Email journaling explained

How journaling works

Journaling is configured on the mail system, not on users' devices. Microsoft's documentation for Exchange Online describes the process in terms that apply broadly:

1. A message is sent or received and passes through the mail system.
2. A journal rule checks whether the message is in scope: internal messages, external messages or all messages, optionally limited to particular recipients or groups.
3. If it matches, the system generates a journal report. In Microsoft 365 the original message is attached unaltered, and the body of the report records details such as the sender, subject, message ID and recipients.
4. The journal report is delivered to a journaling mailbox, which for a third-party archive is the archive's own journal address.
5. The archive receives the report, indexes the message and its attachments, and stores it in immutable storage under the retention policy that applies.

All of this happens as mail is delivered. If a user deletes the message from their mailbox a minute later, the archive's copy is unaffected.

Why envelope data matters

A journal report is more than a copy of the message. Microsoft calls its method envelope journaling, because the report records envelope information: who the message was actually sent to and from, as the mail system saw it.

That matters because the visible To and Cc lines do not tell the whole story. Messages go to distribution lists that expand to many people, and some recipients are not shown on the message at all. Envelope data lets an archive answer "who received this?" accurately, which is often the key question in a dispute or a subject access request. Microsoft states that envelope journaling is the only journaling method supported by Microsoft 365 and Office 365.

Journaling vs archiving

The terms are often used interchangeably, but they describe different steps.

In short, journaling is the pipe and the archive is the vault. An archive without journaling relies on importing or snapshotting mailboxes, which can miss mail; journaling without an archive has nowhere to keep what it captures. See what is email archiving? for the wider picture.

Journaling vs backup

A backup takes scheduled snapshots of mailboxes. Anything a user receives and deletes between two snapshots may not be backed up at all. Journaling has no such gap, because it copies each message as it is delivered.

The trade-off is scope. Journaling captures messages in transit; it does not capture calendar items, contacts, OneDrive files or SharePoint sites, and it does not let you roll a mailbox back to how it looked last Tuesday. That is why NinjaOne's Archiver bundles keep the scheduled backup alongside journaling. The full comparison is on email archiving vs backup.

Journaling in Microsoft 365 and Google Workspace

Microsoft 365 (Exchange Online). Journal rules can cover internal messages only, external messages only, or all messages, and can target a specific recipient such as a mailbox or distribution group. Microsoft states that you cannot designate an Exchange Online mailbox as a journaling mailbox: reports go to an on-premises archiving system or a third-party archiving service. If the journaling mailbox is unavailable, Exchange Online retries delivery for up to 24 hours and then sends a non-delivery report to an alternate journaling mailbox, which also cannot be an Exchange Online mailbox. Microsoft also describes journaling as an older feature and recommends Microsoft 365 retention to manage data in place where possible; organisations that want a copy held outside the tenant use journaling to a third-party archive. Detail is on Exchange Online journaling.

Google Workspace. Gmail does not have a journal rule as such. The equivalent is a routing rule in the Google Admin console that also delivers a copy of each message to the archive's journal address. Selective archiving can be done with a Google group and separate rules for sent and received mail. Detail is on Google Workspace journaling.

How NinjaOne Archiver uses journaling

NinjaOne Archiver is built on journaling. For Microsoft 365, NinjaOne's documentation describes the following:

• Automatic set-up: after the tenant is authenticated, Archiver connects over remote PowerShell and creates the journal rule and a distribution group.
• Envelope journaling: Archiver uses Microsoft's envelope journaling method; mailboxes added to the archive become members of the distribution group, so their inbound and outbound mail is copied.
• Dedicated journal mailbox: each Archiver organisation gets its own external journal mailbox, hosted on mail servers NinjaOne manages.
• Existing mail first: when a mailbox is added, its existing email is backed up, then journaling captures new messages from that point.

For Google Workspace, journaling is set up manually with Gmail routing rules in the Google Admin console, following NinjaOne's guide. We can help you set them up and test them.

NinjaOne is candid that it "cannot guarantee a 100% success rate" for journaling. Journal errors usually come from expired or changed credentials or missing permissions; NinjaOne notifies the partner when a tenant needs to reauthenticate, and until it is fixed the service may rely on periodic snapshots. That is why we check journaling is flowing at set-up and can show your administrators what a reauthentication request looks like. The steps are on how NinjaOne Archiver is set up.

Common journaling problems

Journaling is reliable once working, but a few things trip people up. Microsoft's documentation and NinjaOne's own FAQ point to these:

• Credentials and permissions: an expired or changed credential, or a missing permission, stops the connection that manages journaling. Reauthenticating usually fixes it.
• Deleted or edited rules: someone tidying mail flow settings may remove the journal rule or distribution group without realising what it does. Label them clearly and include them in change control.
• Mailboxes not in scope: a new starter or shared mailbox that is not added to the archive is not journaled. NinjaOne's auto-discovery and coverage reports help you spot new accounts, but build a check into your starter process.
• Quarantined messages: Microsoft notes that a message sent to quarantine by a mail flow rule is not journaled until it is released.
• Duplicates in hybrid set-ups: Microsoft documents scenarios in hybrid Exchange environments where duplicate journal reports are expected by design.
• Undeliverable reports: if the journaling mailbox is unavailable, Exchange Online retries for up to 24 hours before sending a non-delivery report to the alternate journaling mailbox, which someone needs to watch.

Protecting journaled mail

A journal stream contains everything, including HR, legal and personal data. Microsoft advises that journaling mailboxes contain sensitive information and that access should be limited to people with a direct need. Treat the archive the same way.

In NinjaOne Archiver, data is encrypted with AES-256 at rest and TLS 1.2 in transit, access is protected with MFA and role-based permissions, and the IT Admin role has no access to compliance features. Decide who holds the Compliance and Review Officer, Data Protection Officer and Reviewer roles before go-live, and record it in your email retention policy. For the data protection angle, see email retention and UK GDPR.

To talk through journaling for your tenant, contact us.