What does an Exchange Online email scanning tool do?
The Exchange area of Compliance Agent searches Exchange Online mailboxes for the keywords and patterns your organisation defines and reports the matches. Your organisation defines the rules; whether a keyword or pattern is appropriate is your assessment. The product is not designed to examine a specific employee; it helps you verify adherence to your organisation’s policies. The organisation decides.
What is scanned in Exchange Online?
- Subject and message body are scanned.
- Attachments are not scanned.
- Online archive mailboxes are not scanned.
You narrow the scope yourself: the user group selection decides which users are in scope, and the date range decides which period is scanned.
How are scan rules defined?
There are four components:
- Keywords: you enter the words from your policy or import them as CSV.
- Patterns: patterns can be defined where needed; no regex skills required. Those switched on are included in the scan.
- User group selection: you choose who is in scope.
- Try before scanning: you try the rules on sample text (Test rules). The sample text is not stored anywhere.
Ready-made rule packs are optional; they are switched on separately and tried on sample text.
Why should the first scan be a Safe Scan?
A Safe Scan only scans and reports; it touches nothing. Action modes stay off until an administrator turns them on, so on a new installation only Safe Scan is possible. You first see what the rules find, adjust them if needed, and only then decide whether to turn the action modes on.
Employee permission and access to results
No scan can run without the employee’s permission; only the data of employees who gave permission is in scope. Each employee gives permission through a personal link your organisation sends, carrying your logo and your text. The permission does not replace your duty to inform employees and is not a legal ground.
Results are hidden by default: the rule that matched is shown, and the value found is not recorded. To view the full content, Reveal asks for a duration, a reason and a request number; every view is written to the audit log. Limit access to the results to the fewest people necessary.
Can an action taken in Exchange be reversed?
No. An action taken in Exchange cannot be reversed; the product has no feature that reverses it. No copy is made of Exchange emails either. That is why action is controlled:
- Selective Action: a person reviews the findings; the action is applied only to the items they tick.
- Direct Action: scan and action happen in one run; it stops at the hard action limit.
- Hard action limit: you set the number of items processed in one run. A run that would exceed it stops; there is no button to override it, and raising the limit is an administrator task that is written to the audit log.
- If the audit log cannot be written, the action is refused.
Frequently asked: can the scan be scheduled?
A scheduled scan can be defined for Exchange; the schedule should match the periods you announced in your notice to employees, and the scope should still be narrowed by user group, date range and rule selection.
To see Exchange scanning live, book a demo. Related pages: How it works, Security and data, On-premises Exchange Server scanning.