View source for Archiving Emails from Microsoft 365 - Modern Authentication

{{Implementation Guide Preamble|Exchange&nbsp;Online / Microsoft&nbsp;365|{{#ev:youtube|https://youtu.be/X0Um0cDWGg0|350|right|''Tech Tip: Microsoft 365 Archiving Profiles''}}|<br/><br/>Our Tech Tip video shows the essential configuration steps in this article.}}
<br clear="all"/>
{{Multiline Notices|Heading=Important Notices|If you have archived emails from an Exchange server and synchronized users from an Active Directory until now, follow the article [[Changing Archiving from Microsoft Exchange Server to Microsoft 365]].|MailStore Server supports archiving emails from the global Microsoft Cloud ''Microsoft&nbsp;365'' and ''Office&nbsp;365, operated by 21Vianet''. Other Environments like GCC, GCC&nbsp;High or DoD are not supported.|For better readability, the terms ''Microsoft&nbsp;365'' and ''Exchange&nbsp;Online'' are used interchangeably hereinafter instead of ''Exchange&nbsp;Online / Microsoft&nbsp;365''.}}


== App Registration & User Synchronization ==
Before archiving Microsoft&nbsp;365 mailboxes, registering MailStore Server in your Microsoft&nbsp;365 tenant is required. It is also highly recommended to synchronize users in MailStore Server directly with that tenant to fetch all information that is relevant for archiving such as email addresses. The registration and synchronization procedures are described in the chapter [[Synchronizing User Accounts with Microsoft 365 (Modern Authentication)]] of the MailStore Server manual.

<p class=msnote>'''Please note:''' MailStore Server runs as a [[MailStore Server Service Configuration|Windows service]] and thus must use ''Application Permissions'' to access user mailboxes in Microsoft&nbsp;365. By design, on the Microsoft identity platform, which is at the heart of Microsoft&nbsp;365 authentication and authorization, this permission scope encloses the full level of privileges implied by a permission. As a consequence, once registered as described above, MailStore Server has access to all mailboxes in your Microsoft&nbsp;365 tenant. Therefore, with regard to security, access to the Microsoft&nbsp;365 archiving profiles in MailStore Server is limited to MailStore Server administrators.</p>

=== Including Microsoft&nbsp;365 Shared Mailboxes ===
In Microsoft&nbsp;365, shared mailboxes are special mailboxes that multiple users have access to. Unlike a normal mailbox, a shared mailbox is not associated to a licensed Microsoft&nbsp;365 user. For MailStore Server to create user entries for shared mailboxes, you must therefore deactivate the option ''Synchronize licensed Microsoft Exchange&nbsp;Online users only'' in the section [[Synchronizing User Accounts with Microsoft 365 (Modern Authentication)#User_Database_Synchronization|User Database Synchronization]].<br/>
After synchronization you can grant MailStore Server users access to the archive of the shared mailbox by [[Users,_Folders_and_Settings#Folder_Access_.28e.g._Access_to_the_Emails_of_Other_Users.29|assigning privileges]]. For archiving shared mailboxes, just proceed as for individual or multiple mailboxes as detailed below.

== Archiving Individual Microsoft&nbsp;365 Mailboxes ==
{{Archiving Single Mailbox Preamble|Microsoft&nbsp;365}}
For each mailbox, please proceed as follows:

* Log on to MailStore Client as MailStore Server administrator.
* Click on ''Archive Email''.
* From the ''Email Servers'' list in the ''Create Profile'' area of the ''Archive Email'' page, select ''Microsoft&nbsp;365'' or ''Microsoft&nbsp;365 (21Vianet)'' to create a new archiving profile.
* A wizard opens to assist in specifying the archiving settings.<br/><br/>
*; [[File:Microsoft 365 mailbox 01.png|center|347px]]
* Select ''Single Mailbox'' and click on ''OK''.
*; [[File:Microsoft 365 mailbox 02.png|center|347px]]
* Select the Microsoft&nbsp;365 credentials that you have created during the registration of MailStore Server with Microsoft&nbsp;365 from the ''Credentials'' drop-down list. You can also use the button (…) to access the [[Synchronizing_User_Accounts_with_Microsoft_365_(Modern_Authentication)#Creating_Credentials_in_MailStore_Server|Credential Manager]].
* In the ''Mailbox'' field, enter the primary email address of the user whose mailbox you want to archive.
* Click on ''Test'' to verify that MailStore Server can access the mailbox.
* Click on ''Next''.
* If needed, adjust the settings for the [[Email_Archiving_with_MailStore_Basics#Archiving_Specific_Folders|List of Folders to be Archived]], the [[Email_Archiving_with_MailStore_Basics#Specifying_Filter_Criteria_for_Archiving|filter]] and the [[Email_Archiving_with_MailStore_Basics#Archiving_Specific_Folders|Deletion Rules]]. By default, no emails will be deleted from the mailbox. The ''Timeout'' value only has to be adjusted in specific cases (e.g. with very slow network connections). 
*; [[File:Microsoft_365_mailbox_03.png|center|347px]]
* Click on ''Next'' to continue.
* Select the archive of the user for whom the selected mailbox is to be archived. If the user does not exist yet, click on ''Create a New User…''.
*; [[File:Microsoft_365_mailbox_04.png|center|347px]]
* Click on ''Next''.
* In the last step, a name for the archiving profile can be specified. After clicking ''Finish'', the archiving profile will be listed under ''Saved Profiles'' and, if desired, can be run immediately or automatically.

More information on how to execute archiving profiles can be found under the topic [[Email Archiving with MailStore Basics]]

== Archiving Multiple Microsoft&nbsp;365 Mailboxes Centrally ==
{{Archiving Multiple Mailboxes Preamble|Microsoft&nbsp;365}}
Please proceed as follows:

* Log on to MailStore Client as MailStore Server administrator.
* Click on ''Archive Email''.
* From the ''Email Servers'' list in the ''Create Profile'' area of the ''Archive Email'' page, select ''Microsoft&nbsp;365'' or ''Microsoft&nbsp;365 (21Vianet)'' to create a new archiving profile.
* A wizard opens to assist in specifying the archiving settings.<br/><br/>
*; [[File:Microsoft 365 mailboxes 01.png|center|347px]]
* Select ''Multiple Mailboxes'' and click ''OK''.<br/><br/>
*; <p class=msnote>{{Archiving_Multiple_or_Multidrop_Note|multiple mailboxes|[[#App_Registration_.26_User_Synchronization|directory synchronization]]}}</p>
*; [[File:Microsoft 365 mailboxes 02.png|center|347px]]
* Select the Microsoft&nbsp;365 credentials that you have created during the registration of MailStore Server with Microsoft&nbsp;365 from the ''Credentials'' drop-down list. You can also use the button (…) to access the [[Synchronizing_User_Accounts_with_Microsoft_365_(Modern_Authentication)#Creating_Credentials_in_MailStore_Server|Credential Manager]].
* Click on ''Next'' to continue. 
*; [[File:Microsoft 365 mailboxes 03.png|center|347px]]
* If needed, adjust the settings for the [[Email_Archiving_with_MailStore_Basics#Archiving_Specific_Folders|List of Folders to be Archived]], the [[Email_Archiving_with_MailStore_Basics#Specifying_Filter_Criteria_for_Archiving|filter]] and the [[Email_Archiving_with_MailStore_Basics#Archiving_Specific_Folders|Deletion Rules]]. By default, no emails will be deleted from the mailbox. The ''Timeout'' value only has to be adjusted in specific cases (e.g. with very slow network connections). Please keep in mind that these settings apply to all mailboxes to be archived, as specified in the next step.
*; {{Archiving_Multiple_Mailboxes_Centrally_Options|Microsoft_365_mailboxes_04.png|Microsoft&nbsp;365}}

== Archiving Incoming and Outgoing Emails Directly ==
{{Archiving Exchange Journal Mailbox Preamble|Exchange&nbsp;Online}}

=== Step 1: Setup and Configure MailStore Gateway ===
Please refer to the [https://help.mailstore.com/en/gateway/ MailStore Gateway Manual] for detailed instructions about:
 
* Installation and Setup of MailStore Gateway
* Logging on to MailStore Gateway's Management Console
* Creating MailStore Gateway mailboxes

After these steps, a mailbox with an individual email address (e.g. mbx-dead1234beef5678@gateway.example.com) should exist.

=== Step 2: Configure MailStore Server ===
{{Archiving MailStore Gateway Mailbox|''In- and Outbound E-Mail Automatically''|Microsoft 365 journal 01.png|Arch_MailStore_Gateway_Office365_02.png|''Microsoft&nbsp;365''|TargetFolderHint=DontShow|POP3Hint=DontShow|DSLink=[[#App_Registration_.26_User_Synchronization|directory synchronization]]}}

=== Step 3: Creating a Journal Rule ===
The following steps describe how to set up journaling for your Microsoft&nbsp;365 account.

Since you are planning to use an external mailbox (MailStore Gateway) as the recipient for Journal reports, we highly recommend to first create an external contact with this mail address in your Exchange mailbox administration to prevent any later errors or warnings about an unknown recipient in the process.

* Sign in to the [https://purview.microsoft.com/ Microsoft&nbsp;365 Purview portal] as an Exchange or Global Administrator for your Microsoft&nbsp;365 tenant.
* In the left navigation menu select ''Settings''.
* In the now shown ''Settings'' submenu select ''Data Lifecycle Management'' and then select  ''Exchange&nbsp;(legacy)'' or use [https://purview.microsoft.com/settings/application-settings/datalifecyclemanagement this link].
* Enter a mailbox in the ''Send undeliverable journal reports to'' section. This mailbox receives None Delivery Reports (NDRs) for undeliverable journal reports in case the primary journal mailbox is unreachable.
** This mailbox should be a dedicated mailbox for this purpose, which cannot reside in any Microsoft 365 tenant.
** The same journal report non-delivery reports mailbox must not be used for multiple tenants.
** The receiving mail server must not alter the ''X-MS-Exchange-Message-Is-Ndr'' email header.
** For this purpose, you can set up a second gateway on another server with an additional mailbox, as described in [[Archiving_Emails_from_Microsoft_365_-_Modern_Authentication#Step_1:_Setup_and_Configure_MailStore_Gateway|Step 1]]. Alternatively you can use any external mailbox that matches the above criteria.
** MailStore is able to extract the journal reports contained in the NDRs, then archive them like normal journal reports and thus assign the emails they contain to users. You can therefore create a second archiving profile as described in [[Archiving_Emails_from_Microsoft_365_-_Modern_Authentication#Step_2:_Configure_MailStore_Server|Step 2]], which archives from the Microsoft 365 journal report non-delivery reports mailbox.
* In the leftmost navigation menu select ''Data Lifecycle Management'', then ''Exchange&nbsp;(legacy)'', and finally ''Journal rules'' and therefore leave the ''Settings'' section or use [https://purview.microsoft.com/datalifecyclemanagement/exchange/journalrules this link].
* Create a new journaling rule by clicking on ''+ (New rule)''.
*:[[File:Arch_office365_journal_01.png|center|550px]]
* Enter the email address of the previously created MailStore Gateway mailbox in the ''Send journal reports to:'' box.
* Enter a name for the journal rule, e.g. ''Journaling''.
* In the ''Journal messages sent or received from'' section, select whether the rule should apply to everyone or to specific users or groups.
* Under ''Type of message to journal'', choose whether to capture all messages, internal messages only, or external messages only.
* Click on ''Next'', then validate your settings, click ''Submit'' to activate the rule.

== Public Folders ==
{{Archiving Exchange Public Folders Preamble|Exchange&nbsp;Online|Microsoft&nbsp;365}}
* Sign in to the [https://admin.exchange.microsoft.com/#/publicfolders Microsoft&nbsp;365 Exchange admin center] as an Exchange or Global Administrator for your Microsoft&nbsp;365 tenant.
* Navigate to ''Public folders'', in case it it not already opened.
* Click on ''Root permissions''.
*: [[File:Microsoft_365_pf_01.png|center|480px]]
* The side-panel ''Folder permissions'' opens. Click on ''+ Add permissions''.
* Use the text box beneath ''Select User'' to choose the Microsoft&nbsp;365 user you want to grant permissions.
* Choose ''Custom'' as ''Permission level'' and grant ''Read items'' and ''Delete all'' permissions.
*: [[File:Microsoft_365_pf_02.png|center|480px]]
* Click on ''Save Changes''.

=== Step 3: Setting up the Archiving Process ===
* Log on to MailStore Client as MailStore Server administrator.
* Click on ''Archive Email''.
* From the ''Email Servers'' list in the ''Create Profile'' area of the ''Archive Email'' page, select ''Microsoft&nbsp;365'' or ''Microsoft&nbsp;365 (21Vianet)'' to create a new archiving profile.
* A wizard opens to assist in specifying the archiving settings.<br/><br/>
*; [[File:Microsoft 365 pf 03.png|center|347px]]
* Select ''Public Folders'' and click on ''OK''.<br/><br/>
*; [[File:Microsoft 365 pf 04.png|center|347px]]
* Select the Microsoft&nbsp;365 credentials that you have created during the registration of MailStore Server with Microsoft&nbsp;365 from the ''Credentials'' drop-down list. You can also use the button (…) to access the [[Synchronizing_User_Accounts_with_Microsoft_365_(Modern_Authentication)#Creating_Credentials_in_MailStore_Server|Credential Manager]].
* In the ''Mailbox'' field, enter the primary email address of the user that has access to the public folders as described above.
* The value of the ''Target Folder'' box defines the top level folder below which the public folder hierarchy will be created in the target archive. Usually, you can leave this value to its default.
* Click on ''Test'' to verify that MailStore can access the public folders.
* Click on ''Next'' to continue.
*; [[File:Microsoft 365 pf 05.png|center|347px]]
* Adjust the settings for the [[Email_Archiving_with_MailStore_Basics#Archiving_Specific_Folders|List of Folders to be Archived]]. By default, all public folders that contain emails will be archived.
* If needed, adjust [[Email_Archiving_with_MailStore_Basics#Specifying_Filter_Criteria_for_Archiving|the filter]] and the [[Email_Archiving_with_MailStore_Basics#Deleting_Emails_after_Archiving|Deletion Rules]]. By default, no emails will be deleted from the public folders. The ''Timeout'' value only has to be adjusted in specific cases (e.g. with very slow network connections).
* Click on ''Next'' to continue.
*; [[File:Microsoft 365 pf 06.png|center|347px]]
* In the next step, select the archive of the user you have prepared in step 1.
* In the last step, specify a name for the archiving profile. After clicking ''Finish'' the archiving profile will be listed under ''Saved Profiles'' and can be run immediately or automatically if desired.

== About Archiving Archive Mailboxes ==
{{Archive_Mailbox_Folder_Structure}}

== Archiving Individual Microsoft&nbsp;365 Archive Mailboxes ==
{{Archiving Single Archive Mailbox Preamble|Microsoft&nbsp;365}}
For each mailbox, please proceed as follows:

* Log on to MailStore Client as MailStore Server administrator.
* Click on ''Archive Email''.
* From the ''Email Servers'' list in the ''Create Profile'' area of the ''Archive Email'' page, select ''Microsoft&nbsp;365'' or ''Microsoft&nbsp;365 (21Vianet)'' to create a new archiving profile.
* A wizard opens to assist in specifying the archiving settings.<br/><br/>
*; [[File:Microsoft_365_archive_mailbox 01.png|center|347px]]
* Select ''Single Archive Mailbox'' and click on ''OK''.
*; [[File:Microsoft_365_archive_mailbox 02.png|center|347px]]
* Select the Microsoft&nbsp;365 credentials that you have created during the registration of MailStore Server with Microsoft&nbsp;365 from the ''Credentials'' drop-down list. You can also use the button (…) to access the [[Synchronizing_User_Accounts_with_Microsoft_365_(Modern_Authentication)#Creating_Credentials_in_MailStore_Server|Credential Manager]].
* In the ''Mailbox'' field, enter the primary email address of the user whose archive mailbox you want to archive.
* Click on ''Test'' to verify that MailStore Server can access the archive mailbox.
* Click on ''Next''.
* If needed, adjust the settings for the [[Email_Archiving_with_MailStore_Basics#Archiving_Specific_Folders|List of Folders to be Archived]], the [[Email_Archiving_with_MailStore_Basics#Specifying_Filter_Criteria_for_Archiving|filter]] and the [[Email_Archiving_with_MailStore_Basics#Deleting_Emails_after_Archiving|Deletion Rules]]. By default, no emails will be deleted from the archive mailbox. The ''Timeout'' value only has to be adjusted in specific cases (e.g. with very slow network connections). 
*; [[File:Microsoft_365_archive_mailbox_03.png|center|347px]]
* Click on ''Next'' to continue.
* Select the archive of the user for whom the selected archive mailbox is to be archived. If the user does not exist yet, click on ''Create a New User…''.
*; [[File:Microsoft_365_archive_mailbox_04.png|center|347px]]
* Click on ''Next''.
* In the last step, a name for the archiving profile can be specified. After clicking ''Finish'', the archiving profile will be listed under ''Saved Profiles'' and, if desired, can be run immediately or automatically.

More information on how to execute archiving profiles can be found under the topic [[Email Archiving with MailStore Basics]]

== Archiving Multiple Microsoft&nbsp;365 Archive Mailboxes Centrally ==
{{Archiving Multiple Archive Mailboxes Preamble|Microsoft&nbsp;365}}
Please proceed as follows:

* Log on to MailStore Client as MailStore Server administrator.
* Click on ''Archive Email''.
* From the ''Email Servers'' list in the ''Create Profile'' area of the ''Archive Email'' page, select ''Microsoft&nbsp;365'' or ''Microsoft&nbsp;365 (21Vianet)'' to create a new archiving profile.
* A wizard opens to assist in specifying the archiving settings.<br/><br/>
*; [[File:Microsoft_365_archive_mailboxes_01.png|center|347px]]
* Select ''Multiple Archive Mailboxes'' and click ''OK''.<br/><br/>
*; <p class=msnote>{{Archiving_Multiple_or_Multidrop_Note|multiple archive mailboxes|[[#App_Registration_.26_User_Synchronization|directory synchronization]]}}</p>
*; [[File:Microsoft_365_archive_mailboxes_02.png|center|347px]]
* Select the Microsoft&nbsp;365 credentials that you have created during the registration of MailStore Server with Microsoft&nbsp;365 from the ''Credentials'' drop-down list. You can also use the button (…) to access the [[Synchronizing_User_Accounts_with_Microsoft_365_(Modern_Authentication)#Creating_Credentials_in_MailStore_Server|Credential Manager]].
* Click on ''Next'' to continue. 
*; [[File:Microsoft_365_archive_mailboxes_03.png|center|347px]]
* If needed, adjust the settings for the [[Email_Archiving_with_MailStore_Basics#Archiving_Specific_Folders|List of Folders to be Archived]], the [[Email_Archiving_with_MailStore_Basics#Specifying_Filter_Criteria_for_Archiving|filter]] and the [[Email_Archiving_with_MailStore_Basics#Archiving_Specific_Folders|Deletion Rules]]. By default, no emails will be deleted from the archive mailbox. The ''Timeout'' value only has to be adjusted in specific cases (e.g. with very slow network connections). Please keep in mind that these settings apply to all mailboxes to be archived, as specified in the next step.
*; {{Archiving_Multiple_Mailboxes_Centrally_Options|Microsoft_365_archive_mailboxes_04.png|Microsoft&nbsp;365}}

[[de:E-Mail-Archivierung_von_Microsoft_365_(Modern_Authentication)]]
[[en:Archiving_Emails_from_Microsoft_365_(Modern_Authentication)]]