Does Microsoft 365 provide email journaling?

At first glance, it would appear Microsoft 365 (specifically, Exchange online) offers email journaling

If you search the internet for ‘Microsoft365 journaling’, you’re likely to find this Microsoft article that describes how to configure journaling in Exchange Online.

Exchange online only offers part 1

That is to say, Microsoft 365 lets you configure an agent that will direct copies of selected emails (and their respective email envelopes) to a journal store.

It’s an interesting point to note that Microsoft 365 itself does not provide an email journal store.

The overheads of maintaining an email journal on premises, likewise, the costs of using a third-party cloud vendor to provide a journal service, can be prohibitive and something that many enterprises would like to avoid.

The good news is that there are now facilities in Microsoft 365 that can replace the role and functionality of the ‘traditional’ journal service.

This is how…

How does Microsoft 365 replace a conventional email journaling service?

Instead of providing a conventional journal, Microsoft has enhanced its Microsoft 365 model to achieve the same ‘compliance outcomes’ of a journal service.

Here are the key aspects to understand when comparing Microsoft 365 with an email journal:

A copy of every email sent and received is retained at the mailbox level

A journal intercepts emails ‘in transit’ – before they are delivered into recipient’s mailboxes or as they leave your messaging system.  They are retained in single, dedicated journal mailbox. 

By comparison, Microsoft 365 retains all emails at the individual mailbox level.  This is done by putting all mailboxes on Litigation Hold (or applying Microsoft 365 retention policies).  This means that all relevant emails sent and received are retained indefinitely (or until the retention policy expires).

Deleted emails are still discoverable

An email journal cannot be accessed by individuals – if a user deletes their copy of an email from their mailbox, a copy of that email (and proof that they sent or received it) still exists in the journal.

With Microsoft 365, even if a user deletes an email, the email gets removed from the user’s view, but is moved into a special hidden folder inside the Recoverable Items structure (RIF), where they are available to the eDiscovery process and retained in accordance with retention policies.

The vital ‘envelope information’ that journaling captures is now retained in Microsoft 365

A ‘traditional’ journal captures addressee information that would not normally be seen by the email recipient, the most including BCC’d recipients and the members of distribution lists (DLs).  This is information that would not normally be visible at the mailbox level (although DLs can be expanded by the user).

To fill this ‘gap’, Microsoft 365 ensures that any BCC’d recipients are retained indefinitely in the senders’ mailboxes.  Likewise, the members of any distribution lists (DLs) are expanded at the point of sending and stored in hidden headers in senders’ emails, so they are fully discoverable.

Retaining ‘journal’ data in Microsoft 365 does not create a storage issue

A regular journal is a single-instanced store.  For example, an email sent to 1,000 local recipients would only be stored once, along with the addresses of the 1,000 recipients.

By comparison, Microsoft 365 is a multi-instanced store.  Using the same example, 1,000 instances of the email would be stored – i.e. a copy in each mailbox.

You would think this created a storage problem, but this is not the case. To help with all this extra retention, Exchange mailboxes have an extra 100 GB Recoverable Items quota. As items are deleted or changed, the Mailbox Folder Assistant checks each item against your retention policies and keeps a copy in the RIF if necessary.

Additionally, any Inactive mailboxes (i.e., those mailboxes belonging to leavers) can be put on Indefinite Hold without a license penalty.

Can we migrate a conventional journal into Microsoft 365?

We often engage with organisations that have previously invested in third-party journaling solutions. These solutions could be on-premises using an Exchange server or email archive like Enterprise Vault, or cloud-based services such as Mimecast. However, many of these organisations are now looking to reduce costs by migrating wholly to Microsoft 365 security and email retention services.

As you will have gathered by now, although the role of an email journal can be replaced by Microsoft 365, the way in which these two models work is very different.

In fact, it’s a bit like putting a square peg into a round hole and you need to be careful how you do it to end up with the best compliance outcomes.

There’s at least two approaches to migrating an existing journal into Microsoft 365, each of which offers different outcomes and caveats when it comes to future data management and eDiscovery.

For more information about your journal to Microsoft 365 migration options, get in touch with our migration team.