If you’ve been journaling email from Microsoft Exchange to Veritas Enterprise Vault and are moving to Office 365, you have a few options about what to do going forward in terms of eDiscovery:
- Switch to SMTP archiving and continue to use Enterprise Vault, either on-premise or hosted in the cloud.
- Export the data from Enterprise Vault and transfer it to a cloud service such as Archive360 or VeritasEV.Cloud
- Export the data
- Migrate the existing data to Exchange Online and use the eDiscovery and Compliance capabilities of Office 365
Though all options are valid, in this post, I’ll be talking in more detail about the last option.
For example, you have 7 Enterprise Vault journal archives that are associated with 7 journal mailboxes in Exchange. These archives contain the email for all users that sent or received messages in your Exchange environment. The 7 mailboxes were only used as a conduit for the journaling of messages.
One idea would be to create 7 shared mailboxes in Exchange On-line and migrate the 7 archives to these shared mailboxes. Unfortunately, that isn’t going to work. It’s not possible to migrate the contents of these 7 journal archives to 7 individual mailboxes of any kind, even if unlimited archiving is enabled for the type of mailbox known as an archive mailbox.
Let’s look at the Storage Limits across the Office 365 options…
| Feature | Office 365 Enterprise E1 | Office 365 Enterprise E3 | Office 365 Enterprise E5 | Office 365 Enterprise F1 |
| User mailboxes | 50 GB | 100 GB | 100 GB | 2 GB |
| Archive mailboxes | 50 GB | Unlimited | Unlimited | Not available |
| Shared mailboxes | 50 GB | 50 GB | 50 GB | 50 GB |
| Resource mailboxes | 50 GB | 50 GB | 50 GB | 50 GB |
| Site mailboxes | 50 GB | 50 GB | 50 GB | Not available |
| Public folder mailboxes | 50 GB | 100 GB | 100 GB | Not available |
| Group mailboxes | 50 GB | 50 GB | 50 GB | 50 GB |
Chart information up to date as of October 13th, 2019 and is subject to change
You may look at this and see that the Archive mailboxes can have ‘Unlimited’ storage, thinking it would make a good place to put what are likely terabyte size archives. There are a few problems with that:
- Microsoft says that “Using archive mailboxes as a means of storing mail from multiple users or entities is prohibited.” That is a deal breaker for this option
- To get past 100 GB in an Archive Mailbox, you need to enable auto-expanding archiving, which can take up to 30 days to take effect.
- An auto-expanding archive has a max growth rate of 1 GB per day, so to add 1 TB would require nearly 3 years!
- There is a 1 TB limit, on top of the 100 GB available in an auto-expanding archive
- See #1
Given the above points, it’s clearly not possible to use ‘Unlimited’ archive mailboxes for the purpose of storing data from a large journal archive.
From a storage standpoint, it is important to split the journal data per mailbox to put it into Office 365. Why? As we will see later, this will also give you much better search performance when doing eDiscovery.
“Using archive mailboxes as a means of storing mail from multiple users or entities is prohibited.”
The approach we take to transition from Journal archives to individual mailboxes is to determine which messages belong in which mailboxes and then copy the messages to one of the following:
Active Mailbox – If there is room
Archive Mailbox – If they are set up and active
Shared Mailbox – If the users no longer work for the company, meaning the users are no longer active. Note: In addition to being available for eDiscovery, there’s no charge in Office 365 for shared mailboxes (since the user can’t log in).
The architecture of Exchange Online.
Exchange Online is essentially Exchange 2016 with each companies’ mailboxes spread across many different mailbox databases. Each of those mailbox databases is shared with other companies. This explains why there are limits to both the size of each mailbox, and the rate at which it is possible to put messages into each mailbox. The goal is to prevent disruption to the other mailboxes being stored in the same mailbox database.
If you reach the 50 GB limit for a shared mailbox, you can assign an E3 license to then have a 100 GB limit. If that’s not enough, you can enable the Online Archive option for that mailbox to provide an additional 100 GB. If this still isn’t enough, you can enable unlimited archiving to provide a further 1 TB of space.
Doing eDiscovery on your migrated data
The way eDiscovery is done in Office 365 is very different than Enterprise Vault. With Enterprise Vault, if you are expecting to do eDiscovery, the chances are you are using journaling, in which case you would typically use Discovery Accelerator to search the journal archives for users email, specifying search criteria such as custodian, date range, and keywords.
In Office 365 you specify the search criteria, but rather than point to the journal archives, you specify the mailboxes associated with the custodians. It is possible to have Office 365 search all locations. You may think searching thousands of mailboxes would be slow, but Microsoft claims the average time to search 1000 mailboxes is only 45 seconds. (Based on performance information they have collected for searches run by all Office 365 organizations.)
Here is a table of the average Search times in Office 365, according to Microsoft:
| Number of mailboxes | Average search time |
| 100 | 30 seconds |
| 1,000 | 45 seconds |
| 10,000 | 4 minutes |
| 25,000 | 10 minutes |
| 50,000 | 20 minutes |
| 100,000 | 25 minutes |
Summary
For those customers using Enterprise Vault journaling and planning to move to Office 365, it is important to rethink how data is stored to play nicely with the Exchange Online architecture. If done properly, you too can take full advantage of the powerful and efficient eDiscovery capabilities in Office 365.
