The authorized administrators are responsible for end-to-end management of mailboxes on holds. Using specific automated methods to analyze the status of the mailbox hold processes can support the administrators greatly.

Why Admins Need to Identify the Type of Hold Placed on an Exchange Online Mailbox? 

Widely used mailbox holds methods are Litigation Holds, In-Place Holds, and Retention Holds. The administrator monitors status of these holds with complicated efforts for a variety of reasons. Few are listed below.  

1. To reduce license cost– You can remove the holds on the unused inactive mailboxes.  
2. To reduce the storage– The admins plan on revising the hold duration and removing the high-storage consuming mailboxes under hold. 
3. To ensure the mailbox’s contents related to the legal proceeding are preserved permanently. 
4. On identifying multiple holds, the admins can suggest the best hold techniques and update the hold setting if required. 
5. Having the mailbox hold duration data (start and end date), the administrators maintain the time-based mailbox holds easily.  

View Mailbox Holds Status in Exchange Online

The permitted administrators (e.g., Global, Exchange, Compliance and so on.,) can view the status of mailbox holds. Further, you should have specific administrative roles to access the mailbox hold (e.g., Global, Legal, Discovery, Mailbox Search). Make sure that you have the necessary permissions to place a mailbox on hold. 

Using UI: You can view the mailbox holds in the Exchange Online Admin Center (EAC). Follow the navigations below. 

• Find all Litigation holds: In the EAC, go to ‘Recipients’ and click on ‘Mailboxes’. Click on ‘Choose columns’ and select ‘Litigation hold enabled’. You can see the hold status. The Major user complaint here is, you cannot find status and hold details as an aggregated report anywhere in the EAC. 
• View all In-Place holds: Viewing and managing In-Place hold in EAC is obsolete after the launch of new Compliance eDiscovery features. 
• Find the Retention holds: In the EAC, it is impossible to view the mailboxes under retention hold. 

Using PowerShell: You can use the PowerShell cmdlets Get-Mailbox to view the holds placed on the mailboxes. However, despite using PowerShell with multiple filtering conditions, you will not get clear idea about the mailbox holds (e.g., GUID will not disclose the In-Place Hold’s Type directly). 

To overcome all the UI and PowerShell impossibilities and limitations, we designed the All-in-One script ‘MailboxHoldReport.ps1’.  We can discuss the script’s functionalities in detail now. 

Script Highlights: 

• Generates 4 different mailbox holds reports.  
• Automatically installs the Exchange Online module upon your confirmation when it is not available in your machine. 
• Shows list of the mailboxes with all the active holds information for each mailbox. 
• Shows the mailboxes with litigation hold enabled along with hold duration and other details. 
• Displays in-place hold applied mailboxes. 
• Lists mailboxes that are placed on retention hold and their retention policy. 
• Supports both MFA and Non-MFA accounts.    
• Exports the report in CSV format.  
• Scheduler-friendly. You can automate the report generation upon passing credentials as parameters. 

Download Script: MailboxHoldReport.ps1

Mailbox Hold Report – Script Execution Overview 

The admin can quickly identify the mailboxes with holds in their organization using the report data. In addition, the detailed attributes in each report aids in tracking the existing hold policies and reconstruct the mailbox hold settings. We have outlined the steps for supplying inputs and generating reports below.  

With a simple execution format, you can get below mentioned 4 different mailbox holds reports.  

• Report on Mailboxes under Hold(s) 
• Litigation Holds Report 
• In-Place Holds Report 
• Retention Holds Report 

We have outlined the steps for supplying inputs and generating reports below. 

List All Office 365 Mailbox in Holds: 

You can have different types of holds placed on a single mailbox to meet the compliance regulations, legal and investigations procedures. The administrators find difficulties in relating the list of mailboxes hold placed on each mailbox and collecting the unique properties of each hold type. You can refer to the active holds report and get all the mailbox holds information quickly. 

.\MailboxHoldReport.ps1

With the simple execution format and the mailbox holds details, you can also view the archive mailboxes status and ‘ComplianceTagHoldApplied’ status. 

Sample Output:

Litigation Hold Report in Office 365: 

The administrators are responsible for the mailbox storage management, recovering deleted items, and preserving contents deleted by users. Using our script, you can identify the status and all significant details of the litigation hold. You can use the report to analyze the litigation holds properties and revise the litigation hold policies to align with the organization’s needs. 

.\MailboxHoldReport.ps1 -LitigationHoldsOnly

Use the switch param ‘LitigationHoldsOnly’ to get all the mailboxes with the litigation hold. You will get the report with all the litigation holds specific attributes like ‘LitigationHoldOwner,’ LitigationHoldDuration’, and ‘LitigationHoldDate’.

Sample Output:

List In-Place Hold Enabled Mailboxes:

The administrator places mailboxes with multiple In-Place holds when a mailbox is subject to various legal investigations. Using our In-Place hold report, the administrators can identify the mailboxes without holds and enable the holds appropriately. Also, the administrator can use the report to ensure that the email content is retained in an immutable way, free from automated deletion mechanisms (e.g., MRM) and user deletion interferences. 

.\MailboxHoldReport.ps1 -InPlaceHoldsOnly

Use the switch param ‘InPlaceHoldsOnly’ to get the mailboxes with In-Place holds. If you have multiple In-Place holds, you will get the exact count and in-place hold types like ‘Specific location Retention Policy, In-Place, eDiscovery Case’, in the report as shown in the image.

Sample Output:

Get Office 365 Mailbox with Retention Holds Report: 

The retention holds can be configured to retain mailbox items belongs to the Exchange Online, Microsoft 365 Groups, and Teams. The administrator can suspend the processes of MRM by the managed assistant for the mailboxes by enabling retention holds. The retention hold report helps to identify the mailboxes with retention holds, retention policy, and the hold’s end date for each mailbox.

.\MailboxHoldReport.ps1 -RetentionHoldsOnly

Use the switch param ‘RetentionHoldsOnly’ to get the list of retention hold enabled mailboxes. The ‘Retention Policy Tag’ in the report gives the abstract description of the hold, ‘Start Date for Retention Hold’ and ‘End Date for Retention Hold’ exposes the retention hold’s duration.

Sample Output:

Scheduling Office 365 Mailbox on Hold Report:

Since most of the mailbox holds are permanent, you can schedule the PowerShell script to monitor the mailbox hold status in detail. To schedule the execution, you can use both MFA and non-MFA accounts.

 To use the non-MFA admin accounts, try the format below.   

.\MailboxHoldReport.ps1 -UserName admin@contoso.com -Password (password) -LitigationHoldsOnly

If the admin account has MFA, then they cannot use it directly for scheduling. Instead, you have to disable MFA based on the Conditional Access Policy to make it work.

Mailbox Hold Report – More Reasons to Track: 

Administrators of other management groups can also use this report more effectively to maintain the mailboxes. Find below the additional uses. 

• Change the hold duration for an inactive mailbox. 
• Delete an inactive mailbox when no holds are required. 
• Enable archive mailboxes for the mailboxes under hold. 
• Identifies the end date of the holds and update the hold duration.  
• Identifies the compliance tag hold status to understand the retention label’s performance. 

Beat Native Office 365 Reporting with AdminDroid

Monitoring mailbox holds through EAC & PowerShell can present several challenges, and a few of the downsides are time-consuming, error-prone, lack automation, and provide limited visibility into an organization’s compliance status. 

To overcome the challenges associated with monitoring mailbox holds, consider using AdminDroid Microsoft 365 reporter, which provides detailed mailbox hold reports by beating the limitations of native Office 365 reports and aids in simplifying the compliance management process.  

AdminDroid Exchange Online reporting tool goes beyond the basics and provides clear-cut mailbox reports on litigation hold, retention hold, and in-place hold with a more granular view of hold duration, owner, hold date, etc. Further, you can even drill down to specific Exchange Online mailbox details such as the start & end date of the retention period, mailbox type, department, and more.  

Overall, whether you’re a small business or a large enterprise, AdminDroid Microsoft 365 reporting tool can help you manage your Exchange Online environment more efficiently and effectively. It offers a lot more than basic mailbox reports, which provide clear-cut insights into mailbox retention policies and mailbox activities and help to ensure compliance with legal requirements.  

• AdminDroid is an intuitive Office 365 reporting tool that offers over 1800+ all-in-one reports, with smart AI-powered graphical analytics, and sleek comprehensive dashboards for widespread visibility on every other Office 365 service. 
• AdminDroid is now furnished with better alerting capabilities, delegation, advanced scheduling, advanced filtering, etc.,  

Don’t settle for limited reports that leave you in the dark about potential risks and compliance issues! Try the free 15-day premium edition of AdminDroid to explore its features & functionalities! 

The native Office 365 Reporting tool does only 10% of reporting,

and AdminDroid does another 90%!

We hope this blog is useful to get mailbox holds status. If there is still something unclear to you, please leave a comment, and we will address your questions. 

The post Export Office 365 Mailbox Hold Report Using PowerShell appeared first on Office 365 Reports.

Why it is Important to Find Office 365 Mailboxes with Email Forwarding Rules? 

Based on the email forwarding rules report, you can gain the below crucial facts. 

1. Identify employees who override the admin’s email forwarding configuration. 
2. Identify mailboxes with external forwarding set. 
3. Assure email security: The sensitive data may get shared with an unintended audience.  
4. Prevent critical emails reported as spam: It is essential to remove clients and third-party vendors from the email forwarding set up after the business need. When missed to discard, the concerned recipient may report it as spam. Due to this, the risk of important emails falling under the spam category is high. 

How to Get Email Forwarding Rules for a Mailbox? 

Using UI: Following the below navigation, you can view all the email forwarding rules and configurations in the Exchange Online admin center (EAC). However, you cannot view inbox rules through UI is a huge drawback.

1. Email forwarding setup: You cannot view the email forwarding address directly. You need to click on each user’s profile. Select the ‘Manage mail flow settings’ option to view the configured forwarding addresses.  
2. Transport Rules: Go to ‘Mail flow’ and select ‘Rules’. You can see all the redirected email forwarding rules and other transport rules in your organization. 

Using PowerShell: You can use Exchange Online PowerShell cmdlets, Get-Mailbox, Get-InboxRule, and Get-TransportRule. But you will not get significant attributes that depict the email forwarding in your organization. You need to use multiple filters, executions to get the desired report.

To overcome the UI and PowerShell complexities, we have created an All-in-one PowerShell script. It helps to identify all the email forwarding configured via external email forwarding, transport rules setup, and inbox rule configurations. Let us start!

Script Highlights: 

• Generates 3 different email forwarding rules reports.  
• Automatically installs the Exchange Online module upon your confirmation when it is not available in your machine. 
• Shows mailboxes in which email forwarding configured through ‘Forwarding SMTP Address’ and ‘Forward To’. 
• Lists all inbox rules that forward email to others’ mailbox. 
• Identifies transport rule that redirects emails to mailboxes 
• Supports both MFA and Non-MFA accounts.    
• Exports the report in CSV format.  
• The script is scheduler-friendly. You can automate the report generation upon passing credentials as parameters. 

Download Script: EmailForwardingReport.ps1

Email Forwarding Report – Script Execution Overview 

Using our script, you can obtain a detailed email forwarding report on the mailboxes in your organization. We have designed the script to assist admins in tracking the users who forward emails to their personal and external accounts. It also reveals all email forwarding rules and configurations found in your organization. We have outlined the steps for supplying inputs and generating reports below.

List Office 365 Mailboxes with an Email Forwarding  

The user can override the admin email forwarding configuration by creating their forwarding setup in the Inbox (UI Navigation: Inbox-> Outlook setting-> Mail->Forwarding). Administrators can compare and find mismatched user records using our email forwarding reports. Users who forward emails to unauthorized accounts will be exposed as well. 

.\EmailForwardingReport.ps1

This is the default report in our script. The mailbox forwarding report has attributes, as shown in the image. The ‘Forwarding SMTP Address’ displays both the internal and external email forwarding addresses, whereas the ‘Forward To’ displays the name of the internal forwarding recipient name. 

Sample Output:

Find All Inbox Rules with Email Forwarding 

By using inbox rules, users can forward the email, forward it as an attachment, or redirect emails to other accounts. The administrator’s key responsibility is to identify these users to promote data security. Also, it is highly important to identify inbox rules that forward emails to external users.

To get the inbox rules with email forwarding, you can run the script with the ‘InboxRules’ switch.

.\EmailForwardingReport.ps1 -InboxRules

Refer to the image for the attributes delivered by the inbox rules with the email forwarding report. The administrator decides the best prevention way to stop the unpermitted external and internal email forwarding using the ‘Forward As Attachment To’,’ Forward To’, and ‘Redirect To’ attributes in the report. 

Sample Output:

Get All Mail Flow Rules with Email Forwarding  

The transport rules take action on messages while they are in transit, not after they are delivered. Due to negligence, a user may continue to send emails to recipients that no longer exist. The administrators have to act on that and redirect the emails to maintain proper mail flow throughout the organization.

To get transport rules that redirect emails to other mailboxes, run the script with the ‘MailFlowRules’ switch param.

.\EmailForwardingReport.ps1 -MailFlowRules

See the below image to know the attributes in the transport rules with the email forwarding report. Use this report to find the redirected email recipients and other additional details of the redirected rules. 

Sample Output: 

Schedule Office 365 Email Forwarding Report 

You can schedule the PowerShell script to prepare the statistics report and establish better email forwarding rules. To schedule the execution, you can use MFA and non-MFA accounts.

To use the non-MFA admin accounts, try the format below.   

.\EmailForwardingReport.ps1 -UserName admin@contoso.com -Password (password) -InboxRules

If the admin account has MFA, then they cannot use it directly for scheduling. Instead, you have to disable MFA based on the Conditional Access Policy to make it work. 

Ways to Block the Automatic Email Forwarding – Quick Bites   

However, despite the warnings and restrictions given to the users, you cannot continue to risk business data. You can terminate the improper email forwarding users based on the data in our reports. We suggest the commonly used methods to block your users from using the email forwarding facility completely.

• Use outbound spam filter policy to control external email forward rules. 
• Use Remote Domains to block automatic forwarding rules. 
• Use transport rule to block auto-forward. 
• Use role-based access control (RBAC) to hide auto-forward options. 
• Use outlook web app policies to block email forwarding. 

Note: Also, you can identify and block external email forwarding in Exchange Online, including external forwarding configuration and inbox rules with external forwarding to enhance your security.

Get More Detailed Email Forwarding Report:

To get more detailed email forwarding report on

• Configuration methods
  • SMTP forwarding
  • Inbox rule forwarding
• Configured domain
  • Email forwarding to internal domain
  • Email forwarding to external domain
• Inbox rules
  • Inbox rules with internal forwarding
  • Inbox rules with external forwarding

• Mailbox forwarding summary report

you can take a look at AdminDroid Microsoft 365 reporting and auditing tool.

AdminDroid provides 1500+ pre-built reports and 20 smart visually appealing dashboards to know about your Office 365 environment at a glance. This tool provides reports on Office 365 reporting, auditing, analytics, usage statistics, security & compliance, etc.

Each report provides AI-powered graphical analysis to gain insights and better understand the data in a visually appealing manner.

Additionally, AdminDroid offers 100+ reports and dashboards completely for free. It includes reports on Users, Licenses, Groups, Group Members, Devices, Login Activities, Password Changes, License Changes, and more. The free edition doesn’t have any restrictions in reporting functionalities such as customization, scheduling, and exporting. Download Free Office 365 reporting tool by AdminDroid and see how it helps for you.

We hope this blog is helpful to get the detailed email forwarding reports successfully. 

The post Export Office 365 Email Forwarding Report Using PowerShell appeared first on Office 365 Reports.