Inactive & Soft-deleted Mailboxes

The question it answers: Which mailboxes of deleted users are still kept (inactive, on hold) and which soft-deleted ones are about to be purged?

When a user is deleted, their mailbox either becomes inactive (kept by a hold, for years, and still searchable in eDiscovery) or soft-deleted (recoverable for 30 days, then gone). This shows what the organisation still holds - and which mailboxes are about to disappear for good.

At a glance

Where in the app	Exchange Online › Mail Security Posture › Inactive & Soft-deleted Mailboxes
Workload	Exchange Online
Kind	Table · dashboard tile
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	Exchange Online; inactive mailboxes need a hold (Exchange Online Plan 2 or the Exchange Online Archiving add-on).
Report id (API and MCP)	exchange.posture.retained-mailboxes

Columns

Column	Key	Type
Mailbox	Name	Text
Address	Address	Text
State	State	Status
Deleted	WhenSoftDeleted	Date
Purged after	PurgedAfter	Date
Kept by	HoldReason	Text
Type	MailboxType	Text

What it needs

Licence: Exchange Online; inactive mailboxes need a hold (Exchange Online Plan 2 or the Exchange Online Archiving add-on).

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Exchange.ManageAsApp	Office 365 Exchange Online	Manage Exchange As Application

Data sources it reads

• Get-Mailbox -InactiveMailboxOnly
• Get-Mailbox -SoftDeletedMailbox

Through the API and MCP

GET /ir-api/v1/reports/exchange.posture.retained-mailboxes?size=100

An AI assistant reads it with the MCP tool get_report and the id exchange.posture.retained-mailboxes. The client needs the Read grant for Exchange Online. See Using the API.