O365 Email Policies/Retention tags/Manual purging

[Tefters]

Afternoon all, 

 

Feels like I'm pushing a boulder up a hill in regards to Office 365 email maintenance. 

 

I'm trying to set up methods for deleting emails intended for all staff after 14 days, which is a distribution list, e.g., any email that has a 'To', 'CC', or 'Bcc' of [email protected].

I've tried using retention tags, retention policies, compliance searches, compliance search actions, and bashing my head against a wall, and surprisingly, none have worked.

 

Is there anyone out there who is successfully managing emails via any method in O365? Especially relating to distribution list emails

[TechMonkey]

One thing you may be hitting is I seem to remember someone finding the rules only applied after a certain time, or from after it was applied. Could this be the delay?

 

I haven't been this specific with rules but I can look tomorrow and see if I can set one up.

[Tefters]

I think tomorrow I need to try a new approach for testing by going after some test emails from specific individuals using the same methods I've been trying and see whether I hit the same issues I have gotten when trying to do distribution list emails.

 

I have been trying to apply retention tags to any email sent to [email protected] but their is the catch here where I want this to be picked up from both a sender perspective in their sent items and the receiver perspective however to the receiver the email looks like it's come from the individual sender because technically it has and just displays the To: field as [email protected] so that's the only field I can really attack for the search criteria (I'm sweeping bcc and cc into To: here as well while talking).

 

Retention tags I have left for months and nothing has happened.

Retention tags are supposed to be old hat and now replaced by retention policies and something else retention (can't remember name at moment) which are now located in Microsoft Purview, tried these and left for a week's, nada. These things also work on KQL for the search criteria which is.. fun, shall we say.

 

I've then tried to be smarter and use compliance searches and compliance search actions also through Purview via power shell and whole I can find items relating to [email protected] when I try expanding that KQL query to include a date modifier of over 14 days I get 0 back which is baloney.

I excepted defeat on the date range after testing that on its own and getting some right stupid results so proceeded on with just finding and deleting all [email protected] emails from my mailbox.

 

Run the search, find 850 odd items, seems roughly right if not a little low but it's a number so let's see hey, setup the compliance action for hard delete against the report and what happens, nothing. All I get back is an instant complete with a report message of "this failed due to genetic error, please try again later". This has been everyday for 5 working days so I'm not buying it.

 

Now, there is a new preview option in Microsoft Purview in the UI called emergency delete or something like that, this peaked my interest and off I went to play. It's aimedd at nuking email quickly and query based, bingo! While I'm not in a rush I just want a method to delete emails from peoples mailboxes based on queries and have it actually work, at this point I hate to say it but i miss Exchange on-prem, I would of had this done in a day or two.

 

Well... Turns out this new purge feature needs 4 separate accounts to complete, 1 to setup the job and 3 to then authorise the deletion at varying levels of authority, sort of like are you sure, are you sure he is sure, are you sure he is sure that the first person is sure that the creator knows wtf their doing. I mean we are in the realms of some serious compliance process bullplop now when I just want to delete emails from peoples boxes as a global admin because we have emails lying around full of kids names for years due to people sending out all staff communications with Jonny has detention today and Amanda has a flu jab and Phil is a concern for XYZ etc... and then a parent raises a SAR and boom 20 million of these emails come up as 1 email trigger 250 hits, 1 for the sender and 249 for the receivers.

 

Now maybe this is because it's DL based as mentioned before and that's an issue but if a compliance search can find items why can't I then delete them. Tags aren't picking them up and doing a 14 day hard delete either and office 365 support is full of first line help desk monkeys that I can never get through to or answer from anyone competent after 2 weeks.

 

While writing this and racking my brain I might see if moving forward I can do some sort of mail flow rule in exchange online to append something specific in the subject line to any email sent to this DL and then use that as the reference for a future retention tags but it doesn't help me with the current issue of needing to find and delete the emails currently sat in the boxes.

[ITGuyNW]

Did you get anywhere with this?