An email archive holds a complete, searchable copy of everything the organisation has said in writing, which makes it both a legal necessity and one of the most valuable targets an attacker can reach. Regulated firms must capture and keep business email in tamper-evident form, privacy law says not to keep personal data longer than needed, and litigation needs reliable search and holds. Journaling and archiving are the two mechanisms that deliver this, and they are often confused. This guide explains the difference, how journaling works in Exchange Online and Google Workspace, what SEC Rule 17a-4 and FINRA Rule 4511 actually require, how to design retention, and how to secure the archive and the service identities that feed it. It is for messaging, compliance and security teams; capture of messaging apps and personal devices is covered in the Off-Channel Communications Guide.
Key takeaways
- Journaling captures, archiving keeps: journaling copies every in-scope message at transport time, before a user can delete it; an archive stores, indexes and retains what it receives. Mailbox archives alone are not journaling.
- Know the actual rule: SEC Rule 17a-4(b)(4) requires business communications to be kept for not less than three years, the first two in an easily accessible place, in either a non-rewriteable, non-erasable format or a system with a complete time-stamped audit trail.
- Lock retention against your own admins: features such as Microsoft Purview Preservation Lock stop anyone, including a global administrator, from shortening or deleting a locked retention policy.
- The archive is a crown jewel: archive administrators, eDiscovery roles and the archiving vendor's service credentials can read every message. Govern them as privileged and non-human identities.
- Retention cuts both ways: keeping everything forever breaches privacy storage limitation and enlarges breach impact; set a schedule, apply holds deliberately and let expired data go.
Journaling versus archiving versus backup
| Mechanism | What it does | Can users alter it? | Typical purpose |
|---|---|---|---|
| Journaling | Copies each matching message, with envelope data such as all recipients including Bcc and distribution list expansion, to a journal destination at transport time | No; the copy is made before delivery | Regulatory capture (broker-dealers, some public bodies), feeding third-party archives |
| Mailbox archive (for example Exchange Online archive mailboxes) | Extra storage linked to the user's mailbox; items move there by policy | Yes, unless retention or holds apply | Mailbox size management, user access to old mail |
| Retention policies and holds (Purview, Google Vault) | Preserve content in place for a period or indefinitely despite user deletion | Users can delete from view; preserved copy remains | Compliance retention, litigation hold, eDiscovery |
| Third-party archive | Separate, indexed, often WORM store fed by journaling or API | No, if configured as WORM | Supervision, eDiscovery, regulatory retention, platform independence |
| Backup | Point-in-time copies for restore | Depends on immutability | Recovery from deletion, corruption or ransomware, not records compliance |
Microsoft's archive mailbox gives up to 100 GB of extra storage, auto-expanding archiving adds up to 1.5 TB (Microsoft states that a 3 TB limit for eligible licences began rolling out in mid-October 2026), and the default retention policy moves items two years old to the archive. That is storage management. Compliance comes from retention, holds or journaling layered on top. Backup is a separate control again; see the Microsoft 365 Backup guide.
How journaling works in practice
Exchange Online and Exchange Server
- Journal rules have three parts: a scope (internal messages only, external messages only, or all messages), an optional journal recipient (a mailbox, group, mail user or contact whose messages are journaled; no wildcards) and a journaling mailbox that receives the reports. Exchange Online limits how many journal rules a tenant can create.
- Journal reports carry the original message unaltered as an attachment, with envelope information (sender, subject, message ID, recipients) in the body. Microsoft calls this envelope journaling and it is the only method Microsoft 365 supports.
- The destination cannot be in Exchange Online. Reports must go to an on-premises mailbox or a third-party archiving service, usually over SMTP to an address the archive provides.
- Undeliverable reports are queued and retried for up to 24 hours, then returned as non-delivery reports to the alternate journaling mailbox. If that mailbox is also unavailable, Microsoft states the reports are lost and cannot be retrieved. The alternate mailbox therefore holds sensitive copies of journaled mail and must be treated as a protected, monitored mailbox.
Google Workspace
- Google Vault retains Gmail in place with one default rule per service and custom rules by organisational unit, date range or search terms; holds take precedence over retention rules and keep data indefinitely.
- Expiry is final: once retention expires, messages disappear from view and remain available to Vault administrators for about 30 days before being purged. Google warns that careless rule changes can cause unprotected data to be purged immediately.
- External archives are fed by routing rules that send a copy of messages to an archive address, the Workspace equivalent of journaling.
What the rules require
| Requirement | Source | What it means for email |
|---|---|---|
| Keep business communications not less than three years, first two easily accessible | SEC Rule 17a-4(b)(4) | Originals of received and copies of sent communications, including inter-office, relating to the business |
| Non-rewriteable, non-erasable format, or a complete time-stamped audit trail of modifications and deletions | SEC Rule 17a-4(f)(2)(i) | WORM storage or an audit-trail system covering who changed what and when for the whole retention period |
| Verify completeness and accuracy; serialise and time-date; download in human-readable and reasonably usable electronic format; backup or redundant set | SEC Rule 17a-4(f)(2)(ii) to (v) | Capture monitoring, export tested regularly, a second copy |
| Audit system for inputting of records (WORM option); undertaking signed by a designated executive officer or designated third party | SEC Rule 17a-4(f)(3)(iii) and (f)(3)(v) | Records of what was ingested, and a named person or third party able to produce records for regulators |
| Preserve books and records in 17a-4 format; six years where no other period is set | FINRA Rule 4511 | FINRA members inherit the 17a-4 format requirements |
| Storage limitation and security of personal data | GDPR and UK GDPR Article 5(1)(e) and (f) | Retention periods must be justified and documented; archives must be secured |
Other sectors have their own rules (for example public records law and healthcare retention). Build the schedule from legal advice for your jurisdictions, then implement the shortest compliant period for each category. See the Data Retention and Secure Deletion Guide and the Data Retention and Disposal Policy Template.
Designing retention
- Classify mailboxes, not just messages: registered representatives, executives, traders and public officials usually need journaling or locked retention; most staff need a standard retention period.
- Set default and exceptions: one organisation-wide default period, longer periods for regulated roles, and deletion at the end. In Purview, retention policies apply by location; retention labels apply by item.
- Use locks where the law needs immutability: Microsoft Purview Preservation Lock is applied with
Set-RetentionCompliancePolicy -Identity "<policy>" -RestrictiveRetention $true; afterwards nobody can disable, delete or shorten the policy, only extend it or add locations. Adaptive scopes do not support it. Test on a pilot policy first, because there is no undo. - Holds are separate from retention: a litigation or investigation hold overrides expiry. Record who placed each hold and why, and release holds when matters close. See the eDiscovery and Legal Hold Guide.
- Journal scope: "All messages" captures internal and external traffic; scoping by recipient reduces volume but risks missed capture when people change roles.
Native retention or a third-party archive
| Factor | Native retention and holds | Journaling to a third-party archive |
|---|---|---|
| Independence from the mail platform | Data stays in the same tenant; a tenant compromise or account closure affects both | Separate copy under separate administration |
| Immutability evidence | Locks such as Preservation Lock; check whether they meet your regulator's expectations | WORM storage and undertakings are common offerings; verify in contract |
| New identities and credentials | None beyond platform admin roles | Vendor application, certificate or connector credentials with broad mail access |
| Capture of other channels | Limited to the platform's own services | Often also captures chat, social and messaging feeds |
| Exit and portability | Bound to the platform licence | Depends on the vendor's export format and exit terms |
Legacy archives and PST files
Old on-premises archives, stub-based archiving and PST files on file shares are where retention schedules usually fail. They hold mail outside every policy, are rarely encrypted, and are invisible to eDiscovery. Find them with file share scans for .pst and .ost files, ingest what must be kept into the governed archive with chain-of-custody records (source, hash, date, operator), and delete the rest under the disposal policy. Block new PST creation through client policy where the platform allows it. Decommission old archive servers only after a verified export, because their service accounts often still have mailbox-wide rights in the directory.
Securing the archive: where identity fits
An archive concentrates years of contracts, credentials sent by email, personal data and privileged legal advice. ATT&CK Remote Email Collection (T1114.002) and Additional Email Delegate Permissions (T1098.002) describe how attackers harvest mail; an archive or eDiscovery account turns that into one search.
- Archive and eDiscovery administrators: few named accounts, phishing-resistant MFA, privileged access workstations, and separation between those who configure retention and those who search content (NIST SP 800-53 AC-6). See the Microsoft 365 admin centres and admin roles guide.
- Vendor service identities: third-party archives connect with OAuth applications, certificates or service accounts that can read every mailbox. Grant the minimum permissions, restrict application access to the mailboxes in scope, store certificates and secrets in a vault and rotate them. The Mimecast certificate compromise showed how one stolen vendor certificate trusted by many tenants exposes them all, and the ConnectWise Cloud Backup breach showed an application credential signing in to more than 160 Microsoft 365 tenants with no MFA in the path. See How to review Microsoft 365 app registrations with mail permissions.
- Journal transport: require TLS on the connector to the archive, restrict the destination to the vendor's published address, and alert on changes to journal rules and connectors. A rule pointed at an attacker's address is silent, complete exfiltration, the server-side equivalent of Email Forwarding Rule (T1114.003).
- Encryption at rest and keys: confirm how the archive encrypts stored mail, who holds the keys and whether customer-managed keys are offered (SC-28).
- Exports: eDiscovery exports are full copies outside the archive. Log, encrypt and expire them.
- Vendor assurance: review the archive provider's security reports, sub-processors, data location and exit terms, including how you get your data back in a usable format (SR-6).
Detection and measurement
- Configuration changes: creation, modification or deletion of journal rules, transport rules and connectors; retention policy and label changes; holds released.
- Search activity: eDiscovery searches and exports, especially broad queries, off-hours activity or searches by recently granted users (DE.CM-03). See the Microsoft 365 Unified Audit Log Guide for Detection and the Google Workspace Audit Log Detection Guide.
- Capture health: NDRs reaching the alternate journaling mailbox, archive ingestion gaps, reconciliation between messages sent and messages archived.
- Application access: new consent grants or credentials added to archive applications, and sign-ins from unexpected locations.
| Metric | Target | What it shows |
|---|---|---|
| Capture reconciliation rate (archived vs transport count) | 100% for regulated mailboxes | Completeness as 17a-4(f)(2)(ii) expects |
| Journal reports landing in the alternate mailbox per week | Zero, each investigated | Delivery failures before data is lost |
| Accounts with archive search or export rights | Small, reviewed quarterly | Exposure of the whole corpus |
| Holds without an active matter | Zero | Over-retention |
| Time to produce a regulator export | Within the agreed period, tested twice a year | Production readiness |
How to implement
- Inventory obligations and data: list regulated roles, applicable rules and current capture paths (journaling, retention, legacy PST files, old archives).
- Choose the model: native retention and holds (simpler, inside the platform) or journaling to a third-party WORM archive (independent copy, supervision features, portable). Firms under 17a-4 often choose a third-party archive with the vendor as designated third party.
- Pilot: journal a pilot group, reconcile counts daily, test search, hold and export, and confirm alternate journaling mailbox alerts work.
- Roll out by population, regulated users first, then everyone in scope. Keep the old capture method running in parallel until reconciliation is clean.
- Lock and harden: apply locks only after the pilot proves the policy is right; reduce admin roles; vault and rotate vendor credentials.
- Rollback: unlocked retention policies and journal rules can be disabled; locked policies cannot, so rollback planning happens before the lock.
- Operate: monthly reconciliation, quarterly access reviews, annual retention schedule review and a tested exit plan for the archive vendor.
Small and large organisations: an unregulated small business usually needs only a retention policy, litigation hold capability and backup. A regulated firm needs journaling or locked retention, an undertaking, supervision and regular export testing. A large multinational must also reconcile conflicting retention periods across jurisdictions.
Common failure patterns
- Treating mailbox archives as compliance: users can delete from them unless retention or holds apply.
- Silent journal failure: reports pile up in an unmonitored alternate journaling mailbox, or are lost when both destinations fail.
- Over-privileged archive application: a vendor app with tenant-wide read access and a long-lived secret nobody rotates, as in the Mimecast and ConnectWise incidents.
- Locking the wrong policy: Preservation Lock applied to a policy with the wrong scope or period, which cannot be undone.
- Keep everything forever: no deletion at end of retention, holds never released, and a breach that exposes a decade of mail.
- Migration gaps: moving archive vendors without chain-of-custody evidence, losing audit trails or envelope data.
Framework mapping
| Area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Retention and disposal | SI-12 | GV.OC-03 | 5.33, 8.10 |
| Legal and regulatory requirements | SI-12 | GV.OC-03 | 5.31 |
| Archive admin and eDiscovery access | AC-6 | PR.AA-05 | 8.2, 5.15 |
| Protection at rest and in transit | SC-28, SC-8 | PR.DS-01 | 8.24 |
| Logging and monitoring | AU-2 | DE.CM-03 | 8.15, 8.16 |
| Archive vendor | SR-6 | GV.SC-07 | 5.19, 5.20 |
| Redundant copy | SI-12 | PR.DS-11 | 8.13 |
Practitioner checklist
- Document which mailboxes and roles fall under which retention rule, with legal sign-off.
- Decide between native retention and journaling to a third-party archive, and record why.
- Monitor the alternate journaling mailbox and reconcile archive ingestion against transport counts.
- Apply Preservation Lock or WORM settings only after a pilot proves scope and period.
- Limit archive and eDiscovery roles to named accounts with phishing-resistant MFA and separate configuration from search duties.
- Restrict, vault and rotate the archive vendor's application credentials or certificates, and review mail-permission apps quarterly.
- Alert on changes to journal rules, connectors, retention policies and holds.
- Delete at the end of retention and release holds when matters close.
- Test regulator-format export and the vendor exit process at least annually.
Standards and references
- US Code of Federal Regulations (LII): 17 CFR 240.17a-4 Records to be preserved by certain exchange members, brokers and dealers
- FINRA: Rule 4511 General Requirements
- Microsoft Learn: Journaling in Exchange Online
- Microsoft Learn: Use Preservation Lock to restrict changes to retention policies
- Microsoft Learn: Learn about archive mailboxes
- Google: How retention works for Gmail in Vault
- NIST: SP 800-53 Rev. 5
- MITRE ATT&CK: Remote Email Collection
Related NHI Mgmt Group resources: Off-Channel Communications Guide · eDiscovery and Legal Hold Guide · Exchange Online Security Guide · Email Security Guide