Change the hold duration for an inactive mailbox

Microsoft 365 licensing guidance for security & compliance.

An inactive mailbox is mailbox state that is used to retain a former employee's email after they leave your organization. A mailbox becomes inactive when an applicable hold is applied to it before the Microsoft 365 user object is deleted. The following types of holds initiate the creation of an inactive mailbox upon user account deletion:

• Microsoft 365 retention policies and labels with retain-only, or retain and delete settings.

• A hold associated with an eDiscovery case.

• Litigation Hold.

• An existing In-Place Hold.

Once made inactive, the contents of the mailbox including the Recoverable Items folder are retained until the hold that was placed on the mailbox before it was made inactive no longer applies.

If the applicable hold is not time-based, such as a hold associated with an indefinite retain-only Microsoft 365 retention policy or label, an eDiscovery case or Litigation Hold (without a LitigationHoldDuration configured), the mailbox content is retained indefinitely until the hold is removed.

However, if the hold is time-based, the mailbox content is retained until the hold duration expires. At this time, any items in the Recoverable Items folder are permanently deleted (purged) from the inactive mailbox.

As regulations and policies evolve, there may be some situations in which you need to change the duration of the hold assigned to the inactive mailbox. The following steps outline how to do this.

Connect to PowerShell

As we mentioned before, many different types of holds can trigger the creation of an inactive mailbox. For this reason, in order to change the hold duration applied to the inactive mailbox, you must first identify what type of holds are affecting it. To identify the type of holds, you must use Exchange Online PowerShell to identify the types of holds. If the inactive mailbox is affected by Microsoft 365 retention policies or labels, you must also use Security & Compliance PowerShell to identify the specific policies.

• To connect to Exchange Online PowerShell or Security & Compliance PowerShell, see one of the following topics:

  • Connect to Exchange Online PowerShell

  • Connect to Security & Compliance PowerShell

Step 1: Identify the holds on an inactive mailbox

Because different types of holds or one or more Microsoft 365 retention policies might be placed on an inactive mailbox, the first step is to identify the holds on an inactive mailbox.

Run the following command in Exchange Online PowerShell to display the hold information for a specific inactive mailbox in your organization.

Get-Mailbox -Identity <identity of inactive mailbox> -InactiveMailboxOnly | FL DisplayName,Name,DistinguishedName,ExchangeGuid,IsInactiveMailbox,LitigationHoldEnabled,LitigationHoldDuration,LitigationHoldDate,LitigationHoldOwner,InPlaceHolds,ComplianceTagHoldApplied

If you need to identify the type of hold for multiple inactive mailboxes and your organization has a large number of them, it may become unmanageable to view using PowerShell. In this case, you can export all of the applicable information to a CSV file using the following command and modifying the Path as needed for your environment:

Get-Mailbox -InactiveMailboxOnly -ResultSize Unlimited | Select DisplayName,Name,DistinguishedName,ExchangeGuid,IsInactiveMailbox,LitigationHoldEnabled,LitigationHoldDuration,LitigationHoldDate,LitigationHoldOwner,InPlaceHolds,ComplianceTagHoldApplied | Export-Csv -NoTypeInformation -Path "C:\Temp\InactiveMailboxHoldTypes.csv"

For the purposes of this example, the following shows results for six inactive mailboxes with different possible hold types.

DisplayName              : Ann Beebe
Name                     : annb
DistinguishedName        : CN=annb,OU=Soft Deleted
                           Objects,OU=contoso.onmicrosoft.com,OU=Microsoft Exchange
                           Hosted Organizations,DC=NAMPR06A007,DC=PROD,DC=OUTLOOK,DC=COM
ExchangeGuid             : 664ef44e-c1a0-47b0-9553-2ecdfc6ef840
IsInactiveMailbox        : True
LitigationHoldEnabled    : True
LitigationHoldDuration   : 365.00:00:00
LitigationHoldDate       : 10/25/2021 6:54:57 PM
LitigationHoldOwner      : [email protected]
InPlaceHolds             : {}
ComplianceTagHoldApplied : False
...
DisplayName              : Carol Olson
Name                     : carolo
DistinguishedName        : CN=carolo,OU=Soft Deleted
                           Objects,OU=contoso.onmicrosoft.com,OU=Microsoft Exchange
                           Hosted Organizations,DC=NAMPR06A007,DC=PROD,DC=OUTLOOK,DC=COM
ExchangeGuid             : e646a369-00bf-43d3-837a-8eae8b301d44
IsInactiveMailbox        : True
LitigationHoldEnabled    : False
LitigationHoldDuration   : Unlimited
LitigationHoldDate       :
LitigationHoldOwner      :
InPlaceHolds             : {mbxcdbbb86ce60342489bff371876e7f224:3}
ComplianceTagHoldApplied : False
...
DisplayName              : Megan Bowen
Name                     : meganb
DistinguishedName        : CN=meganb,OU=Soft Deleted
                           Objects,OU=contoso.onmicrosoft.com,OU=Microsoft Exchange
                           Hosted Organizations,DC=NAMPR06A007,DC=PROD,DC=OUTLOOK,DC=COM
ExchangeGuid             : 36ec77cb-c524-468a-a8e8-bfb75e01a176
IsInactiveMailbox        : True
LitigationHoldEnabled    : False
LitigationHoldDuration   : Unlimited
LitigationHoldDate       :
LitigationHoldOwner      :
InPlaceHolds             : {mbx6fe063689d404a5bb9940eed0f0bf5d2:1}
ComplianceTagHoldApplied : True
...
DisplayName              : Mario Necaise
Name                     : marion
DistinguishedName        : CN=marion,OU=Soft Deleted
                           Objects,OU=contoso.onmicrosoft.com,OU=Microsoft Exchange
                           Hosted Organizations,DC=NAMPR06A007,DC=PROD,DC=OUTLOOK,DC=COM
ExchangeGuid             : 0579e039-a695-40d5-8f0a-0dc04f4b4c8f
IsInactiveMailbox        : True
LitigationHoldEnabled    : False
LitigationHoldDuration   : Unlimited
LitigationHoldDate       :
LitigationHoldOwner      :
InPlaceHolds             : {}
ComplianceTagHoldApplied : False
...
DisplayName              : Abraham McMahon
Name                     : abrahamm
DistinguishedName        : CN=abrahamm,OU=Soft Deleted
                           Objects,OU=contoso.onmicrosoft.com,OU=Microsoft Exchange
                           Hosted Organizations,DC=NAMPR06A007,DC=PROD,DC=OUTLOOK,DC=COM
ExchangeGuid             : 55ad8905-4e68-4c8d-940d-e068ec6b51fc
IsInactiveMailbox        : True
LitigationHoldEnabled    : False
LitigationHoldDuration   : Unlimited
LitigationHoldDate       :
LitigationHoldOwner      :
InPlaceHolds             : {UniH7d895d48-7e23-4a8d-8346-533c3beac15d}
ComplianceTagHoldApplied : False
...
DisplayName              : Pilar Pinilla
Name                     : pilarp
DistinguishedName        : CN=pilarp,OU=Soft Deleted
                           Objects,OU=contoso.onmicrosoft.com,OU=Microsoft Exchange
                           Hosted Organizations,DC=NAMPR06A007,DC=PROD,DC=OUTLOOK,DC=COM
ExchangeGuid             : 8d7867d6-bb6d-4cd8-a51f-09d208f97fcc
IsInactiveMailbox        : True
LitigationHoldEnabled    : False
LitigationHoldDuration   : Unlimited
LitigationHoldDate       :
LitigationHoldOwner      :
InPlaceHolds             : {c0ba3ce811b6432a8751430937152491}
ComplianceTagHoldApplied : False

The following table identifies the six different hold types that were used to make each mailbox inactive from the above example.

Step 2: Change the hold duration for an inactive mailbox

After you identify what type of hold is placed on the inactive mailbox (and whether there are multiple holds), the next step is to change the duration for the hold. The process varies depending on the type of hold applied.

• Change the duration for a Microsoft 365 retention policy

• Change the duration for a Microsoft 365 retention label

• Change the duration for an eDiscovery Hold

• Change the duration for a Litigation Hold

• Change the duration for an In-Place Hold

Change the duration for a Microsoft 365 retention policy

In order to modify the hold duration for a Microsoft 365 retention policy, you must first identify the policy affecting the inactive mailbox by running Get-RetentionCompliancePolicy with the associated GUID from the InPlaceHolds property on the mailbox in Security & Compliance PowerShell.

Be sure to remove the prefix and suffix from the GUID when running this command. For example, using our previous sample information, take the InPlaceHolds value of mbxcdbbb86ce60342489bff371876e7f224:3 then remove mbx and :3 resulting in a policy GUID of cdbbb86ce60342489bff371876e7f224. In this example, run:

Get-RetentionCompliancePolicy cdbbb86ce60342489bff371876e7f224 | FL Name

Once you know the name of the policy, you can simply modify the retention policy in the Microsoft Purview portal or the Microsoft Purview compliance portal. Retention policies are typically applied to more than one location, so modifying the policy affects all applied locations - both inactive and active, which may also include locations other than Exchange. For more information, see Create and configure retention policies.

If the intention is to modify the retention period for only inactive mailboxes, or only specific inactive mailboxes, you may consider deploying adaptive policy scopes, which can be used to individually target specific mailboxes - or mailbox types, such as inactive mailboxes - using Microsoft Entra ID and Exchange attributes and properties.

Change the duration for a Microsoft 365 retention label

As with retention policies, when you modify the hold duration of a Microsoft 365 retention label, you must first identify the policy that publishes the label affecting the content within the inactive mailbox. To identify that policy, run Get-RetentionCompliancePolicy with the associated GUID from the InPlaceHolds property on the mailbox in Security & Compliance PowerShell.

Be sure to remove the prefix and suffix from the GUID when running this command. For example, using the previous sample information, you take the InPlaceHolds value of mbx6fe063689d404a5bb9940eed0f0bf5d2:1 then remove mbx and :1, which results in a policy GUID of 6fe063689d404a5bb9940eed0f0bf5d2. In this example, you run:

Get-RetentionCompliancePolicy 6fe063689d404a5bb9940eed0f0bf5d2 | FL Name

After you identify the policy, you'll know which labels have been published and their settings. Because labels apply to individual items, depending on the number of labels published with the policy and their settings, you may not be able to directly identify which label is affecting the content.

One method that you can use to identify the content each label applies to is to use Content Search. For example, using the previous sample information, assume the policy publishes several labels, one of which is named "HR-Content". With the correct permissions, you can run a Content Search with the New-ComplianceSearch PowerShell command, specify the inactive mailbox's primary SMTP address, pre-pended with a period (.), and the -AllowNotFoundExchangeLocationsEnabled $true parameter to skip validation:

New-ComplianceSearch -Name "MeganB Inactive Mailbox HR-Content Label Search" -ExchangeLocation [email protected] -AllowNotFoundExchangeLocationsEnabled $true -ContentMatchQuery "compliancetag=HR-Content"

After the search is created, start the search using the following command:

Start-ComplianceSearch "MeganB Inactive Mailbox HR-Content Label Search"

Using this method, you can then identify which labels from the identified label policy apply to content within the inactive mailbox so that you can modify their retention periods. Retention labels are typically applied to more than one location, so modifying a label affects all applied locations and labeled content, which may also include locations and content other than Exchange. For more information, see Publish retention labels and apply them in apps.

Change the duration for an eDiscovery Hold

Holds associated with eDiscovery cases are indefinite holds, which means there's no hold duration that can be changed. Items are held forever or until the hold is removed or the case is closed.

Change the duration for a Litigation Hold

You must use Exchange Online PowerShell to change the hold duration for a Litigation Hold that is placed on an inactive mailbox. You can't use the Exchange admin center. Run the following command to change the hold duration. In this example, the hold duration is changed to an unlimited period of time:

Set-Mailbox -InactiveMailbox -Identity <identity of inactive mailbox> -LitigationHoldDuration unlimited

The result is that items in the inactive mailbox are retained indefinitely or until the hold is removed or the hold duration is changed to a different value.

Change the duration for an In-Place Hold

In-Place Holds are retired and can no longer be modified. If an inactive mailbox has an In-Place Hold applied to it, you can't change the hold duration. You can only remove the In-Place Hold, which will result in the deletion of the inactive mailbox. For more information, see Delete an inactive mailbox.

More information

• How is the hold duration calculated for an item in an inactive mailbox? The duration is calculated from the original date a mailbox item was received or created.

• What happens when the hold duration expires? When the hold duration expires for a mailbox item in the Recoverable Items folder, the item is permanently deleted (purged) from the inactive mailbox. If there's no duration specified for the hold placed on the inactive mailbox, items in the Recoverable Items folder are never purged (unless the hold duration for the inactive mailbox is changed).

• Is an Exchange MRM policy still processed on inactive mailboxes? If an MRM retention policy was applied to a mailbox before it went inactive, any deletion policies (MRM retention tags configured with a Delete action) continue to be processed on the inactive mailbox. That means items that are tagged with an MRM deletion policy are be moved to the Recoverable Items folder when the retention period expires. Those items are purged from the inactive mailbox when the hold duration expires. If a hold duration isn't specified for the inactive mailbox, items in the Recover Items folder are retained indefinitely.

  Conversely, any archive policies (MRM retention tags configured with a MoveToArchive action) that are included in the MRM retention policy assigned to an inactive mailbox are ignored. That means items in an inactive mailbox that are tagged with an archive policy remain in the primary mailbox when the retention period expires. They're not moved to the archive mailbox or to the Recoverable Items folder in the archive mailbox. They are retained indefinitely.

  Note

  Applying an Exchange retention policy (the messaging records management, or MRM, feature in Exchange Online) does not create an inactive mailbox when the user account is deleted.

• As with regular mailboxes, the Managed Folder Assistant (MFA) also processes inactive mailboxes. In Exchange Online, the MFA processes mailboxes approximately once every seven days. After you change the hold duration for an inactive mailbox, you can use the Start-ManagedFolderAssistant cmdlet to immediately start processing the new hold duration for the inactive mailbox. Run the following command.

  Start-ManagedFolderAssistant -InactiveMailbox <identity of inactive mailbox>
  

• If many InPlaceHolds are placed on an inactive mailbox, not all of the hold GUIDs will be displayed. You can run the following command to display the GUIDs for all InPlaceHolds that are placed on an inactive mailbox.

  Get-Mailbox -InactiveMailboxOnly -Identity <identity of inactive mailbox> | Select-Object -ExpandProperty InPlaceHolds