Delete items in the Recoverable Items folder in Exchange Online

One of the customers I work with apply extensive retention policies for mailboxes in the organization. A restrictive policy applied to a mailbox receiving a lot of messages with attachments will likely cause incidents where the recoverable items quota is exceeded.

In this case the root cause is retention policies but this could also be caused by litigaton hold, eDiscovery case holds etc. This article assumes it is OK to remove these policies and hard deleting the messages. If these messages need to be retained.

Before proceeding, verify that the quota is exceeded by running the below command. Mailboxes on hold have a default recoverable item quota of 100 GB.

Get-MailboxStatistics <PrimarySMTPAddress> | ft DisplayName, TotalDeletedItemSize, DeletedItemCount

Preparations

Before proceeding we need to make sure that messages can be deleted from the mailbox. This involves changing some settings for the mailbox. The following command will disable deleted item retention and single item recovery for the mailbox.

Set-Mailbox <PrimarySMTPAddress> -RetainDeletedItemsFor 0
Set-Mailbox <PrimarySMTPAddress> -SingleItemRecoveryEnabled $false

You also need to ensure the mailbox is no longer affected by any holds. Microsoft explains this in detail in this article. Note that a applied retention policy starting with a minus sign means the mailbox is excluded from the policy.

As changes related to retention / holds usually take a long time to apply in large organizations I recommend waiting 24 hours before proceeding.

Deleting the items

To delete the items I grant my account access to the mailbox in question and setup a new Outlook profile for the task. I configure the profile not to use cached Exchange mode and close the Outlook client as soon as the target mailbox becomes avaialble.

Using MFCMAPI I proceed with deletion of the contents of the DiscoveryHolds folder:

  1. Start the application and select “Session” -> “Logon…”
  2. Select the newly created Outlook profile and click “OK”.
  3. Double-click the target mailbox in the list of available mailboxes.
  4. Expand the mailbox and the “Recoverable Items” folder.
  5. Right-click “DiscoveryHolds” and select “Advanced” -> “Empty items and subfolders from folder…”
  6. Check the “Hard Deletion” box and click “OK”.

The deletion process should start immediately you should see the ItemsInFolder and FolderAndSubfolderSize changing when running the command below.

Get-MailboxFolderStatistics -Identity <PrimarySMTPAddress> -FolderScope RecoverableItems | ft Identity, ItemsInFolder, FolderAndSubfolderSize

When you’re happy with the results verify that you’re under the recoverable item quota by running this again.

Get-MailboxStatistics <PrimarySMTPAddress> | ft DisplayName, TotalDeletedItemSize, DeletedItemCount

It everything looks OK make sure to re-apply the single item recovery and deleted item retention settings. Below are commands to restore defaults.

Set-Mailbox <PrimarySMTPAddress> -RetainDeletedItemsFor 14
Set-Mailbox <PrimarySMTPAddress> -SingleItemRecoveryEnabled $true

Possible issues

If deleting the items only results in the items being moved from “DiscoveryHolds” to “Purges” it most likely means the item retention and single items recovery settings are not fully applied. Wait some time and run the below command.

Start-ManagedFolderAssistant -Identity <PrimarySMTPAddress>

Leave a Reply

Your email address will not be published. Required fields are marked *