Originally blogged @ Lucian.Blog. Follow Lucian on Twitter @lucianfrango.
In-place hold, legal hold, compliance hold, journaling and/or select “D”: all of the above, when it’s simplified down to its simplest form is storing emails for X amount of time in case there’s a problem and these need to be reviewed. What’s great about Office 365 Exchange Online is that there is the ability to store those emails in the cloud for 2,555 days (or roughly speaking 7 years).
Let’s fast forward to having in-place hold enabled for an Exchange Online tenant. In my reference case I have roughly 10,500 users in the tenant and numerous in-place hold policies, with the largest containing 7,500 or so users. I’ve run into a small problem with this Hybrid based environment whereby I need to move a mailbox that is covered by an in-place hold policy (let’s call it “Lucians Mailbox Search Policy”) back to on-premises for a couple of reasons.
The following blog post outlines how to remove users from an in-place hold via PowerShell as the Office 365 / Exchange Online Control Panel may not let you do that when you have thousands of users in a single hold policy.
Problem
When working with Exchange Online (and potentially with Exchange Server 2013 and Server 2016, but this is a cloud orientated blog, so, lets stick with Exchange Online), there it is very likely that there are tens of thousands of users in a tenant. When you have that many users, it’s important to be able to use the tools to manage large numbers of users effectively.
I ran into a problem where the Exchange Online Control Panel was not allowing me to remove two users from an in-place hold policy that covered roughly 7,500 users. This is part one of the problem, but, part two is also a reference to eDiscovery search that ties in with in-place hold polices. eDiscovery search in our tenant has a maximum search size of 5,000 users. This does not affect the in-place hold policy much as that is limited to 10,000 users and we’re bellow that. However, this client may need eDiscovery in the future, so i’ll come back to this problem later in the is post.
To remove two users from the in-place hold policy called “Lucian’s Mailbox Search Policy” I need to use PowerShell to get around the ECP.
Solution
The following PowerShell Cmdlets are able to be used to remove a user from a in-place hold policy.
Get the data
Run the following PowerShell to create a variable in your PS session grabbing all the mailboxes in the hold policy called “Lucians Mailbox Search Policy”
Back this up!
I’ve included this as an additional step to be safe, so that if you delete too many users you can go back and restore the original policy.
Remove your users
Run the following, replacing <user1> to <whoever you want to remove> to remove the users from your PS sessions variable $check.
Save and go live
The final step is to save the new list of SourceMailboxes to the live in-place hold policy.
Final words
I wasn’t able to find much literature on this topic through the oracle (Google). This solution came about via a Microsoft Premier support case. I was in the process of simply removing some users from a clients hold policy, however, I’m in the process of setting up new polices and transitioning users. The above solution though is great in that it allows for a PowerShell solution to removing users from a hold which I previously wasn’t sure was possible.
Cheers,
-Lucian
Originally blogged @ Lucian.Blog. Follow Lucian on Twitter @lucianfrango.