Exchange Online getting serious about helping with eDiscovery

The Exchange Blog - Preserve mailbox data for eDiscovery using inactive mailboxes in Exchange Online

In Exchange Online and Exchange Server 2013, you can use In-Place Hold to preserve mailbox content for litigation or investigations. Many organizations also need to preserve mailbox data for users who are no longer in the organization.

In on-premises Exchange deployments, this has typically been done by disabling the Active Directory user account and performing actions such as removing it from distribution groups, preventing inbound/outbound email to and from the mailbox (including setting delivery restrictions and configuring message size limits), hiding the mailbox from the Global Address List (GAL), and also setting an account expiration date on the user account in Active Direcory. Licensing costs are not a concern in this scenario, because you do not need a Client Access License (CAL) for a mailbox that’s no longer active.

In Exchange Online, admins remove mailboxes for departed users. However, once you remove a mailbox, it can no longer be included in eDiscovery searches (using Multi-Mailbox Search in the previous version). Additionally, 30 days after you remove a mailbox, it is permanently deleted from Exchange Online and can no longer be recovered. Multi-Mailbox Search requires that the mailbox be active, which means an Exchange Online or Office 365 plan is required for the mailbox for as long as you want to preserve data for eDiscovery.

Note: You can preserve mailbox data offline by exporting it to a PST file using Microsoft Outlook and then remove the mailbox. However, if you need to perform an eDiscovery search, you would need to inject it back to an Exchange Online mailbox.

Inactive Mailboxes

In the new Exchange Online, we’ve introduced the concept of inactive mailboxes to handle departed users. When a user leaves the organization and you need to retain their mailbox data for some time to facilitate eDiscovery (or meet retention or business requirements), you can place the mailbox on In-Place Hold before removing it. This preserves the mailbox, but prevents it from sending/receiving messages, hides it from users so it's no longer visible in the GAL and other recipient lists. You can add inactive mailboxes to In-Place eDiscovery searches. Inactive mailboxes do not require an Exchange Online or Office 365 plan.

When your eDiscovery, retention or other business requirements are met and you no longer need to preserve the mailbox content, you can remove the mailbox from In-Place Hold...

For more details, see Managing Inactive Mailboxes (short url: aka.ms/inactivembx) in Exchange Online documentation.

Given the business I've been in for the last 1.5 decades (Lit Support/EDD/ESI/eDiscovery/etc), I think it's great to see a big name email vendor get serious about eDiscovery and help solve real world problems like this . Now I want to see this feature become part of on-premise Exchange too (being in the Legal biz space, "cloud" = "No way in hell")