Six Critical Considerations for Exchange Online Archiving 

Adoption of Office 365 continues to grow rapidly, adding 50,000 customers a month, with Exchange email remaining the number one workload. At the same time, increasing regulation, litigation, and operational drivers necessitate the need for speedy, accurate and complete access to email data.

Email archiving has long been recognized as a key mechanism to meet these needs. Historically this was achieved on-premise alongside the mail server, but more recently has started to shift to the cloud in order to achieve economic and operational benefits. As email moves to the cloud, organizations must consider how to appropriately protect their data. Remembering that it’s their data, and responsibility ultimately sits with them to safeguard it, is critical.

With over 16% of Mimecast customers now using Office 365 for email, we’re often asked about what to look for in an email archive – specifically for protecting critical Exchange Online data. The following six critical considerations summarize the advice we give.

   1. Email data should be immutable by default

All inbound and outbound mail, including detailed metadata, should be captured and stored automatically for all users – without the need for manual or scripted processes. A true enterprise-grade email archive should be designed from the outset as a long-term, compliance-driven archive with immutable (WORM) storage and strong chains of custody. In this case, data cannot be modified or removed until the pre-defined retention period is reached.

A suitable archive allows for an independent, always-on, verifiable copy of data to be stored outside of the operational Office 365 infrastructure.

While Office 365’s in-place or litigation holds may satisfy some organizations’ requirements to preserve mailbox data, both were conceived to provide data preservation for active, ongoing litigation – not as a long-term immutable archive.

Mailboxes are not placed on litigation or in-place hold automatically - this is a manual task and can get inadvertently forgotten or misconfigured. Any mailbox content not on hold can be tampered with or deleted.

   2. Search speed and consistency

The explosion in the amount of data stored by most organizations along with stricter regulation and increased litigation requires a suitable storage architecture to ensure rapid and accurate archive search results. A dedicated, cloud-based grid storage architecture is best suited to this task so that archive searches benefit from the aggregate power of all servers in the storage grid, together with a unified index, to deliver consistent results at superfast speed.

There should be no limit to the number of mailboxes that can be searched and the number of searches that can be run concurrently. E-discovery searches should not be impacted by email system downtime.

With Exchange Online, users are connected to a single server and data store. Large deployments likely mean multiple servers and data stores – each with its own index. Mailboxes are spread automatically across servers.

As a result, e-discovery searches could require access to hundreds of servers and indexes – potentially liable to inconsistent search results, e.g. server busy, server down, and incomplete index (e.g. unsupported file types, indexing errors).

Search speed is limited by individual Exchange server performance – each with multiple competing workloads. There are limits on both the number of mailboxes (10,000) and the number of e-discovery searches that can be run at the same time.

   3. Minimize and limit specialized and manual admin tasks

Initial setup and ongoing administrator actions should all be managed through a single web-based graphical user interface (GUI). This negates the need for manual scripting which is more likely to result in misconfiguration and command errors that can result in significant data loss. Remember, humans, are often the weakest link in the chain.

Organizations should also ensure that no single administrator should be able to change key archive policies such as retention duration. This could increase the chances of accidental or malicious actions having a potentially devastating impact.

There are certain admin actions in Office 365 that can only be achieved through PowerShell commands, such as applying a litigation hold to all mailboxes at once, or in-place hold to more than 500 mailboxes. Misconfiguration and errors are arguably more likely in these manual processes.

A single Exchange administrator can remove a hold.

   4. Auditing must provide the details needed

Audit logs are vital to check and prove historical actions for both operational and legal purposes. Logs should be enabled by default and retained in perpetuity in order to ensure a complete record. The details logged must also be sufficient for the purposes they may be needed for. The logs should be held in a secure location accessible only to those with appropriate privileges.

In Office 365, auditing of admin actions is enabled by default and cannot be switched off. However, these logs are only kept for 90 days by default and do not include some actions, such as when messages are accessed or deleted, or the client or source details.

Mailbox audit logs must be manually setup and enabled per mailbox using PowerShell. These logs are stored in the target mailbox and could be deleted if the mailbox is deleted.

   5. Seamless employee archive access from anywhere

The amount of critical data in email is growing rapidly, with archives increasingly used by employees as their primary repository to save and access important information. In fact, Gartner estimates that by 2019, 75% of organizations will treat archive data, including email, as an active data source.

Seamless and rapid access to this archive data from any device is, therefore, critical. Consistent access should be available via Outlook, the web, and mobile devices. Archive searches must be virtually instant to satisfy employee expectations. Almost 200,000 archive searches a month are made by Mimecast customer employees using the Mimecast Mobile app alone, demonstrating the importance of having easy access to archived content when out of the office. Mimecast offers an industry leading 7-second search SLA.

Microsoft provides archive access via Outlook, Outlook on the web, Mac and iPad only. There is currently no support for iPhone or Android – the two most popular smartphone platforms globally. There is no Office 365 archive search SLA offered.

   6. Avoid mailbox lock-in

When archive data is held in a separate platform and location to operational email data, not only does this support compliance and regulatory requirements, it means that the primary mail platform can be changed without the roadblock of finding a viable way to extract data first (or risk losing it). It also provides continuity of access during mailbox migration projects.

Ask yourself. Will a move to Office 365 be the last time you change mailbox providers? Unlikely.

Office 365’s inline archive stores primary and archived mailboxes in the same single environment. With all email data in Office 365, it becomes more difficult to switch to another email environment – essentially leading to Office 365 lock-in. Tony Redmond, a Microsoft MVP, and leading commentator expands on this situation in his article ‘Getting data into Office 365 is easy; not so straightforward to retrieve’.

Microsoft gives you 90 days to extract all your data before its permanently deleted following expiration or termination of an Office 365 subscription.