant details of the litigation hold. You can use the report to analyze the litigation holds properties and revise the litigation hold policies to align with the organization’s needs.
Use the switch param ‘LitigationHoldsOnly’ to get all the mailboxes with the litigation hold. You will get the report with all the litigation holds specific attributes like ‘LitigationHoldOwner,’ LitigationHoldDuration’, and ‘LitigationHoldDate’.
List In-Place Hold Enabled Mailboxes:
The administrator places mailboxes with multiple In-Place holds when a mailbox is subject to various legal investigations. Using our In-Place hold report, the administrators can identify the mailboxes without holds and enable the holds appropriately. Also, the administrator can use the report to ensure that the email content is retained in an immutable way, free from automated deletion mechanisms (e.g., MRM) and user deletion interferences.
Use the switch param ‘InPlaceHoldsOnly’ to get the mailboxes with In-Place holds. If you have multiple In-Place holds, you will get the exact count and in-place hold types like ‘Specific location Retention Policy, In-Place, eDiscovery Case’, in the report as shown in the image.
Get Office 365 Mailbox with Retention Holds Report:
The retention holds can be configured to retain mailbox items belongs to the Exchange Online, Microsoft 365 Groups, and Teams. The administrator can suspend the processes of MRM by the managed assistant for the mailboxes by enabling retention holds. The retention hold report helps to identify the mailboxes with retention holds, retention policy, and the hold’s end date for each mailbox.
Use the switch param ‘RetentionHoldsOnly’ to get the list of retention hold enabled mailboxes. The ‘Retention Policy Tag’ in the report gives the abstract description of the hold, ‘Start Date for Retention Hold’ and ‘End Date for Retention Hold’ exposes the retention hold’s duration.
Scheduling Office 365 Mailbox on Hold Report:
Since most of the mailbox holds are permanent, you can schedule the PowerShell script to monitor the mailbox hold status in detail. To schedule the execution, you can use both MFA and non-MFA accounts.
To use the non-MFA admin accounts, try the format below.
.\MailboxHoldReport.ps1 -UserName email@example.com -Password (password) -LitigationHoldsOnly
If the admin account has MFA, then they cannot use it directly for scheduling. Instead, you have to disable MFA based on the Conditional Access Policy to make it work.
Mailbox Hold Report – More Reasons to Track:
Administrators of other management groups can also use this report more effectively to maintain the mailboxes. Find below the additional uses.
- Change the hold duration for an inactive mailbox.
- Delete an inactive mailbox when no holds are required.
- Enable archive mailboxes for the mailboxes under hold.
- Identifies the end date of the holds and update the hold duration.
- Identifies the compliance tag hold status to understand the retention label’s performance.
We hope this blog is useful to get mailbox holds status. If there is still something unclear to you, please leave a comment, and we will address your questions.