What changed in every release

The system knows whether a mailbox is on hold, and tells you before you approve

A mailbox’s hold state is not exposed in Microsoft Graph: there is no property there that says whether a mailbox is on hold, and Microsoft itself points to Exchange Online management to find out. (The eDiscovery paths in Graph let you see which mailboxes are included in a case, but not ask about a single mailbox, and not see litigation hold, delay hold or an organizational retention policy.) So the product opens its own management connection to Exchange Online, authenticates with your installation’s certificate, and reads the hold state from there.

• The compliance officer sees before the click whether the deletion about to be approved is reversible or not.
• What was read is written to the audit log: the source of the check, the answer, and the reasons returned. If no answer could be obtained, that too is recorded as such, and the deletion moves to the reversible path.
• Nothing is installed on your side. Everything runs inside the product’s containers, against Exchange Online only.
• You do not have to allow this, and you may decide not to. There is a switch in the settings screen that says “do not open a management connection on my tenant”, and you can also simply not grant the application the permission in Exchange. In both cases no connection is opened.
• And this is what happens when it is not allowed, with no fine print: every mailbox’s hold state is recorded as “cannot be determined”, and every mail deletion automatically moves to the reversible path: the message goes to the recoverable items folder, and the mailbox owner can restore it. The compliance officer sees this on screen before approving, and the log records that this is what happened and why. In other words, the question you are deciding is certainty of deletion versus a management connection to your tenant, and the product hides the price of neither side.
• The screen says what is blocking. If the permission is missing or too narrow, the settings screen names the reason (for example that the role is narrower than View-Only Organization Management) instead of leaving you to guess.

A file that cannot be read does not come out clean

These are all the cases where the product checked and found nothing, against the cases where it could not check.

• A scanned document with no real text layer reaches the officer flagged, with the scan quality numbers: how many words were recognized, how many pages were processed, and what share of the text was recognized with low confidence.
• The number of pages that could not be read reaches the screen.
• 7z and rar archives are opened and the files inside them scanned, in the scheduled scan too.
• An archive that cannot be opened is declared as such instead of being counted clean, and a file inside the archive that is too large is flagged as a partial scan.

The audit log records more, and you can ask it whether the deletion actually happened

• A policy change and starting, stopping or deleting a scan each leave a line.
• A verification window says what was checked and what was not checked, not just “OK”.
• A deletion that was approved and never confirmed as carried out appears in the dashboard instead of disappearing.

A nightly scan that touches several policies says so

When two or more policies apply to the same files, their detection criteria are merged, but the scope is never merged. A policy with a different scope does not run silently: its name is recorded in a warning saved with the scan.