What is email journaling?

Email journaling is where a copy of all email traffic sent and received by an organisation (and optionally, within an organisation) is written to a separate, single-instanced store.

In comparison to a regular mailbox, this store cannot be accessed or deleted by the individuals that sent or received the email.

As well as capturing the email ‘body’, a journal preserves the email envelope data.  By this we mean the metadata that describes exactly who was intended to receive a copy of the email, including the original TO: and FROM: addresses, as well as:

• Any recipients BCC’d on correspondence
• Any recipients that were part of a local distribution list (e.g., sales@acme.com)

As such, the journal provides a reliable record that can be used to meet the compliance needs of an organisation.

Journaling provides a “golden copy”

Does Microsoft 365 solve my journaling needs?

The short answer: Partially.

Although you can configure journaling to take place in your Microsoft 365 messaging backbone, you cannot use Exchange Online mailboxes to provide the storage for your email journals.

You have to store your journals elsewhere.

As found in Microsoft’s documentation:

“You can’t designate an Exchange Online mailbox as a journaling mailbox. You can deliver journal reports to an on-premises archiving system or a third-party archiving service. If you’re running an Exchange hybrid deployment with your mailboxes split between on-premises servers and Exchange Online, you can designate an on-premises mailbox as the journaling mailbox for your Exchange Online and on-premises mailboxes.”

Microsoft 365 journaling hacks

Arguably, by setting the right retention policies in Microsoft 365 you can recreate the ‘effect’ of having a journal – including capturing those emails that were ‘BCC’d’.  You can read more about the importance of capturing BCC’d emails (and how to do this in Microsoft 365) here.

It’s also possible to migrate your historic journals into Exchange Online.  This might involve migrating a journal from Exchange on-premises, a third-party archive such as Enterprise Vault, or a hosted journaling service such as Mimecast.

Whilst this is technically possible – for example, by taking an extremely large journal and chopping it up into smaller chunks that will fit into a series of Microsoft 365 shared mailboxes with appropriate use of retention policies –  this approach is a hack.

For example, it can create search and discovery complications downstream as, in order to be complete, all relevant shared folders would need to be included in any future eDiscovery exercise, alongside regular mailboxes.

You should test any retention and eDiscovery strategy to ensure it aligns with your legal and compliance requirements and that the hold, collection and eDiscovery workflows deliver the results you expect.

Journaling Microsoft 365 in the Cloud

Cloud-based journaling can work alongside Microsoft 365 to solve both the retention of legacy journal archives and the go-forward journaling for an ‘air-gapped’ golden copy.

Much like insurance – you never know when your organisation will need to pull data from old emails.  If you don’t have a journaling system in place you run the risk of lacking the information needed which can ultimately cost much more than implementing a proper journaling solution in the first place. That’s why preparing in advance is key to preventing unnecessary problems in the future.

If you haven’t started looking into email journaling, now is as good a time as any to start.