What is on-premises Exchange Server scanning?
Compliance Agent has four scan areas: Exchange, OneDrive, Microsoft Teams and DiskScanner. The Exchange area covers both Exchange Online and on-premises Exchange Server. So even where part of your email never moved to the cloud, it can be scanned from the same product with the same rules. It scans and reports; the organisation decides.
What is scanned in on-premises Exchange Server?
In the Exchange area, the subject and message body are scanned. Attachments and online archive mailboxes are not scanned.
What do you need for on-premises Exchange Server scanning?
On-premises Exchange Server and DiskScanner need access to on-premises systems. Otherwise the general requirements are the same as for the other areas:
- an Azure subscription to deploy into;
- a Global Administrator for the one-time setup step;
- the permission of each employee to be scanned.
The product deploys from Azure Marketplace into your own subscription in about 10 minutes and runs in your own Azure subscription. You do not need E5, an extra Microsoft licence tier or a paid Microsoft API.
Are the rules the same as for Exchange Online?
The same structure applies in every area: permitted users, keywords, rule packs and settings in one place.
- Keywords: you enter them from your policy or import them as CSV.
- Patterns: defined where needed; no regex skills required.
- User group selection and date range: the main tools for narrowing the scope.
- Try before scanning: you try the rules on sample text (Test rules); the sample text is not stored anywhere.
Safe Scan first, action is controlled
A Safe Scan only scans and reports; it touches nothing. Action modes stay off until an administrator turns them on, so on a new installation only Safe Scan is possible. If you do take action, Selective Action applies only to the items you ticked and Direct Action stops at the hard action limit. An action taken in Exchange cannot be reversed, which is why modes, the hard action limit, roles and the audit log protect it.
Employee permission and results
No scan can run without the employee’s permission; this applies to every area, Exchange included. The permission does not replace your duty to inform employees and is not a legal ground. The results show the rule that matched; to view the full content, Reveal asks for a duration, a reason and a request number, and every view is written to the audit log.
Scans are runs you start, in the periods set in your organisation’s policy and announced in advance in your notice to employees. Keep the scope narrow with user group, date range and rule selection.
Frequently asked: are Exchange Online and Exchange Server in the same product?
Yes. In Compliance Agent, Exchange is a single scan area that covers Exchange Online and on-premises Exchange Server together. For seats and plans see the Pricing page.
To talk through your environment, book a demo. Related pages: Exchange Online scanning, How it works, Pricing.