Exchange Online journaling: rules, scope and set-up

What journaling does in Exchange Online

When a message matches a journal rule, Exchange Online's Journaling agent generates a journal report and delivers it to the journaling mailbox you have specified. The original message is attached to the report unaltered. The body of the report carries information from the original message, such as the sender, subject, message ID and recipient addresses.

Microsoft calls this envelope journaling, and it is the only journaling method Microsoft 365 supports. Because the copy is taken as mail passes through the service, it does not depend on what a user later files or deletes. That is why journaling is the standard way to feed a compliance archive; our general guide to email journaling explains the idea, and email archiving vs backup shows how it differs from scheduled backups.

Microsoft also describes journaling as "an older feature from Exchange" and says that, when possible, it recommends Microsoft 365 retention to archive and manage data in place. Journaling remains the documented route for organisations that need a copy stored outside Exchange, which is the job of a separate archive.

The parts of a journal rule

Every journal rule has three parts: a scope, an optional journal recipient and a journaling mailbox.

The journal recipient narrows a rule to particular people. It can be a mailbox, distribution group, dynamic distribution group, mail user or contact, and the address cannot contain a wildcard. If you name a distribution group, mail to or from every member is journaled. If you leave the recipient blank, every message that matches the scope is journaled.

The journaling mailbox is the address that receives the reports. You can use one for all rules or different ones for different rules. Exchange Online limits how many journal rules you can create; Microsoft lists the current figure in its Exchange Online limits documentation.

Why the journaling mailbox has to be outside Exchange Online

Microsoft is explicit: "You can't designate an Exchange Online mailbox as a journaling mailbox." Journal reports must be delivered to an on-premises archiving system or a third-party archiving service. The one exception is an Exchange hybrid deployment, where an on-premises mailbox can be the journaling mailbox for both on-premises and Exchange Online users.

Microsoft's archive mailbox rules close the other obvious route. Using journaling, transport rules or auto-forwarding to copy messages into an archive mailbox is not permitted, and an archive mailbox may only hold one licensed user's mail. In practice, if you want Exchange Online journaling in a cloud-only tenant, you need an outside archive such as NinjaOne Archiver. The Exchange Online Archiving page explains what the archive mailbox is for instead.

Microsoft also points out that journaling mailboxes hold sensitive information and recommends limiting access to the people who need it. A separate archive with role-based access, audit logs and separate compliance roles is built for exactly that.

Delivery failures and the alternate journaling mailbox

If the journaling mailbox does not exist or is temporarily unavailable, journal reports wait in the transport queue on Microsoft's servers. Delivery is retried periodically for up to 24 hours. After that, a non-delivery report (NDR) is generated, with the journal report attached, and sent to the alternate journaling mailbox if you have configured one.

A few points from Microsoft's documentation are worth knowing:

• The alternate journaling mailbox receives every rejected or undeliverable journal report across the whole organisation, so it must be able to cope with volume and be secured like the main one.
• It cannot be an Exchange Online mailbox either.
• If the alternate mailbox is unavailable at the same time as the journaling mailbox, the rejected journal reports are lost and cannot be retrieved.
• When the journaling mailbox is back, reports held in the alternate mailbox can be resubmitted with Outlook's Send Again feature.
• Microsoft says it is the customer's responsibility to monitor and follow up NDRs to the journaling mailbox.

This is one of the strongest arguments for a managed, cloud-native archive: the receiving service is run by the vendor rather than by a server you have to keep online.

Things that catch people out

Journaling behaves in a few ways that surprise people setting it up for the first time:

• Spoofed mail looks internal: a message whose MAIL FROM address is in one of your accepted domains is treated as internal, so an external-only rule will not catch spoofed messages that pretend to come from you.
• Out-of-office replies have an empty MAIL FROM field, so external-scoped rules journal them.
• Quarantined messages sent to quarantine by a mail flow rule are not journaled until they are released.
• Encrypted messages: you can turn on journal report decryption so the report holds a clear-text copy of mail encrypted by your own organisation. Mail encrypted by outside organisations is not decrypted.
• Duplicates: when a message matches several rules with different journaling mailboxes, each one gets a report, and hybrid deployments can produce duplicate reports by design.

None of these stops journaling working well, but they matter when you are deciding scope and explaining to an auditor what the archive holds.

How NinjaOne Archiver sets up journaling

With NinjaOne Archiver you do not build the journal rule by hand. According to NinjaOne's documentation:

1. After you authenticate your Microsoft 365 tenant, NinjaOne connects over remote PowerShell and creates a journal rule and a distribution group in Exchange Online, using Microsoft's envelope journaling.
2. Journal reports go to a dedicated external journal mailbox for your Archiver organisation, on mail servers that NinjaOne manages, which meets Microsoft's requirement for an outside journaling mailbox.
3. Mailboxes you add to the archive become members of the distribution group, so their inbound and outbound mail is journaled from that point.
4. Mail already in those mailboxes is captured by the initial backup, so the archive includes existing history as well as new mail.

NinjaOne says it "cannot guarantee a 100% success rate" for journaling. Journal errors are usually credential problems, such as an expired or changed admin authorisation, and reauthenticating fixes them; until then, archiving can fall back on snapshot backups only. So, as part of set-up, we can check that reports are arriving and show your administrators where journal errors appear and how to reauthenticate. The full sequence is on how NinjaOne Archiver is set up.

How Forever Systems helps

We supply NinjaOne SaaS Backup with Archiver and can help you:

• Decide which mailboxes, shared mailboxes and leavers to include
• Authenticate the tenant and confirm the journal rule and distribution group are in place
• Check for older journal rules from a previous archive that should be retired, so you do not journal to two places by accident
• Set retention policies and reviewer roles to match your email retention policy

Pricing depends on the bundle, user count and term, so ask us for a quote. Contact us and tell us how mail is archived today.