Entra / Microsoft 365 · Exchange Online
Report enforced time stamps
Report compliance time stamps written into Exchange Online mailboxes that guide the Managed Folder Assistant when applying retention policies and holds.
Connect & set up
Run these once per session. All scopes are read-only unless the script makes changes.
Connect-ExchangeOnline -ShowBanner:$false
Run it
The main script. Copy it, or download the .ps1 and run it from your console.
[array]$Modules = Get-Module | Select-Object -ExpandProperty NameIf ("ExchangeOnlineManagement" -notin $Modules) {Write-Host "Connecting to Exchange Online..."Connect-ExchangeOnline -ShowBanner:$false}# Define the event types$EventTypeMap = @{1 = 'RetentionHoldApplied'2 = 'RetentionHoldRemoved'3 = 'LitigationHoldApplied'4 = 'LitigationHoldRemoved'5 = 'DelayHoldApplied'6 = 'DelayHoldRemoved'7 = 'RetentionPolicyApplied'8 = 'RetentionPolicyRemoved'9 = 'RetentionPolicyTagApplied'10 = 'RetentionPolicyTagRemoved'11 = 'CalendarLoggingDisabled'12 = 'CalendarLoggingEnabled'13 = 'AuditEnabled'14 = 'AuditDisabled'15 = 'SingleItemRecoveryDisabled'16 = 'SingleItemRecoveryEnabled'17 = 'DiscoveryHoldApplied'18 = 'DiscoveryHoldRemoved'26 = 'DiscoveryHoldRemoved (Legacy)'}# Find mailboxes[array]$Mailboxes = Get-Mailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox | Sort-Object DisplayNameWrite-Host ("Found {0} mailboxes to process" -f $Mailboxes.Count)$Report = [System.Collections.Generic.List[Object]]::new()ForEach ($Mailbox in $Mailboxes) {[array]$Events = $Mailbox.EnforcedTimestampsIf ($Events.Count -eq 0) {Write-Host ("No enforced time stamps found for mailbox {0} ({1})" -f $Mailbox.DisplayName, $Mailbox.PrimarySmtpAddress)Continue}$EventData = $Events | ConvertFrom-JsonForEach ($Event in $EventData) {$EventType = $null[int]$EventType = $Event.EventType[string]$EventTypeString = $EventTypeMap[$EventType]$EventTimeStamp = Get-Date $Event.EventTimeStamp -Format 'dd-MMM-yyyy HH:mm'$EnforcedUntilTimestamp = If ($Event.EnforcedUntilTimestamp) { Get-Date $Event.EnforcedUntilTimestamp -Format 'dd-MMM-yyyy HH:mm' } Else { 'N/A' }$ReportLine = [PSCustomObject][Ordered]@{DisplayName = $Mailbox.DisplayNamePrimarySmtpAddress = $Mailbox.PrimarySmtpAddressEventType = $EventType'Event Name' = $EventTypeStringEventTimeStamp = $EventTimeStampEnforcedUntilTimestamp = $EnforcedUntilTimestamp}$Report.Add($ReportLine)}}
Attribution
Author
Office365itpros