Microsoft 365 Compliance Center vs. Dedicated Email Archiving

Microsoft 365 is the productivity platform of choice for tens of millions of businesses worldwide. Its Compliance Center bundles a set of features that many IT administrators assume cover their email archiving obligations. In practice, the picture is more nuanced. M365 compliance tools are powerful within their intended scope, but they were designed primarily to support Microsoft's own legal holds and eDiscovery workflows, not to serve as a standalone, auditor-ready email archive. This article breaks down what M365 offers, where it falls short, and how dedicated archiving solutions fill the gaps.

What Microsoft 365 Offers

M365 includes several features that overlap with email archiving:

In-Place Archive (Exchange Online Archiving) The In-Place Archive provides a secondary mailbox that moves older messages out of the primary mailbox. It is included in Exchange Online Plan 2, Microsoft 365 Business Premium, and higher tiers. Storage limits and auto-expand archive availability depend on the specific license.

Retention Policies and Retention Labels The Microsoft Purview compliance portal allows administrators to define retention policies that keep or delete content based on age or specific conditions. Labels can be applied manually or automatically using trainable classifiers.

Litigation Hold and In-Place Hold Placing a mailbox on Litigation Hold prevents any item from being permanently deleted, regardless of user action, for the duration of the hold. This is commonly used in legal proceedings.

eDiscovery (Content Search, Core eDiscovery, eDiscovery Premium) M365 provides search and export tools that allow compliance teams to query mailbox content across the tenant. The premium tier adds custodian management, review sets, and advanced analytics.

Audit Logging The Unified Audit Log captures administrator and user actions across M365 services. Retention of audit log data ranges from 90 days (E3) to 1 year (E5) or up to 10 years with an add-on.

These are genuinely useful capabilities. For small organisations with straightforward compliance needs and no cross-platform obligations, they may be sufficient. For everyone else, the limitations are significant.

Where M365 Built-in Archiving Falls Short

Vendor Lock-in and Data Portability

All archived data lives inside Microsoft's ecosystem. Exporting mailbox content at scale requires either the eDiscovery export tool (which produces PST files) or the M365 API, both of which impose rate limits and operational complexity. There is no native journal feed to an external system, and Microsoft retains control over the data format, tooling, and access methods.

The EU Data Act (Regulation 2023/2854, Chapter IV) addresses exactly this scenario. From September 2027, cloud providers must ensure customers can switch to a competing service without functional, technical, or financial obstacles, and at zero switching cost. Article 23 requires providers to offer documented interfaces for porting data to other providers. Microsoft is adapting to these requirements, but the current M365 export experience is far from frictionless.

US Data Residency and Cross-Border Transfer Risk

Microsoft is a US company subject to the CLOUD Act (2018). US authorities can compel Microsoft to produce data stored in any Microsoft facility worldwide, including EU data centres. Even with M365's EU Data Boundary commitments, this exposure is not fully eliminated because some processing and support access may still involve non-EU personnel.

Under GDPR Articles 44 to 49, transfers of personal data to third countries require either an adequacy decision, Standard Contractual Clauses (SCCs), or another recognised mechanism. The EU-US Data Privacy Framework (2023) provides the current basis for transfers to certified US organisations. However, this framework is subject to legal challenge, as its two predecessors (Safe Harbor, Privacy Shield) were both invalidated by the Court of Justice of the EU. Organisations that need to demonstrate verifiable, future-proof data sovereignty should maintain the option to store email archives on EU-controlled infrastructure under a controller they can audit directly.

No Guaranteed Immutability

GoBD (the German fiscal authority's principles for electronic records) and similar regulations in Austria and Switzerland require that archived records cannot be altered after the fact, with every access logged. M365 Litigation Hold prevents deletion but does not provide the cryptographic or write-once guarantees that many auditors expect when reviewing compliance with GoBD-style immutability requirements. Microsoft's platform is updated continuously, and the internal storage mechanisms are not exposed for independent verification.

Feature Changes and Licence Dependency

Microsoft regularly restructures its compliance feature portfolio. Features that were available in one licence tier get moved, rebranded, or restricted. The transition from the Security and Compliance Center to the Microsoft Purview portal brought significant UI and functional changes. Organisations that rely on specific M365 compliance capabilities need to monitor Microsoft's roadmap and licence terms actively and may need to upgrade licences to retain access to features they currently depend on.

Audit Log Retention Limits

Without the M365 E5 licence or the Audit Premium add-on, unified audit log retention is limited to 90 days (E3: 180 days for some events). Regulations such as GoBD (10-year retention) and HGB Section 257 (6 years for commercial correspondence) require far longer retention periods. Bridging this gap requires purchasing additional add-ons or accepting that the audit trail is incomplete.

No Journal-Level Completeness Guarantee

M365 retention policies operate on existing mailbox content. If a user moves a message to a personal folder, an unmanaged device, or a third-party client that bypasses Exchange Online, the retention policy may not capture it. SMTP journaling, by contrast, captures a copy of every message at the transport layer, before it reaches the mailbox and before the user can interact with it. This is the standard relied upon by financial regulators and auditors as proof of complete capture.

GDPR Obligations: The Processor Relationship

When you store email archives in M365, Microsoft acts as a data processor under GDPR Article 28. The Microsoft Data Protection Addendum (DPA) constitutes the processor agreement. You remain the controller responsible for ensuring that the processing meets your GDPR obligations, including:

• Demonstrating that the processor provides sufficient guarantees (Art. 28(1))
• Ensuring the processor only processes data on your documented instructions (Art. 28(3)(a))
• Verifying that sub-processors are subject to equivalent obligations (Art. 28(4))

In practice, this means you are relying on Microsoft's self-attestation and third-party audit reports (ISO 27001, SOC 2) rather than direct audit rights. For many organisations, this is acceptable. For organisations in regulated sectors (finance, healthcare, legal) or those operating under national supervisory guidance that demands demonstrable control over archived records, a dedicated solution with clear contractual audit rights and EU-only infrastructure is the more defensible position.

NIS2 (Directive 2022/2555, Art. 21) also requires that organisations subject to the directive implement risk management measures covering their supply chain and service providers. Sole reliance on a single hyperscaler for both primary email and archiving creates a concentration risk that is difficult to mitigate within the same ecosystem.

Comparison: M365 Built-in vs. Dedicated Email Archiving

The Journal-Based Approach: M365 Plus an External Archive

The strongest architecture for M365 customers with serious compliance requirements is not to choose between M365 and a dedicated archive, but to use both. The setup is straightforward:

1. Configure a journal rule in Exchange Online to send a copy of every inbound and outbound message to a dedicated SMTP journal address.
2. The dedicated archive receives messages at the transport layer, before any user interaction, and stores them in immutable, encrypted form.
3. M365 retention policies continue to manage the active mailbox. The archive provides the long-term, auditor-grade record.

This approach preserves all existing M365 workflows. Users continue to work in Outlook or Teams as normal. Administrators retain access to all M365 compliance tools for day-to-day operations. The dedicated archive handles the long-term retention, immutability, and data sovereignty requirements that M365 alone cannot fully address.

The journal rule can be scoped to all mailboxes or to specific domains, making it straightforward to archive only regulated traffic if needed. Exchange Online journal targets must be an external SMTP address; EasyMailArchive provides this endpoint out of the box.

Making the Right Choice for Your Organisation

M365's built-in compliance tools are a solid starting point. They are appropriate for organisations that:

• Have no specific audit-grade immutability requirements
• Operate exclusively within the Microsoft ecosystem
• Accept the CLOUD Act risk profile for their stored data
• Do not face GoBD, financial sector, or other regulator-specific archiving standards

Dedicated archiving is the better fit for organisations that:

• Must demonstrate GoBD-compliant, cryptographically verifiable immutability
• Require provable EU data sovereignty without reliance on a US parent company
• Archive email from multiple platforms (M365, Google Workspace, on-premise Exchange)
• Need to demonstrate data portability in preparation for the EU Data Act (September 2027 deadline)
• Want predictable per-user pricing independent of Microsoft licence tier changes
• Must provide auditors with direct evidence of tamper-evident storage

EasyMailArchive as Your M365 Journal Target

EasyMailArchive integrates directly with Exchange Online as a journal target. Every message sent or received by your M365 tenant is captured at the SMTP transport layer and stored in encrypted, tamper-evident form on EU infrastructure, with retention periods you control.

Features relevant to M365 customers:

• SMTP journal endpoint for Exchange Online journal rules
• AES-256 encryption at rest, TLS 1.3 in transit
• Cryptographic message integrity verification on retrieval
• EU-only hosting with no US sub-processor exposure
• Configurable retention policies from 1 to 10 years per domain or user group
• eDiscovery and legal hold tools that work across all archived sources, not just M365
• GDPR-compliant DPA with direct audit rights

If your organisation is running M365 and needs to close the gap between Microsoft's built-in capabilities and your regulatory obligations, EasyMailArchive is designed for exactly that use case.