Microsoft365 - notification emails that old events on shared calendar are being deleted

[HCHTech]

Another day, another M365 question that I can't bill for. So this customer has some sort of shared company calendar in addition to the individual user calendars. I say "some sort of" because it is NOT a public folder. If I log into OWA as any of the 3 accounts, I can see this calendar listed under "Peoples calendars". I'm guessing the main guy just created this additional calendar and gave permissions to the other two employees. I don't know how to view this at all from an admin login to M365.

In any event, they are getting spammed with dozens of notification emails every as old events from this calendar are being deleted. All of the calendar events that are being deleted are about 2 years old. Since no one there is deleting the events, it must be a result of a retention policy somewhere, but I'll be damned if I can find it. Looking through the Purview admin center, there are NO retention policies created at all, so maybe this is a new MS default policy?

The headers of these notification emails look legitimate to me. Here is a paste of one of the emails they forwarded to me - the original notification was received on :


Since there are no existing policies created, I somehow doubt that creating a new one will change what's happening. Has anyone see this behavior before?

 

[HCHTech]

Anyone?

 

[Sky-Knight]

I'm not sure why you think that this is 1.) an M365 problem, and 2.) You cannot bill for it.

Once again you have a client that's performing a broken process. Your first challenge as you've already noted is figuring out where this calendar actually lives. After that you can go about figuring out what's happening to it. Stuff doesn't get deleted for no reason, and you likely have someone deleting these things intentionally and not understanding the consequences.

Regardless you need to confirm this thing is a personal calendar in someone's mailbox and get them to knock that crap off, move that junk to a calendar associated with a Team so it doesn't just up an vanish when this magic person leaves the company someday. Yes, this includes the blasted owner of the company.

Automating a broken process gets us the wrong answer faster... both of the posts you bumped are screaming this at me.

*Edit 1*
Something that MIGHT be involved...

If you have Exchange Online Archive disabled on the mailbox that has the calendar, the default MRM policy isn't supposed to apply. You can find the details of this policy in your Purview Admin panel. Https://admin.microsoft.com -> Admin Centers -> Compliance. Then you're looking for Solutions -> Data Lifecycle Management -> Exchange (legacy). MRM Retention Policies should have the "Default MRM Policy" and you'll see a default 2 year move to archive in the list.

IF for some reason that move to archive is firing, but there isn't an archive mailbox to move it to... that's a delete. I have as a standard practice to go into the Exchange admin panel and enable the archive on every mailbox when I create the user. Exchange Online Plan 1 subscribers (all Business subs) get 50gb mailboxes, and 50gb archives... but the latter isn't enabled by default. Exchange Online Plan 2 subscribers get 100gb mailboxes, and 101gb archives, but also support auto expanding archive which can grow that 101gb to 1.5tb.

So my first itch is to check those archive settings and see if those archives are enabled, if they are... flip them on. It might fix this. But I have no idea WHY this policy is doing this without that archive turned on, it's not supposed to apply to mailboxes with a disabled archive. But the 2 year timer makes me think this is involved.

*Edit 2*
Check your audit log! If something was deleted in the last couple weeks it will tell you who, and what did it.

 

[nlinecomputers]

Each user needs to

Automatically dismiss reminders for past events

1. Select File > Options > Advanced.
2. In the Reminders section, select Automatically dismiss reminders for past events.

 

[HCHTech]

I'm not sure why you think that this is 1.) an M365 problem, and 2.) You cannot bill for it.

Once again you have a client that's performing a broken process.

Emphasis mine. You are absolutely CORRECT! My biggest challenge with M365 is taking over a tenant that I didn't setup (IOW, identifying those broken processes so they can be corrected). I never have these kinds of problems with tenants that I create. Yes, when I have a takeover, I go through the tenant, usually starting by applying security defaults, then I have a list of standards that I apply, but it is inevitable that crap like this rears it's head at some point down the line. It's not a problem initially, so there are no symptoms that point to a problem in the setup. And every one I run into is different - it's not like there is a pattern. In this case somebody obviously changed something (even Microsoft may have changed a default, god knows every time you log in to a tenant there is a new set of reminder boxes saying things have been renamed or moved around), but finding that change is a frustrating process. Sure there are audit logs, but exactly WHEN did the change happen? Who knows. Last week, two weeks ago? They don't remember, they just know it's just not working now.

As to the billing - Especially with this kind of ever-changing platform and rules, I feel hesitant to bill for stuff that either I should have already known, or at least it looks to the client like I should have already known.

I am not now, nor do I wish to be an M365 specialist. I am a jack of all trades like many, many other small IT firms. I educate myself to the best of my abilities with the time I have available, while somehow still finding time to run a business. I'm not afraid to ask dumb questions because I know there are probably folks in the same boat who are afraid to ask them.

 

[britechguy]

Yes, when I have a takeover, I go through the tenant, usually starting by applying security defaults, then I have a list of standards that I apply

Would someone mind starting a topic about just this: What I do when I take over an M365 Tenant OR What I do to initially configure an M365 Tenant

Although I expect that practices will be relatively consistent, it's also clear that certain members want things locked down a lot more tightly than others. There will be differing reasons for enabling/not enabling various settings that can be equally valid depending on the operating environment.

Having the "cheat sheets" of different members, perhaps with brief rationales for specific setting choices, would really be helpful for many of us, and that includes those who are already doing this kind of setup routinely. The number of settings is myriad and there's no one who likely knows each and every one of them, and there will certainly be things to be learned no matter how much you know.

 

[nlinecomputers]

As to the billing - Especially with this kind of ever-changing platform and rules, I feel hesitant to bill for stuff that either I should have already known, or at least it looks to the client like I should have already known.

Nonsense. Maybe you can’t bill the entire time it takes to figure it out, but if you had known what the issue was you’d bill an hour, so bill an hour.

 

[britechguy]

Nonsense. Maybe you can’t bill the entire time it takes to figure it out, but if you had known what the issue was you’d bill an hour, so bill an hour.

That's how I work when I encounter something I feel I should have known, but didn't. There is no way that any one of us can possibly know everything about anything we might happen to encounter. While I don't feel it's OK to bill for extended learning time, I do feel it's fine to bill for approximately how long it would have taken had I known it all going in. With a one hour minimum for on-site service calls, that would be one hour.

I can also say that customers are routinely pleased when I bill them far less than the time actually taken because "I should have known this."

 

[Sky-Knight]

I am not now, nor do I wish to be an M365 specialist. I am a jack of all trades like many, many other small IT firms. I educate myself to the best of my abilities with the time I have available, while somehow still finding time to run a business. I'm not afraid to ask dumb questions because I know there are probably folks in the same boat who are afraid to ask them.

I'm in the same boat, but I have to push back on this a little...

You will become an M365 specialist. Because that isn't a specialty, it's Swiss Army Knife of tools to keep the business going, and where all the general IT work has gone.

You will decide if you wish to support GSuite too, or turn those customers away because of the nightmare the above accounts for.

As for the rest, that's why I always bill hourly for services. IF I take over a tenant, my initial push is an authentication rework to ensure only validated identities are authorized to get into things. Everything after that is break / fix billed in accordance with that model. There is no MSP all you can eat plan for anything that's not specifically defined.

I can MSP plan:
M365 password resets and authenticator enrollment support.
Mailbox / Archive creation.
Mail flow rule modifications and basic email troubleshooting.

I cannot MSP Plan, and therefore these are all T&M projects:
SharePoint automation and work flow adaptation along with user training.
Endpoint redeployment to eliminate AD dependence and shift the organization to Entra ID native.
Troubleshoot literally anything to do with m365 Calendaring.

I'm a master of what Microsoft calls Infrastructure, Security, and Modern Work. What does that make me? A GENERALIST. What does that also make me? A "Microsoft Specialist", but do I actually specialize in anything? No... I do not. Because that is a bloody huge well to draw from, and why I've decided to tell Google to take a hike, no more brain space. And also why I don't have any MS certifications attached to tests with a number > 300. Though I am looking hard at AZ-500 and AZ-700 as notable exceptions, will probably eventually get my AZ-305.

Track your time, and bill it. Customer needs to understand this is hard work, and difficult to scope. All you have to do is warn them up front, that sometimes things go down the rabbit hole! I understand your feelings, but you need to eat!

Anyone that wants to work in the M365 ecosystem is well advised to go over the materials for MS-900 and AZ-900. Even if you never take the tests, you need to know the material to work with anything that has Microsoft's name on it.