One in five mailboxes in this project belongs to someone who has left. The business wants that mail in Microsoft 365, but it doesn't want to pay for 100 licenses that nobody will ever sign in with. That's achievable, within clear limits. In this part I'll set out what Microsoft's licensing rules allow, compare the possible designs, and then build the license-free one: one shared mailbox per former employee, filled with the same IMAP endpoint as part 2.
What the rules allow#
Microsoft's shared mailbox documentation and the Exchange Online limits page set the boundaries:
- A shared mailbox stores up to 50 GB without a license. Raising it to 100 GB needs an Exchange Online Plan 2 license.
- Microsoft lists more situations that need a license on the shared mailbox: a larger in-place archive and litigation hold each require Exchange Online Plan 2, or Plan 1 with the Exchange Online Archiving add-on. Advanced features such as Defender for Office 365, eDiscovery (Premium) and retention policies may need licensing too.
- Whoever opens a shared mailbox needs their own Exchange Online license; the shared mailbox doesn't. Microsoft states that a shared mailbox supports at most 25 users, and that its own account isn't meant for signing in, so block sign-in and keep it blocked.
- You can't stop people with access from deleting messages in a shared mailbox.
- When a shared mailbox reaches its limit it can receive for a while but can't send, and after that senders get non-delivery reports. For a migration, it means the copy stops at the quota.
The options#
| Design | License | Capacity | Who can reach the mail | Retention |
|---|---|---|---|---|
| Unlicensed shared mailbox per leaver | None | 50 GB | Named staff with Full Access (up to 25) | No litigation hold; people with access can delete |
| Shared mailbox with Exchange Online Plan 2 | One per mailbox | 100 GB plus archive | Same | Litigation hold available |
| Inactive mailbox | Only while you load it; freed when the account is deleted | That of the license used | Only through Microsoft Purview eDiscovery and content search | Kept by a retention policy or hold |
| PST files on a file share | None | Disk space | Anyone with access to the files | Nothing in Microsoft 365, and not searchable there |
| Leave it on FortiMail | None in Microsoft 365 | Existing disks | FortiMail administrators | FortiMail's own, for as long as the hardware lives |
For a requirement worded "migrate them without assigning a license", the first row is the answer for every leaver whose mailbox fits in 50 GB. The second and third rows are for the exceptions: mailboxes that are too big, or people whose mail is under a legal hold.
The inactive mailbox route needs a word of explanation. Microsoft turns a mailbox into an inactive mailbox when a hold or retention policy is on it and the user account is then deleted. The mailbox must be licensed so the hold can apply, and once the account is deleted that license is free to assign to someone else. The inactive mailbox can't receive mail, disappears from the address book and is reached only by people with eDiscovery permissions. It's the strongest option for retention, but it needs a license while you load and hold each mailbox.
Step 1: Create the shared mailboxes#
Create one shared mailbox per leaver, with the leaver's original address, so searches by address and replies to old threads still make sense. A CSV with Alias, DisplayName and PrimarySmtpAddress columns drives it:
Connect-ExchangeOnline
Connect-MgGraph -Scopes "User.ReadWrite.All"
$leavers = Import-Csv "C:\Migration\leavers.csv"
foreach ($l in $leavers) {
New-Mailbox -Shared -Name $l.Alias -Alias $l.Alias -DisplayName $l.DisplayName -PrimarySmtpAddress $l.PrimarySmtpAddress
}
# Once the mailboxes exist: block sign-in, hide them from the address book, grant access
foreach ($l in $leavers) {
$mbx = Get-Mailbox -Identity $l.PrimarySmtpAddress
Update-MgUser -UserId $mbx.ExternalDirectoryObjectId -AccountEnabled:$false
Set-Mailbox -Identity $l.PrimarySmtpAddress -HiddenFromAddressListsEnabled $true
Add-MailboxPermission -Identity $l.PrimarySmtpAddress -User "records.team@contoso.com" -AccessRights FullAccess -AutoMapping $false
}Grant access to a small mail-enabled security group (here records.team@contoso.com) rather than to individuals. Then decide what should happen to mail that still arrives at these addresses: leave it, forward it to a manager with Set-Mailbox -ForwardingAddress, or accept internal senders only with Set-Mailbox -RequireSenderAuthenticationEnabled $true.
Watch out: if the leavers' accounts are still synchronized from Active Directory with their email addresses, those addresses are already taken in Microsoft Entra ID and the shared mailboxes can't use them. Take those accounts out of the synchronization scope, or clear their address attributes, before you create the mailboxes.
Step 2: Size them and settle the exceptions#
Run the analysis batch from part 1 against the shared mailboxes. In the CSV, EmailAddress is the shared mailbox, and the credentials are those of the leaver's FortiMail account. Because nobody uses these accounts any more, you can reset their FortiMail passwords without affecting anyone. One catch: if FortiMail checks passwords against Active Directory and the leavers' directory accounts are disabled or deleted, the IMAP sign-in fails, so first give those accounts a password FortiMail can verify.
New-MigrationBatch -Analyze -Name "Leavers-Analysis" -SourceEndpoint "FortiMail-IMAP" -AutoStart `
-CSVData ([System.IO.File]::ReadAllBytes("C:\Migration\leavers-all.csv"))
Get-MigrationUser -BatchId "Leavers-Analysis" | Format-Table Identity, Status, EstimatedTotalCount, EstimatedTotalSizeEstimatedTotalSize is in bytes, and 45 GB is 48,318,382,080 bytes. Every leaver above that line is an exception, because the mailbox has to hold the data and keep some headroom under the 50 GB cap. Decide each exception with legal and HR:
- License it with Exchange Online Plan 2: 100 GB, plus an archive and litigation hold if needed.
- Make it inactive: migrate into a licensed mailbox, apply the retention policy, confirm the hold, delete the account, and reuse the license for the next one.
- Keep it outside Microsoft 365, on FortiMail or as a protected PST file, until its retention period ends, if nobody needs to search it.
Step 3: Migrate the data#
Use the endpoint from part 2, with separate batches for the leavers so their errors don't mix with the active users' waves:
New-MigrationBatch -Name "Leavers-01" -SourceEndpoint "FortiMail-IMAP" `
-CSVData ([System.IO.File]::ReadAllBytes("C:\Migration\leavers-01.csv")) -AutoStart
Get-MigrationUser -BatchId "Leavers-01" | Format-Table Identity, Status, SyncedItemCount, SkippedItemCount
Get-EXOMailboxStatistics -Identity jane.doe@contoso.com | Format-List DisplayName, ItemCount, TotalItemSizeNote: Microsoft's IMAP migration documentation is written for user mailboxes and doesn't discuss shared mailboxes as targets either way. Admins report that IMAP batches into unlicensed shared mailboxes complete normally, but prove it in your own tenant with a pilot of two or three leavers before you commit all 100.
Two decisions differ from the active users:
- Exclusions. When the point is retention, legal may want everything, including the trash and junk folders. Don't exclude folders out of habit.
- When to remove the batch. If a leaver's address no longer receives mail on FortiMail, remove the batch once the mailbox is Synced and checked. If it still receives mail, keep the batch running until after the MX cutover, like everyone else's.
Step 4: Be clear about retention#
An unlicensed shared mailbox keeps the mail in Exchange Online, but it isn't a records system: there's no litigation hold without a license, and anyone with Full Access can delete items. Keep the access group small and put that decision in writing. Where legal needs mail that can't be altered, license those few mailboxes and place them on litigation hold, or use the inactive mailbox route. Before you delete an account to make its mailbox inactive, confirm the hold really is on it:
Get-Mailbox -Identity jane.doe@contoso.com | Format-List LitigationHoldEnabled, InPlaceHolds
# After the account is deleted (it can still be restored for 30 days)
Get-Mailbox -InactiveMailboxOnly -ResultSize Unlimited | Format-Table DisplayName, PrimarySmtpAddress, WhenSoftDeletedMicrosoft recommends Microsoft 365 retention policies, rather than litigation hold or eDiscovery holds, for creating inactive mailboxes. My guide to retention policies, litigation hold and inactive mailboxes covers the setup.
What not to do#
- One mailbox for everyone. Importing all the leavers into one licensed mailbox, or into its archive, is the tempting shortcut, and it breaks the rules. Microsoft states that an archive mailbox can only hold mail for a single user or entity, that using archive mailboxes to store mail from multiple users is prohibited, and that it can refuse extra archive storage when a user's archive holds other users' data.
- Unlicensed user mailboxes. When a user mailbox's license is removed, Exchange Online keeps the data for only 30 days. Convert a user mailbox to a shared mailbox before you remove its license, or start with shared mailboxes as above.
- Signing in to a shared mailbox. Its account only anchors the mailbox. Keep sign-in blocked and grant access through permissions.
- Long access lists. If more than 25 people need a leaver's mail, choose a different design.
Verify#
# Quota and address-book visibility
Get-EXOMailbox -RecipientTypeDetails SharedMailbox -ResultSize Unlimited -Properties HiddenFromAddressListsEnabled, ProhibitSendReceiveQuota |
Format-Table DisplayName, PrimarySmtpAddress, HiddenFromAddressListsEnabled, ProhibitSendReceiveQuota
# Who has access
Get-MailboxPermission -Identity jane.doe@contoso.com | Where-Object { $_.User -notlike "NT AUTHORITY*" } |
Format-Table User, AccessRights
# Sign-in blocked: good is False
Get-MgUser -UserId (Get-Mailbox jane.doe@contoso.com).ExternalDirectoryObjectId -Property AccountEnabled |
Format-List AccountEnabledThen compare item counts with FortiMail for a sample of leavers, and ask a member of the records team to open two or three of the mailboxes in Outlook on the web and run a search in each.
References#
- About shared mailboxes in Microsoft 365 (Microsoft Learn)
- Learn about inactive mailboxes (Microsoft Learn)
- Exchange Online limits (Microsoft Learn)
