Microsoft is enabling threshold-based auto-archiving by default in Exchange Online to prevent email flow issues caused by mailboxes filling up faster than expected.

While users can also configure messaging records management (MRM) time-based archive policies that provide automatic archival every two years, for example, these policies aren’t effective when dealing with high volumes of incoming emails with large attachments.

This can lead to mailboxes reaching full capacity before time-based archiving kicks in, resulting in issues such as the inability to send or receive emails.

However, when auto-archiving is enabled, the oldest items in the users’ primary mailboxes are moved to the users’ archive mailbox when utilization approaches 90% of the quota, provided the archive mailbox is provisioned and has available space remaining.

As the company explained on Tuesday, the Managed Folder Assistant will continuously monitor the mailbox’s size and automatically archive the oldest items first, until usage drops below the threshold.

“Responding to requests of customers who emphasized the need for proactive and automated space management that complements existing retention settings, we are rolling out an update designed to prevent mail flow disruption due to misconfigured archiving policies or situations where mailboxes might fill up faster than expected,” the Exchange Team said.

“This threshold-based archiving approach ensures that mailbox usage is brought back below the 90% threshold before users experience functional loss such as inability to send or receive emails ensuring real-time mailbox health monitoring across organizations.”

Auto-archiving for Exchange Online is rolling out this month for all public clouds and is also scheduled to roll out for all government clouds in November.

While it will be enabled by default after rollout, users can prevent important items from being archived by tagging them using the “Never Move to Archive’ flag, which will still be honored when auto-archiving kicks in.

In June, Microsoft also upgraded its Defender for Office 365 cloud-based email security suite to automatically detect and block email bombing attacks. 

Various threat groups, including ransomware gangs and financially motivated cybercriminals, have employed this tactic to fill victims’ mailboxes with emails within minutes, posing as their IT support teams in voice phishing cold calls to trick overwhelmed employees into granting remote access to their devices.