Microsoft 365 Email Archiving

Microsoft 365 stores email, but it does not archive it in the sense of GoBD. Emails can be deleted from the mailbox and the online archive, and administrators can change retention policies. Keeping email for 6, 8 or 10 years under § 257 HGB and § 147 AO takes a copy of every email outside the mailbox. This guide shows how to set it up.

Prerequisites

• A Microsoft 365 tenant with Exchange Online
• An account with Exchange admin rights
• An EasyMailArchive account. Sign up here, free for 30 days.

Step 1: Get your relay address

After signing up, the app shows your relay address under Admin > Integrations:

[email protected]

Step 2: Create a transport rule

1. Open the Exchange admin center.
2. Go to Mail flow > Rules.
3. Choose Add a rule > Create a new rule.
4. Name: "EasyMailArchive".
5. Apply this rule if: Apply to all messages.
6. Do the following: Bcc the message to and enter your relay address.
7. Save and enable the rule.

If the admin center does not accept the address, first add it as a mail contact under Recipients > Contacts.

You can also use a journal rule in Microsoft Purview under Data lifecycle management > Exchange (legacy) > Journal rules. The result is the same.

Step 3: Test

Send one email from outside to a mailbox and one email out. Both appear in EasyMailArchive search within minutes.

Step 4: Import existing mail

The transport rule captures everything from the moment it is active. Import older emails under Admin > Import, either through the Microsoft 365 connection or over IMAP for single mailboxes. Emails already archived are detected and not stored twice.

Step 5: Set retention

Set how long emails are kept in the rules. A common choice is 10 years for all mailboxes. That covers business letters (6 years), invoices (8 years) and annual financial statements sent by email (10 years). Add an exclusion rule for mailboxes that should not be archived.

What you get

• Every email in its original form with attachments, encrypted with AES-256 and a separate key
• Storage in a data centre in Germany, a separate database per customer
• No delete function for single emails, automatic deletion when retention ends
• Sign-in with Microsoft accounts via SSO
• Export as EML, or as PDF with SHA-256 checksums

Read more

• GoBD email archiving
• Audit-proof email archiving
• Microsoft 365 vs dedicated archiving

See pricing or try it free for 30 days.

This article summarises the law in general terms and is not legal or tax advice.