Q2<\/strong>: What is the built-in mechanism that Exchange server architecture provides for dealing with such scenarios?<\/p>\n Q3<\/strong>: What are the available options when we host our mail infrastructure on Office 365?<\/p>\n So, let’s see some of the answers to this questions.<\/p>\n In other words: Don’t even dream that you can call to the Exchange Online support team instruct them to solve the problem by doing \u201csome magic\u201d and inform the user that \u201ceverything is OK\u201d. if This solution doesn’t exist yet! However, we still have ways to deal with this situation!<\/p>\n Many times, during Office 365 deployments, we here something similar:<\/strong>\u00a0So what are you telling me? Do you say<\/strong> that it\u2019s not passable to deal with a scenario in which we need to recover or restore mail for our Exchange Online users?<\/em><\/p>\n Our usual response to those questions<\/strong>: We just say<\/strong>\u00a0is that in Exchange and Office 365 environment, we can use the built-in capabilities the Exchange architecture offer for \u2013 dealing with such scenarios (recover mail items). The available built-in Exchange option are \u2013 single item recovery<\/strong> or, other Exchange Online services such as Litigation Hold<\/strong> or In-Place Hold<\/strong>.<\/p>\n To be able to provide good answers and good services for our customers, we will need to know about the available options, the limitations, and the best practices for dealing with a scenario of missing mail and so on.<\/p>\n The source for this misconception is \u2013 when we read about the \u201chigh availability of cloud services\u201d (such as office 365) and the \u201cinsurance\u201d that we have regarded scenarios of DRP (disaster and recovery plan), we automatically \u201ctranslate\u201d this information under the assumption that \u2013 in a cloud environment, deleted mail items will always be available for us.<\/p>\n It\u2019s a truth that Microsoft has an infrastructure for backing up all the \u201ccustomer information<\/strong>\u201d. These \u201cbackups<\/strong>\u201d, could serve for restoring data in case of \u201cdisaster\u201d such as storage corruption, server hardware failure or even a catastrophic event of \u201ccomplete Data Center failure\u201d. The important thing that we should understand is that this ability, can be used ONLY<\/strong> for scenarios of \u201cDisaster<\/strong>\u201d, and not for a situation of recovering a particular deleted mail item.<\/p>\n The source for this misconception is \u2013 we are used to associating to term \u201carchive<\/strong>\u201d with another term such as \u201cbackup<\/strong>\u201d. I can’t remember even one project where it wasn’t required to do an explanation about this!<\/em><\/p>\n In Exchange Online (office 365) environment, the primary purpose of the Exchange Online archive is not to back up the user mail items, but instead, improve the Outlook mail client performance. Mail items that are sent or saved in the Online Archive NOT saved<\/strong> to the local OST file (cache mode<\/strong>).<\/p>\n In case that a user deletes mail from the online archive, the mail item will be deleted like any \u201cstandard\u201d mail item.<\/em><\/strong><\/p>\n Let\u2019s make it clear and very simple \u2013 the default Exchange Online deleted mail policy value is \u2013 14 days!<\/strong><\/p>\n In case that a user implemented \u201cHard delete\u201d the mail item considers as \u201crecoverable\u201d for a period of ONLY 14 days.\u00a0After this period, the mail item will be lost forever<\/strong>! There is no option for recovering such as a mail item in the Exchange Online (Office 365) environment!<\/p>\n Office 365 customers who use Exchange Plan <\/strong>E1,E3 or E5<\/strong> license can extend the default deleted mail item policy for 30 days<\/strong> + use the option of Litigation Hold<\/strong> or In-Place Hold<\/strong> that enable to keep mail items for a longer period or forever, but this option cannot be implemented in retrospect!<\/p>\n In other words \u2013 if the Exchange Online administrator didn\u2019t \u201cactivate\u201d the described options in advance, we are still subject to the \u201c14 Days Rule<\/strong>\u201d.<\/p>\n 4. In O365 environment, I can recover the user mailbox to his \u201coriginal state\u201d<\/strong><\/p>\n<\/div>\n False assumption 1<\/strong> \u2013 restore the user mailbox snapshot.<\/p>\n Usually, when Exchange Online (O365) administrator says that sentence their meaning is translated to the option of restoring a snapshot of the user mailbox sometimes refers as \u201cpoint in time<\/strong>\u201d in which the user mailbox will behave all the mail items\u00a0and the folder structure that the user had at a particular point in time.<\/p>\n The Exchange Online infrastructure doesn\u2019t include this option<\/strong>. There is no way<\/strong> to restore the user mailbox to a particular point in time.<\/p>\n False assumption 2<\/strong> \u2013 restore mail items to the original location.<\/p>\n For example, in case that the deleted mail item located in the inbox folder, when I use the available option for recovering the specific mail items, it will be restored to \u201chis original folder\u201d meaning \u2013 the inbox folder.<\/p>\n In a recovery scenario in which we use Outlook or OWA mail client for recovering a mail item, the mail item will be restored to \u201chis original folder<\/strong>\u201d but not to the folder that we consider as \u201coriginal<\/strong>.\u201d<\/p>\n When we delete a mail item, \u201chis original folder\u201d become the Deleted items folder<\/strong><\/p>\n When we restore the mail items from the Recoverable Items folder, <\/strong>the mail item will be restored to the Deleted items folder<\/strong> and not<\/strong> to the inbox folder!<\/p>\n In a scenario that you have Exchange 2013 or Exchange 2016 on-Premises, you will find that most of the infrastructure, the screenshot, and the interfaces are relevant also for the \u201con-Premises environment.\u201d<\/p>\n In many of the \u201cdeleted mail item\u201d scenario or in the \u201cMy mail disappeared!!\u201d\u00a0There is a common theory described as \u2013 \u201cThe \u201ccloud\u201d deleted my mail.\u201d<\/p>\n The truth is that there is some logic behind this hypothesis because we all know that at night, the Office 365 deleted mail demon<\/strong> comes and deletes our Poor user\u2019s E-mails ruthlessly!!!<\/p>\n Theoretically, there is a possibility that the causes for the deleted mail item relate in some way to the Exchange Online infrastructure but, my opinion is that chance for this scenario is identical to the chance in which you win the grand prize lottery three weeks in a row.<\/p>\n A user calls the help desk support and reports that his mail disappeared!!!<\/p>\n In case that the user is a VIP, or the user makes a lot of noise, we are entering into a panic mode and want to be able to find the \u201cmagic formula\u201d that everything returns to the previous state!<\/p>\n Before we get into the panic state, let’s try to answer two important questions<\/p>\n 1. What is the meaning of \u201cmy mail\u201d?<\/p>\n 2. What is the meaning of \u201cdisappeared\u201d?<\/p>\n When does the user say that his mail \u201cdisappeared\u201d does it mean that the mail deleted? Does it mean that the mail exists, but for some reason, he cannot see or find the particular mail item?<\/p>\n I am sure, you all understand that it\u2019s crucial that we will have a clear understanding of the event characters!<\/p>\n Before we start to fire in all directions, we need to verify if this is a simple scenario in which the mail exists, but the user cannot find it or, a scenario in which we cannot locate the specific mail items, and we can assume that the E-mail can consider as \u201cdeleted.\u201d<\/p>\n We a user reports that he cannot find his E-mail, many times the meaning is that the mail exists, but not where the user expects to find in his mail.<\/p>\n For example<\/strong><\/p>\n The solution<\/strong><\/p>\n In a scenario in which users report that his mail was disappeared\\deleted\\evaporated or any other term, before we start to think about the worst-case scenario, let\u2019s start with a simple \u201csearch operation.\u201d<\/p>\n The best practice is to search for the \u201cmissing in action\u201d mail items by using the OWA mail client because, when we use the OWA mail client, we eliminate a scenario in which the problem related to a synchronization problem.<\/p>\n Let\u2019s assume that we have implemented a thorough search in the user mailbox and, we could not find the mail items that were reported as \u201cmissing\u201d.\u00a0In this stage, we have a reasonable basis to believe that the mail deleted.<\/p>\n Let’s see some of the \u201ccommon causes\u201d for mail deletion scenario.<\/p>\n 1. Mail item that was deleted by the user himself.<\/strong><\/p>\n Despite that we are not willing to consider this scenario, in real life, the reason for the deleted mail item could be the user himself.\u00a0It doesn\u2019t matter if the user deleted the mail in the past and, forgot that he deleted the mail or the mail accidentally deleted.\u00a0What is important is that we should consider this option before we start to fire in all directions to seek to blame the environment.<\/p>\n 2. Antivirus<\/strong><\/p>\n Most of the time we relate to Antivirus as an element that created for protecting the mailbox data, but in some scenarios, the Antivirus application could recognise a mail as a \u201cproblematic\u201d and decide to delete the mail items or remove some parts of the mail item such as attachment, etc.<\/p>\n 3. Virus or malware<\/strong><\/p>\n Any hostile code that exists on the user desktop or device and manages to delete mail items.<\/p>\n 4. Variety of mail client and mail protocols.<\/strong><\/p>\n In a modern environment, users access their mailbox from many different devices, application using a variety of mail protocols and so on.\u00a0In this \u201ccomplex environment\u201d, it\u2019s reasonable to assume that the scenario of deleted mail can cause a problem with a particular mail client, specific mail protocol-specific device, etc.<\/p>\n 5. Other users who have access to the specific user mailbox.<\/strong><\/p>\n One of the notable characteristics of the Exchange environment is the ability of \u201csharing resources such as mailbox or calendar.\u00a0The scenario in which mail items deleted can cause by users who have access (permission) to the user mailbox.\u00a0The \u201cdeletion\u201d could consider as deliberate action or mistake, but the important issue is that in case those other users have access to the user mailbox; the deletion could be related to another user.<\/p>\n 6. Outlook add-in or plugin.<\/strong><\/p>\n The purpose of Outlook add-on or plugin is \u201cto do something\u201d with the mail items that existed in the user mailbox. Most of the time, the Outlook add-in or plug-in has unlimited access to the mailbox content and some scenarios; the Outlook add-in or plugin could \u201cdecide\u201d to delete or remove a particular mail item.<\/p>\n 7. Mail Migration and corrupted mail items.<\/strong><\/p>\n In the case in which we migrate our mail infrastructure to Office 365, our underlying assumption is that all the mailbox content migrated to the cloud.\u00a0This assumption could be wrong<\/strong> in a scenario in which the \u201coriginal user mailbox\u201d includes a corrupt mail item. In this case, the corrupt E-mail items will not be migrated<\/u><\/strong> to the Office 365 Mailbox.<\/p>\n In this type of scenario, the user assumes that the mail items are waiting for him in the mailbox while, in reality, the E-mail never reached to the Office 365 mailbox.<\/p>\n 8. Exchange Online \u2013 Retention policy.<\/strong><\/p>\n Some organisation uses an Exchange retention policy and retention policy tag that \u201cmove\u201d mail item with a particular age to the archive mailbox or even deletes old mail items.<\/p>\n In case that your organisation uses retention policy, you will need to verify if the mail item that reported as \u201cdisappeared\u201d was just moved to the archive mailbox.<\/p>\n 9. Local PST file.<\/strong><\/p>\n In a scenario in which the user uses a local PST, an available option could be that the mail item was manually or automatically moved to the PST store.<\/p>\n Or another option is that the mail stored in PST file that is saved on the user desktop and at the current time, the user uses a different desktop that doesn\u2019t include the PST file.<\/p>\n 10. Problem with\u00a0Office 365<\/strong><\/p>\n This case added to the list as the \u201clast case\u201d because technically, this scenario could be an option.<\/p>\n To be honest, my opinion is that this type of scenario, in which the mail items were deleted by a \u201cproblem\u201d in Office 365 infrastructure considered as a very rare event or, even non-possible.<\/p>\n I mention this possible cause because theoretically, we cannot fully rule out this possibility.<\/p>\n One of the most popular confusion regarding the \u201cdeleted mail\u201d scenario, is related to the two different scenarios: Deleted Mail Item<\/strong> versus Deleted Mailbox<\/strong>.<\/p>\n Despite the so-called similarity, these two situations are entirely different<\/strong> from each other.<\/p>\n In Exchange (on-premises) and Office 365 environment, the term \u201cdeleted mail item\u201d can be translated to different type of Exchange mailbox items such as:<\/p>\n Each of this item considers as mail item.<\/p>\n The meaning of the term \u2013 \u201cDeleted Item Retention<\/strong> Policy<\/strong>\u201d relate to our ability to recover mail items that were deleted for a specific period of time.<\/p>\n The default Office 365\u00a0Deleted Item Retention<\/strong>\u00a0Policy<\/strong> defines a \u201crange\u201d of 14 days in which we can recover mail items that were deleted.<\/p>\n We have the ability to \u201cextend\u201d this default range up to 30 days, but we will need to use the PowerShell interface for implementing this \u201cextension\u201d and also; we will need to run the PowerShell command for each new mailbox that will create.<\/p>\n Example 1<\/strong>: Set Misha Hanin’s mailbox to keep deleted items for 30 days. In Exchange Management Shell, run the following command.<\/p>\n Example 2<\/strong>: Set all user mailboxes in the organisation to keep deleted items for 30 days. In Exchange Management Shell, run the following command<\/p>\n Note: The ability to extend the default 14-day limitation is available only to Office 365 customers who purchase at least E1,E3 or E5 license.<\/p>\n After an item has removed from the Deleted Items folder, it\u2019s kept in a Recoverable Items folder for an additional 14 days before being permanently removed. Users can recover the item during this 14-day period by using the Recover Deleted Items feature in the Outlook Web App or Outlook.<\/p>\n The Single Item Recovery period is 14 days by default, but administrators can increase this to a maximum of 30 days by using remote Windows PowerShell. To preserve E-mail for longer period than 30 days, organizations can implement long-term email preservation or time-based In-Place Holds.<\/p><\/blockquote>\n [Source of information<\/strong>: High Availability and Business Continuity<\/a>] One of the most common questions that are raised by Office 365 customers is the question about the possibility to save mail items for an unlimited period.<\/p>\n In other words, \u201coverride\u201d the default Deleted mail item policy<\/p>\n The good news is that office 365 offers this option by using one of the following Exchange Online features:<\/p>\n The option of Exchange Online Litigation Hold or Exchange Online, enables us to \u201coverride\u201d the default deleted mail items retention policy and enable a configuration in which we can \u201chold\u201d and recover (restore) mail items forever!<\/p>\n The important thing regarding Litigation Hold or In-Place Hold option, is that this \u201cfeature\u201d exists only when purchasing a specific Exchange Online license, like:<\/p>\n In the current blog post, we will not go into a detailed description of this Office 365 option but instead, focus on the Deleted Item retention<\/strong> policy and the Exchange Online architecture that is used for recovering mail items.<\/p>\n The common question among Office 365 clients is the question regarding the possibility of implementing some kind of user mailbox solutions.<\/p>\n Most of the time, the idea behind the backup \\ restore solution is the ability to restore the user mailbox to a specific \u201cpoint in time\u201d. This option sometimes described as a snapshot because the backup enabled us to capture a snapshot of the user mailbox and view the mailbox content as at appear at a particular time during the past.<\/p>\n At the current time, the Exchange Online infrastructure doesn\u2019t provide this type of service.\u00a0This kind of \u201csolutions\u201d are provided by third party backup and restores products that can provide this service in the office 365 base environment. As an example, you can take a look on\u00a0CodeTwo Backup for Office 365<\/a><\/p>\n As mentioned in the former section, in the current time Exchange Online doesn\u2019t include a backup solution that could describe as: \u201cpoint on time\u201d which will enable us to restore user mailbox status to a particular point in time.<\/p>\n The office 365 \u201cBackup solutions\u201d are based on the architecture or the concept which described as single mail item recovery<\/strong>.<\/p>\n The single mail item recovery concept implemented by using a \u201cset of mailbox hidden folder\u201d that serves as a \u201ccontainer\u201d for deleted mail items.<\/p>\n This technical name for the \u201cset of folders\u201d is: Recoverable Items folder<\/strong>.<\/p>\n Note<\/strong>: The previous term that used in the past for describing this set of \u201crecovery folders\u201d is- dumpster<\/strong>.<\/p>\n We use the term \u201chidden\u201d because by default the user cannot see this set of \u201crecovery folders\u201d as part of his \u201cstandard folder hierarchy.\u201d<\/p>\n We use the term \u201cset of folders\u201d because the deleted mail item is not saved in a specific folder but instead in a set of folders. Each of the folders has a particular \u201crule\u201d and purpose.<\/p>\n The backup and restore capabilities of Office 365 based on accessing this folder and \u201cpull out\u201d the mail items that stored in this set of folders.<\/p>\n office 365 include two features or components that enable us to \u201cextend\u201d the process or saving and recovering an E-mail item.<\/p>\n For example, the Exchange Online default Deleted Item retention<\/strong> policy will keep deleted mail items in the Recoverable Items folder<\/strong> for 14 days.<\/p>\n When we use the feature of Litigation Hold or In-Place Hold we can \u201cextend\u201d this limitation to an unlimited number of days.<\/p>\n The Litigation Hold or In-Place Hold components enable us to manage the required policy that we want to set for a specific mailbox or, on a set of mailboxes and when we need to recover data (deleted mail items), enable us to search and recover E-mail item.<\/p>\nThe purposes of the current blog post:<\/h4>\n
\n
<\/p>\nExchange Online and \u201cCommon Misconceptions\u201d Regarding Data Recovery and Backup<\/h3>\n
<\/p>\n1. The \u201ccloud\u201d backup my mail forever!<\/strong><\/h4>\n
2. When using the Office 365 Archive, My Mail is Backed Up!<\/strong><\/h4>\n
3. In a scenario that a user wants to recover mail that deleted a long time ago, I could call Microsoft support, and they will recover for me the required information!<\/strong><\/h4>\n
Exchange Online (Office 365) versus Exchange on-Premises<\/h3>\n
The \u201cCloud\u201d Deleted My Mail<\/h3>\n
My Mail Was Disappeared!!<\/h2>\n
\n
Mail is hidden from the user.<\/h3>\n
\n
\nAnother variation of this scenario could be a user; that consciously moves mail items from their original folder to another folder and over time, he forgot that he changed the original location of the mail item.<\/li>\n
\nMany times, when a user reports that he cannot find a specific mail item, the \u201cproblem\u201d is the particular view that hides the mail item.<\/li>\nThe 10 Major Causes for \u201cDeleted Mail Item\u201d Scenario<\/h2>\n
Recover a deleted mail item versus a scenario of \u2013 recover deleted Office 365 Mailbox<\/h3>\n
The meaning of \u201cmail item\u201d<\/h3>\n
\n
Default Deleted Mail Policy in an Office 365 Environment<\/h3>\n
Set-Mailbox -Identity \"Misha Hanin\" -RetainDeletedItemsFor 30<\/pre>\n
Get-Mailbox -ResultSize unlimited -Filter {(RecipientTypeDetails -eq 'UserMailbox')} | Set-Mailbox -RetainDeletedItemsFor 30<\/pre>\n
\n
<\/p>\n\u201cOverride\u201d the default Deleted Item Retention policy<\/h3>\n
\n
\n
![\"Legal-Hold-E1-E3-E5-1\"](\"http:\/\/dev.highclouder.com\/wp-content\/uploads\/2016\/09\/Legal-Hold-E1-E3-E5-1.jpg\")
<\/a>
\n[Source of information: Office 365 Business Plans<\/a>]<\/p>\nMailbox and Backup solution in Office 365 Environment<\/h3>\n
Exchange Online and Recoverable Items Folder<\/h3>\n
Exchange Online Litigation Hold and Exchange Online In-Place Hold<\/h3>\n