How and what to check when your emails are not being deleted or archived properly in Exchange Online

Always been wondering, what does "ELC" stand for? Wild guess: Exchange Litigation (or Legal) & Compliance?

Also, note a few occurances of "on premise" in your article above should be "on-premises"

Thanks for a little insight into otherwise officially undocumented features!

Hi Nezgar,

Thanks for correcting me, I've adjusted the article. ELC stands for Email Lifecycle :).

I see a lot of "get" commands. But what would be the command to start ELC? I used this:

$ElcProperties = Export-MailboxDiagnosticLogs *** Email address is removed for privacy *** -ExtendedProperties

$XMLProperties = [xml]($ElcProperties.MailboxLog)

$XMLProperties.Properties.MailboxTable.Property | where {$_.Name -like "ELCLastSuccessTimestamp"}

result:
ELCLastSuccessTimestamp 1-9-2022 14:22:20

today is 13-09-2022 so that should also be the elclastsuccesstimestamp :-(

What to I do to get an elclastsuccesstimestamp of today?

Hello Willem,

Sorry that it took so much for me to reply, the system doesn't always notify me when I get questions on my forum posts.

You start the ELC with Start-ManagedFolderAssistant -Identity "user alias or email". The ELCLastSuccessTimestamp gets updated if the Managed Folder Assistant processed the mailbox without any errors during its processing cycle. If there are errors encountered during processing (such as throttling errors for example), the ELCLastSuccessTimestamp will not be updated, but this doesn't mean that no items were deleted/archived while the Managed Folder Assistant ran over that mailbox.

This is why we look at the issue from multiple angles, size of mailbox (primary and/or archive), size of a folder from where we are expecting items to be deleted/archived. Mailbox folder statistics such as OldestItemReceivedDate/NewestItemReceivedDate (for all folders with the exception of Deleted Items and everything that is under Recoverable Items) and OldestItemLastModifiedDate/NewestItemLastModifiedDate (for Deleted Items and everything that is under Recoverable Items).

You can also figure out that the Managed Folder Assistant has actually ran over a given mailbox by looking at these properties, especially at the first two of them, which describe how much it took for the assistant to process the mailbox.

ElcLastRunTotalProcessingTime

ElcLastRunSubAssistantProcessingTime

ElcLastRunUpdatedFolderCount           

ElcLastRunTaggedFolderCount             

ElcLastRunUpdatedItemCount              

ElcLastRunTaggedWithArchiveItemCount    

ElcLastRunTaggedWithExpiryItemCount

Hope this helps a bit.

Alex

Thank you Alex for this excellent article! Question for you that I can't find anywhere else: When a user applies a Personal Tag to the very top level of their mailbox in Outlook what object within their mailbox is that tag applied to? See the screenshot below. Users can apply a tag to this top-level object and by virtue of all folders defaulting to "Use Parent Folder Policy" all mailbox folders then pick up the Tag. However I cannot find what within the mailbox actually receives this top-level tag.

Hello James,

That's essentially the root of the mailbox. When viewed with a tool like MFC MAPI, you would basically have the personal tag applied on the "Top of Information Store" folder. Please keep in mind that applying a personal tag at the root of the mailbox, will cause the Default Archive policy tag to be overridden, meaning that the default policy of "2 Years Move to Archive" will no longer take effect.

Hope this helps :),

Alex

Hello James,

That's essentially the root of the mailbox. When viewed with a tool like MFC MAPI, you would basically have the personal tag applied on the "Top of Information Store" folder. Please keep in mind that applying a personal tag at the root of the mailbox, will cause the Default Archive policy tag to be overridden, meaning that the default policy of "2 Years Move to Archive" will no longer take effect.

Hope this helps :),

Alex

Thanks Alex! That's very helpful confirmation. The challenge I have is that there's no PR_ARCHIVE_TAG, PR_ARCHIVE_PERIOD or PR_ARCHIVE_DATE properties for Top of Information Store. However those personal tags are being recorded for that object is not the same as the rest of the objects in the mailbox. What properties of Top of Information Store contain information on the personal tag applied to it? That's the crux of my issue and perhaps what I didn't do a good job of articulating. Here's a screenshot of the properties of the Top of Information Store object in the mailbox pictured in my prior screenshot; properties are sorted alphabetically. You can see there from the names that PR_ARCHIVE_TAG is missing.

Hi James,

I've tested a bit on my end, and it seems we stamp the PR_ARCHIVE_TAG on all the folder that previously did not have a personal archive tag applied on them and they were obeying the default archive policy tag. This means that after applying a personal archive tag on the root of the mailbox, folders in it that already had a different personal archive tag applied on them, will not be included in the list of updated folders and will continue to retain their current personal archive tag.

If you need to remove the personal tag from certain folders, you can do the following, but bear in mind the potential parent folders and their archive tag for inheritance scenarios:

- run in Exchange Online PowerShell this cmdlet: Get-MailboxFolderStatistics -Identity "user name" -IncludeOldestAndNewestItems -FolderScope All | Export-CSV -NoTypeInformation -Path .\usernameprimaryfolderstats.csv

- look at the ArchivePolicy and Name columns to see the folders that have the personal tag applied on them

- go with MFC MAPI and simply delete the PR_ARCHIVE_TAG property from the folders where you don't want this policy to be applied

- run in Exchange Online PowerShell this cmdlet: Start-ManagedFolderAssistant -Identity "user name" -FullCrawl, to confirm the changes made with MFC MAPI

Please keep in mind that running the Managed Folder Assistant for the user, doesn't guarantee that the assistant will process that mailbox exactly when you run the cmdlet. This is a throttled mailbox assistant due to the nature of its functionality and if the service is busy with other higher priority tasks, it will take even up to a few days to fully go over the mailbox in question.

Generally speaking, if a personal tag was applied on the root of the mailbox, like in your first screenshot, and you want to change this, there will be a lot of manual work to be done to remove the personal tag from all the folders, if that is the end goal.

PS: A default archive policy tag will never show as a property on any given folder in MFC MAPI, so please remember this as well. Only personal tags are visible in MFC MAPI with the PR_ARCHIVE_TAG property.

Hope this helps,

Alex

Thanks Alex, I did know all that before. My goal is to remove the personal tag from the root of the mailbox, on Top of Information Store. However without knowing what properties contain that tag we have no way to do it besides opening the mailbox in Outlook. Furthermore if I remove all of the tags from subfolders when those subfolders inherit tags from Top of Information Store they will all return once the MFA runs; that keeps happening unless the tag on Top of Information Store is removed.

There must be some properties being modified within the mailbox itself when Top of Information Store gets a personal tag; what are they?