How NinjaOne Archiver is set up

Before you start

A few decisions shape the whole set-up, so we settle them first:

• What to keep and for how long: the categories of mail, the retention period for each and the reason, ideally written down in an email retention policy
• Who searches the archive: the people who will hold the Data Protection Officer, Compliance and Review Officer and Reviewer roles, kept separate from day-to-day IT admins
• Who is in scope: all users or a defined group, and how leavers will be handled
• Legacy data: old archives or PST files you want brought in, which NinjaOne can ingest separately
• Where the archive will be held: we confirm the hosting location with you before set-up

Two product rules also apply. Enabling Archiver cannot be reversed within an organisation, and the plan covers every user backed up in that organisation. Our bundles page explains both.

Step by step

This is the order NinjaOne's documentation follows, with our part at each stage.

1. Enable Archiver. Archiver is switched on in the NinjaOne SaaS Backup Partner Portal, under the organisation's subscriptions, not from the NinjaOne console. We do this once you have approved the quote and the one-way change.
2. Connect the tenant. For Microsoft 365, an administrator authenticates the tenant from the End-User Portal; for Google Workspace, an administrator signs in with Google Workspace admin credentials and installs the NinjaOne SaaS Backup app from the Google Workspace Marketplace. We guide your administrator through the consent screens.
3. Add mailboxes. Add users by hand or turn on Autodiscover, which scans once a day and adds new users, with an exclusion list for accounts you leave out. For Microsoft 365 you can also limit scanning to a named group (dynamic groups are not supported). We can agree the scope with you first.
4. Set up journaling. Microsoft 365 journaling is created automatically; Google Workspace journaling is configured with routing rules. Both are covered below, and we work through them with you.
5. Create retention policies. After Archiver is enabled, the portal prompts for a retention policy. We help you set the standard policy and any department, mailbox or SharePoint policies.
6. Assign departments and roles. Use Department Sync to group users, then give compliance roles to the right people. We set this up to match who should see what.
7. Turn on extras. Activate private Teams chat backup if you need it, and arrange ingestion of legacy archives.
8. Check it is working. Confirm journaled mail is arriving and show your administrators where to see status.

Microsoft 365: journaling is created for you

For Microsoft 365, NinjaOne's Archiver FAQ describes the process. When a mailbox is added, its existing mail is backed up directly from the mailbox. Once the Archiver organisation is authenticated, NinjaOne connects over remote PowerShell and creates a journal rule and a distribution group. Every mailbox you add to the backup becomes a member of that group, so a copy of each incoming and outgoing message is sent to a dedicated external journal mailbox. NinjaOne uses Microsoft's envelope journaling, hosts the journal mailboxes on Postfix servers it manages, and collects the journaled mail from that mailbox and files it under each user. The distribution group is kept up to date automatically as accounts are added to backup.

Some practical points from the documentation:

• With the backup admin method, NinjaOne adds its backup admin account to your groups and Teams, because Microsoft's API does not allow shared mailboxes and shared calendars to be backed up otherwise; NinjaOne says that if it is removed, group shared mailboxes, shared calendars and Planner tasks cannot be backed up
• NinjaOne also offers Service Principal Authentication, where no standing admin account is needed; while its custom role is being connected, journaling for Archiver is stopped, which NinjaOne says can take up to 24 hours

Microsoft does not let an Exchange Online mailbox act as the journaling mailbox, which is why reports go to an external service. Our Exchange Online journaling page explains journal rule scope, recipients and undeliverable reports.

Google Workspace: routing rules in the Admin console

Google Workspace journaling is not automatic. NinjaOne's Google Workspace guide sets it up in Apps > Google Workspace > Gmail > Routing in the Google Admin console, with a rule that:

• Affects all four message types (inbound, outbound, internal sending and internal receiving)
• Also delivers each message to an additional recipient, with the envelope recipient replaced by the archive's Journal ID, which we supply as your reseller
• Adds the custom header DME-JOURNAL-REPORT with the value true
• Optionally does not deliver spam to the journal and suppresses bounces from it

To archive only some users, create a Google group of those users and set up separate receiving and sending routing rules filtered on group membership. Group members can be changed later without editing the rules. We do this with you, because a routing mistake can leave gaps in the archive. The full explanation is on our Google Workspace journaling page. We only archive existing Google Workspace tenants; we do not supply Google licences.

Retention policies, Department Sync and roles

Retention is where an archive turns policy into practice, so it gets the most care.

• Standard policy: applies to everything in the organisation, including email, OneDrive, calendars and tasks. Choose a period or use "Set to Unlimited".
• Custom policies: for a department or individual mailboxes, so a regulated team can keep mail longer than everyone else.
• SharePoint policy: a separate policy for selected SharePoint sites.

Be careful with the first policy. NinjaOne says retention is counted from the date each email was received, applies to existing mail as soon as it is created, and permanently deletes items once their period expires. A short period set by mistake can remove years of mail. We can check each period against your written policy with you before it is saved, and legal hold can freeze retention for data that must be preserved.

Department Sync lets you assign users to departments in User Management, so a custom retention policy can target a department and a Group Supervisor only sees the users in the departments they are assigned. Then assign roles: Data Protection Officers can review flagged results, change retention policies and place legal holds, and only they can delete eDiscovery searches. IT Admins cannot use compliance features at all, which keeps archived mail out of day-to-day IT access.

Private Teams chats

Private Teams chats (direct messages outside team channels) can be backed up with the Archiver plan, but backup does not start by itself. NinjaOne's guide asks you to reauthenticate the backup admin account, then enter an application ID and secret in the portal's credential settings and test the connection. After that, every Microsoft 365 account shows on the Private Chat tab as inactive until you activate it, individually or in bulk.

Chats can then be downloaded as EML, PDF or CSV, with or without attachments. Private chats are backed up once a day on the Archiver plan. NinjaOne's own documents differ on whether private chat backup carries an extra charge, so that is confirmed when we quote. More on retention and discovery for Teams is on our Teams chat archiving page.

Journal errors and how they are fixed

NinjaOne is open that it cannot guarantee every journal set-up succeeds. A journal setup error means the system found a missing or incorrect configuration, journaling stops working, and email backups fall back on periodic snapshots, which can leave gaps. NinjaOne lists the usual causes as an incomplete journal rule, expired or invalid credentials, missing permissions, misconfiguration during set-up and incorrect mail routing.

Most errors are credential problems, and NinjaOne emails the partner when a tenant needs to reauthenticate. For Microsoft 365, the fix is to reauthenticate in the End-User Portal under Account Settings > Credentials; for Google Workspace, it is to follow the steps on the portal's Journal ID page. Backup status, including retries and connection or authentication errors, is shown on the End-User Portal's System Status tab.

That is why we can check journaling with you at set-up and show your administrators what to look for, and why it is worth reviewing the status whenever admin credentials or mail routing change. If you also want us to help with ongoing administration, we agree the scope with you when we quote.

Legacy archives and next steps

Journaling captures new mail from the day it is switched on; existing mail is picked up by the initial backup. Older archives exported to PST or zipped EML files are a separate job: NinjaOne offers an ingestion service in which its service delivery team imports the files in bulk after you upload them, covered on our email archive migration page.

Contact us to plan an Archiver set-up for your Microsoft 365 or Google Workspace organisation, or go back to the NinjaOne Archiver overview.