Keep deleted mails

[JhonnyK]

Hello everyone! I want to keep saving of all emails ever delivered to office 365 mail box, even if user would have deleted files (delete from the bin) it should still be availbe in the bin of veaam's backup. Is it possible?

[Mildur]

Hi Jonny

Veeam can only keep mails in his backup repo, when they exist at the moment when the backup of the mailbox is starting.
When a user receives the mail and permanently delete it before the next backup has started, it is gone and veeam cannot backup the mail. A user is able to purge the mail even from the „permanently deleted folder“.

What you are looking for is a archiving software for mails which leverages the mailbox journaling. Veeam doesn‘t provide this feature.

With veeam, there would be only workarounds. Some bad ones, some good ones but with a chance to not get all received items in to the backup repo.
If this question is for a legal reason or a regulation you must be compliance, then I would recommend to look for a archive software.

You could put the mailbox on litigation hold (check the global folder exclusions in vbo365), then veeam could backup this folder and the enduser would not be able to completely delete a received mail. I don‘t recommend todo that forever for all mailboxes. It‘s more like a short time option if you need to backup the data for a few days or weeks for a single user.

Second option, veeam creates backups of the permanently deleted item folder. If an enduser receives a mail and deletes it immediately, the item will be moved to this folder. I think it will stay there for 14 days (default configuration, can be extended to 30 days in exo powershell). The received mail would be in the backup, but the enduser can purge them in his outlook from the permanently deleted folders. Then it would be lost and cannot be back-ed up.

[Regnor]

@Mildur: Are you sure about the last one? I think, the 14 days retention still applies even if the user permanently deletes the emails. The user can no longer see this email but it should still be somewhere under the Recoverable Items folder. I'll need to verify that as I'm not 100% sure.

[Mildur]

@Max
Yeah, if I remember correctly, it will be removed from this folder when the enduser purge the mail from the „permanently deleted folder“ feature.
I will test it too.

[Mike Resseler]

@Regnor @Mildur

It depends. If you have the rights to purge it, then the 14 days don't apply. But you need to have that permission and by default no-one has it. I do cannot remember anymore what exact permission it is, because I find it weird that you actually would use that, unless we are talking about a playground environment

[Mildur]

Thanks Mike.
If I must archive each Mail, I would use the right Archiving Software.

[Regnor]

I would also be on Mike's side, an enduser should not be able to purge emails, although he will no longer be able to access them.
At least it was like that in the on-premises world, so I would think it's the same in EXO as no use should be able to circumvent the default 14 days.
But...I've just tried it myself and the purges folder isn't visible in VBO/Exchange Explorer.
Via discovery search I can see that the email is still there: "\XXX@XXX.OnMicrosoft.com (Primary)\Recoverable Items\Purges"
So probably VBO isn't able to backup the purges ordner or it is a limitation of Modern Authentication?

Regardless of that, you're right @Mildur; backup and archiv are two different things.
So on the topic, if you want to ensure that you're not missing/losing emails then either litigation hold or journaling are the correct EXO features.

[Mike Resseler]

@@Regnor
I will verify why the purges is not there, it might be that we have no access to it

[Mike Resseler]

@Regnor

Good news, the purges information is actually there and seen in the Veeam Explorer. However, because of the way it is being stored, you will need to find it somewhere else (long story but there is documentation from Microsoft that explains how that IPM tree exactly works)

You should be able to find those mesages under the litigation hold items folder in the Veeam Explorer

[Regnor]

Unfortunately not in my case. I had to enable it's backup in the general options in order to see the litigation hold folder, but it stated empty.

[Mike Resseler]

@Regnor

Can you perform one more test with a dummy email and take that backup? I looked at it and shows it in the Veeam Explorer under Litigation Hold Items (purge)
You also should be able to see a folder called Permanently Deletions Items there

[Regnor]

I'm sorry for the late feedback Mike, I wasn't able to test it earlier.
In my lab I wasn't able to access the purged/hard deleted items, the folder was just empty. In a different environment those elements were shown unter Litigation hold, but I first had to remove the Litigation Hold items folder from the exclusions in the VBO options; before that the folder wasn't listed in the Explorer. Can you confirm that?

[Mike Resseler]

Correct, you do need to have that folder protected.

[Regnor]

Thanks for confirming.
So to sum it up for JhonnyK and everyone else: Deleted items are getting protected, but you need to remove the "Litigation Hold Items" folder from the exclusions.

@Mike: I would say many users/admins are thinking that the deleted/purged items are included in the backup per default, which is not the case.
Does it make sense to remove this folder from the exclusions in future versions? I'm not sure if this will/could cause issues, but I don't think that many customer use litigation hold.
If not, then I would suggest to rename the exclusion to "Litigation Hold / Purged items" and include a note in the documentation.

[Mike Resseler]

@Regnor

We took that setting because at first we were getting lots of complaints of high-volume backups because of that folder and people didn't estimate for it. Which caused in issues with storage availability.

[Regnor]

Ok, I wouldn't have thought that it would make a big difference. But still it's not ideal to exclude those items. At least there should be some kind of hint or warning about that.

[Mike Resseler]

@regnor,

Understood.