Email journaling is necessary for compliance and eDiscovery, but there’s gap in Microsoft 365 journaling capabilities.
Microsoft 365 includes software and tools for modern workplace productivity, security, and information governance. Organizations on E5 licenses gain access to advanced compliance tools, including Microsoft Purview Suite (Premium), granular retention policies, and comprehensive legal holds. The one thing the Microsoft ecosystem is missing is true native email journaling capabilities.
What Microsoft refers to as journaling for Exchange online is a version of email archiving. Rules and policies can exist, but journal messages cannot be sent to a separate Exchange mailbox. Organizations need either a third-party archiving tool, Exchange on-premises, or a separate server in order to have full and complete journaling. Both options can be costly.
Key Takeaways
- The M365 E5 Journaling Dilemma: Exchange Online allows you to configure journal rules, but it cannot serve as the destination for journal reports, requiring an external target.
- Cost Structure Advantage: Replacing costly platforms (like Mimecast, Proofpoint, or Enterprise Vault) with volume-based archiving eliminates redundant licensing costs.
- EDRM Optimization: Cloudlocker manages the left side of the EDRM (capture, preservation, and collection), allowing Purview eDiscovery (Premium) to handle downstream review and processing.
The Microsoft 365 Journaling Gap Explained
Enterprise retention strategies often dictate that an unaltered, immutably logged copy of every inbound, outbound, and internal message be captured at the moment of transmission.
Microsoft Purview provides robust in-place retention and holds directly within production mailboxes. However, in-place retention operates inside the same tenant boundary as production data. For regulatory compliance, audit readiness, or strict air-gap requirements, legal and risk teams frequently require an independent copy of journaled communications kept entirely outside the production environment.
Because Microsoft does not allow an Exchange Online mailbox to act as a journal receiver, IT teams traditionally resort to one of two inefficient workarounds:
- Maintaining Hybrid On-Premises Infrastructure: Running legacy Exchange servers solely to receive and store SMTP journal reports, incurring ongoing patching, maintenance, and hardware overhead.
- Paying Double for Third-Party Gateways: Purchasing per-user licenses for platforms like Mimecast, Proofpoint, or Enterprise Vault, often using them strictly for email archiving. Features such as email encryption, threat protection, anti-spam/malware/phishing, loss prevention, and retention policies are included with an E5 subscription. You’re paying high costs for services and features you already have via E5, when all you need is true email journaling.
Cloudlocker + Purview eDiscovery: Bridging the EDRM Workflow
A common objection to dedicated journaling solutions is that Microsoft 365 E5 already includes Purview eDiscovery (Premium). Cloudlocker is not designed to replace Purview; it is engineered to complement it. Cloudlocker easily integrates with Purview to split responsibilities across the Electronic Discovery Reference Model (EDRM). IT leaders can maximize their existing software investments while maintaining air-gapped compliance.
EDRM Stage | Responsible System | Function & Value |
Information Governance | Cloudlocker | Captures every message outside the tenant; maintains immutable audit logs. |
Identification & Preservation | Cloudlocker | Applies independent legal holds and secures raw message data. |
Collection | Cloudlocker | Consolidates legacy archives and real-time journals into a single searchable store. |
Processing, Review, & Analysis | Purview eDiscovery (Premium) | Ingests Cloudlocker feeds directly into the native E5 review interface. |
Production | Purview / Cloudlocker | Export natively via Purview, or output PST/EML formats to RelativityOne. |
Cloudlocker acts as the capture and preservation engine on the left side of the EDRM. It feeds directly into Microsoft Purview eDiscovery (Premium), ensuring your legal team continues working within the native M365 tools they already know.
Architectural Flexibility & Control
Enterprise environments demand deployment models aligned with their specific regulatory and data sovereignty constraints. Cloudlocker supports flexible deployment architectures:
- Classic SaaS (Hosted): Fully managed, multi-tenant or dedicated SaaS hosted on Microsoft Azure. Delivers automatic updates, effortless scaling, and zero infrastructure overhead.
- Managed PaaS (Self-Hosted in Azure or AWS): Deploys inside your organization’s cloud tenant. Cloudlocker manages the application, while data storage remains inside your security perimeter.
- S3 Local Storage (Hybrid): Connects to your existing S3-compatible storage infrastructure, keeping physical data control under your roof without sacrificing cloud discovery features.
Microsoft 365 E5 delivers world-class threat protection and review capabilities, but it relies on external destinations for full-fidelity message journaling. Cloudlocker completes the E5 compliance stack by providing an independent, volume-priced target for journal reports that integrates seamlessly back into Microsoft Purview.