Hi again, I am confronted with a user whose mailbox is full. There is no deleting manually the emails or the attached files. Here the Folder statistics : Clearly the issue is with the DiscoveryHolds and the SearchDiscoveryHoldsUnindexedItemFolder, however I don't know how to purge these folder atm. Please advise.

You cannot purge items that are on hold, that's the idea behind the hold feature. The only way would be to remove the hold(s) first, as detailed in this article: https://zcusa.951200.xyz/en-us/purview/ediscovery-delete-items-in-the-recoverable-items-folder-of-mailboxes-on-hold?view=o365-worldwide Of course, make sure that you are actually allowed to remove the hold first, you don't want to end up in a scenario where a bunch of item required by a litigation were removed. If the idea is to free up some space, a faster approach might be to do a "cleanup", by running the following cmdlet: Start-ManagedFolderAssistant user@domain.com -HoldCleanup This will prompt the MFA to potentially clean up duplicate items that are on hold, without impacting the overall hold status.

How to delete emails from a user's mailbox when it doesn't allow you to do it manually? (Purge?)

Accepted answer

Vasil Michev 111.7K Reputation points MVP

2024-12-16T17:07:07.9833333+00:00
You cannot purge items that are on hold, that's the idea behind the hold feature. The only way would be to remove the hold(s) first, as detailed in this article: https://zcusa.951200.xyz/en-us/purview/ediscovery-delete-items-in-the-recoverable-items-folder-of-mailboxes-on-hold?view=o365-worldwide

Of course, make sure that you are actually allowed to remove the hold first, you don't want to end up in a scenario where a bunch of item required by a litigation were removed. If the idea is to free up some space, a faster approach might be to do a "cleanup", by running the following cmdlet:

Start-ManagedFolderAssistant user@domain.com -HoldCleanup

This will prompt the MFA to potentially clean up duplicate items that are on hold, without impacting the overall hold status.
Please sign in to rate this answer.

1 person found this answer helpful.
Christophe Cervello (FLAIR-IT) 45 Reputation points

2024-12-17T13:28:56.6766667+00:00

Hi and thks for your help again @Vasil Michev ,

While following the mentioned link ( the holdcleanup didn't save any space). I am confronted with an issue as the Get-ComplianceSearch cmdlt is unrecognized. I added to my account the following rights: Discovery Management right, security Admin, Compliance admin, exchange admin ofc but also the litigation Hold Manager (though i believe in my case it is pointless, they are none on this mailbox). disconnected and reconnected to the IPPSession and Exchange in PS but nothing works, the cmdlt remains unrecognized and without it i cannot find how to remove the in-place holds.

Please advise.

Vasil Michev 111.7K Reputation points MVP

2024-12-17T14:43:37.1+00:00

The Compliance admin role you assigned is sufficient, but give it some time to replicate first. You need the SCC endpoint for this cmdlet (Connect-IPPSsession), it is no longer supported for Exchange Online PowerShell.
If you are still having trouble with PowerShell, you can review the set of searches via the UI. Navigate to the (classic) Content search page, hit F12 to open Dev tools > Network, then hit the Refresh button on the page to re-fetch the set of Content searches. The data you are looking for will be under the ComplianceSearch?ResultSize=Unlimited query.

Christophe Cervello (FLAIR-IT) 45 Reputation points

2024-12-17T15:38:46.42+00:00

I've give quite some time for it to replicate, few hours, on the ui according to your instructions, i get the following result : DiagnosticContext: "{Version:17.01.2535.000,Environment:WEUPROD,DeploymentId:8db0ec6b-a691-41ac-b8ac-4007367a5531,InstanceId:WebRole_IN_1,SID:b97dde07-4a5a-4e0a-b009-f44a4edc5709,CID:e7e978e0-50b5-4b78-a35d-d7bcda3409cb}"

ExceptionType: "System.UnauthorizedAccessException"

Message: "Looks like you don't have the right permissions to view this page or this feature isn't part of your organization's Microsoft 365 subscription. To get access, contact the person who assigns permissions or makes purchasing decisions. If you're a new user or were recently assigned permissions, try again in 15 minutes."

Time: "2024-12-17T15:08:38.36182Z"

It seems to point at a lack of permission, but how can this be, as i mentionned before i have added all role I could find related to this acces.

Christophe Cervello (FLAIR-IT) 45 Reputation points

2024-12-17T15:44:56.42+00:00

found the issue, somehow the compliance administrator right expired, seen on the AZ portal under the active rights section.

Christophe Cervello (FLAIR-IT) 45 Reputation points

2024-12-17T16:26:55.1+00:00

I am sorry to keep bothering you @Vasil Michev , but according to the Hold GUID, the only hold effectively in place is the retention policy applied to a mailbox. they start with prefix mbx or grp and finish by :2 . But once i go to the Compliance UI, in the data lifecycle management I do not see a Microsoft 365 nor a retention page. Am I missing something?

Christophe Cervello (FLAIR-IT) 45 Reputation points

2024-12-17T16:28:48.92+00:00

Hi @Vasil Michev , I cannot find the Microsoft 365 under the Data lifecycle management in the compliance console :

What am I missing?

Christophe Cervello (FLAIR-IT) 45 Reputation points

2024-12-17T16:55:44.9966667+00:00

Found it, somehow there is no Microsoft 365 to look for but there is a retention as per the following screenshot.

Question, do you know how long it should take to take effect so that i might be able to carry on with the process : https://zcusa.951200.xyz/en-us/purview/ediscovery-delete-items-in-the-recoverable-items-folder-of-mailboxes-on-hold?view=o365-worldwide#step-1-collect-information-about-the-mailbox ? it says minium 24h, but how can I check whether it has gone through or not?

Vasil Michev 111.7K Reputation points MVP

2024-12-17T17:24:25.4766667+00:00

It can take some time... To check the progress, select the policy and check the top row in the right-hand pane (Status). Alternatively you can do it via PowerShell:

Get-RetentionCompliancePolicy policyName -DistributionDetail

Vasil Michev 111.7K Reputation points MVP

2024-12-17T17:25:50.2133333+00:00

Btw how did you enable dark mode in the new portal? :) Or is this some add-in?

Christophe Cervello (FLAIR-IT) 45 Reputation points

2024-12-18T08:02:32.9566667+00:00

ahah, it is an add-in (dark reader)

More pleasant to the eyes, especially on a long day like yesterday.

Christophe Cervello (FLAIR-IT) 45 Reputation points

2024-12-18T08:10:31.6+00:00

If I am not mistaken this would mean it has been enforced already?

Christophe Cervello (FLAIR-IT) 45 Reputation points

2024-12-18T08:21:35.68+00:00

I am an idiot, with the FL piped I get the following result, i believe i should see more, but the location with the exceptions are a big fat vacuum :

Though it might have something to do with the status being pending :

In any case, thanks for your help so far @Vasil Michev , your awesome ! I am quite sure i will have more questions before the end of this endeavour :D .

Christophe Cervello (FLAIR-IT) 45 Reputation points

2024-12-18T08:26:39.34+00:00

this comment is a mistake, i apparently opened a new answer isntead of adding in the thread.

Vasil Michev 111.7K Reputation points MVP

2024-12-18T10:22:00.5766667+00:00

Pending means it's still rolling out, you have to wait.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.