Exchange Online Mailbox Full Runbook: Split Quotas, Retention Holds, and MRM vs. Purview Architecture

When a user reports that their Exchange Online mailbox is full and they can no longer send or receive email, the instinct on many service desks is to check whether the In-Place / Online Archive is enabled or try raising the mailbox quota in PowerShell. On an Exchange Online Plan 2 (Microsoft 365 E3/E5) mailbox, both instincts usually hit a wall: the primary mailbox is already at its hard 99 GB / 100 GB license ceiling, and the Online Archive is already enabled—yet sitting nearly empty while the primary mailbox is choked with years of aged mail.

Recently, while investigating an escalation where a user reported they could neither send nor receive email (which they had tested by sending a message to themselves from the exact same mailbox), three architectural traps stood out that routinely trip up administrators:

1. Asymmetric Send vs. Send-and-Receive Quotas: Exchange Online enforces distinct storage ceilings for outbound sending (ProhibitSendQuota at 99 GB) versus inbound delivery (ProhibitSendReceiveQuota at 100 GB), plus an independent 30 GB ceiling for RecoverableItemsQuota.
2. Dual Retention Engines (Exchange MRM vs. Microsoft Purview): While Microsoft is migrating data lifecycle governance to Microsoft Purview, legacy Exchange Messaging Records Management (MRM) policies remain actively in effect and are still the mechanism responsible for moving items to the Online Archive (MoveToArchive).
3. Retention Hold Freezes Archiving (RetentionHoldEnabled): If a mailbox has RetentionHoldEnabled (or ElcProcessingDisabled) set to $true, Exchange MRM policies do not execute at all—meaning nothing moves to the In-Place Archive until the hold is removed.

flowchart TD
    Mail["Aged Mailbox Items (Primary Mailbox ~99 GB)"] --> MFA{"Managed Folder Assistant (ELC / MRM Cycle)"}
    
    MFA -- "RetentionHoldEnabled = True OR ElcProcessingDisabled = True" --> Frozen["MRM Halted: MoveToArchive Tags Ignored"]
    Frozen --> QuotaHit["Primary Mailbox Hits 99 GB (ProhibitSend) / 100 GB (ProhibitSendReceive)"]
    
    MFA -- "RetentionHoldEnabled = False & ELC Active" --> Eval["Evaluate Exchange MRM + Purview Policies"]
    Eval --> ArchiveTag["MRM 'MoveToArchive' Tag Moves Aged Items to Online Archive"]
    Eval --> PurviewRule["Purview Compliance Policies Enforce Retain / Delete Rules"]

[!IMPORTANT] Executive Summary (BLUF):

• Problem: Users with Exchange Online Plan 2 mailboxes and active Online Archives still hit storage lockouts (5.2.2 NDRs or outbound send blocks) when stale holds (RetentionHoldEnabled), disabled ELC processing, or misconfigured MRM/Purview policies silently prevent automated archiving. Worse, attempting to remediate a full mailbox by bulk-emptying the Deleted Items folder frequently overflows the 30 GB Recoverable Items quota, locking the user out of deleting anything at all.
• Architecture / Solution: This guide explains the three-tier quota model, clarifies how Exchange MRM and Microsoft Purview retention policies interact, and provides a 6-step read-only PowerShell diagnostic sequence followed by a safe same-day unblock and root-cause remediation runbook.

---

1. Architectural Foundations: Why “Mailbox Full” Happens

Before running remediation commands against a production tenant, engineers need a clear mental model of three underlying Exchange Online subsystems.

1.1 The Split Quota Architecture (ProhibitSend vs. ProhibitSendReceive)

Exchange Online does not enforce a single “full” threshold. Instead, a primary mailbox on Exchange Online Plan 2 (E3, E5, or Exchange Online Plan 2 standalone) passes through three stepped gates alongside a separate dumpster quota:

Quota Parameter	Plan 2 Default	Operational Impact
IssueWarningQuota	98 GB	User receives warning notifications in Outlook and OWA. Outbound and inbound mail flow continue normally.
ProhibitSendQuota	99 GB	Outbound sending is blocked. The user cannot send new messages or replies, but can still receive inbound email until the mailbox grows another 1 GB.
ProhibitSendReceiveQuota	100 GB	Both sending and receiving are blocked. Inbound messages bounce back to senders with SMTP status code 5.2.2 (Mailbox full).
RecoverableItemsQuota	30 GB (100 GB on hold)	Tracks the hidden Recoverable Items substrate (Deletions, Versions, Purges, Audits). When full, users cannot delete items or empty Deleted Items.

This split explains two common support mysteries:

• “I can’t send OR receive!” (The Self-Test Illusion): When a mailbox crosses 99 GB (ProhibitSendQuota) but is still below 100 GB (ProhibitSendReceiveQuota), the user is blocked from sending outbound mail. When the user tests whether they can receive mail by sending a test email from their own mailbox to themselves, the outbound send fails immediately—leading them to report that both sending and receiving are broken even while external inbound emails are still arriving.
• Asymmetric Mail Flow: Depending on where TotalItemSize sits relative to the send and send-and-receive thresholds (or when custom per-mailbox quotas are configured), a user can experience partial mail flow disruption long before hard NDR bounces begin.

1.2 Two Retention Engines: Exchange MRM vs. Microsoft Purview

One of the most confusing aspects of modern Microsoft 365 administration is that two separate retention architectures exist side by side:

graph LR
    subgraph Engine1 ["1. Exchange Online MRM (Legacy / Active)"]
        MRMPolicy["Retention Policy (Get-RetentionPolicy)"]
        MRMTags["Retention Tags: DPT, RPT, Personal (Get-RetentionPolicyTag)"]
        MRMAction["Actions: MoveToArchive, DeleteAndAllowRecovery, PermanentlyDelete"]
        MRMPolicy --> MRMTags --> MRMAction
    end

    subgraph Engine2 ["2. Microsoft Purview Data Lifecycle (Modern)"]
        PurviewPolicy["Compliance Policy (Get-RetentionCompliancePolicy)"]
        PurviewRule["Compliance Rule (Get-RetentionComplianceRule)"]
        PurviewAction["Actions: Retain, Delete, KeepAndDelete"]
        PurviewPolicy --> PurviewRule --> PurviewAction
    end

    Engine1 --> MFA["Managed Folder Assistant (ELC)"]
    Engine2 --> MFA

1. Exchange MRM (Messaging Records Management): Configured in the Exchange Admin Center or via Get-RetentionPolicy and Get-RetentionPolicyTag in Exchange Online PowerShell. Microsoft is gradually moving retention management from Exchange to Purview, but that migration is not complete. Exchange MRM policies remain fully active and—critically—Exchange MRM is still the engine that drives MoveToArchive (In-Place / Online Archiving).
2. Microsoft Purview Retention Policies: Configured in the Microsoft Purview portal or via Get-RetentionCompliancePolicy and Get-RetentionComplianceRule in Security & Compliance PowerShell (Connect-IPPSSession). Purview policies layer on top of Exchange MRM to enforce organization-wide compliance retention and deletion (Retain, Delete, KeepAndDelete). When conflict occurs, retention always wins over deletion, and explicit inclusion wins over implicit inclusion.

[!WARNING] Never Trust a Retention Tag’s Display Name: In inherited or long-lived tenants, administrators frequently modify an MRM tag’s RetentionAction or AgeLimitForRetention without renaming the tag itself (leading to situations where a tag named "1 Year Delete" actually has RetentionEnabled: False or RetentionAction: MoveToArchive). Always inspect the underlying properties in PowerShell.

1.3 Why RetentionHoldEnabled Stops Online Archiving Cold

It is easy to confuse Litigation Hold (LitigationHoldEnabled) or Purview eDiscovery / Retention Holds (InPlaceHolds) with Exchange Retention Hold (RetentionHoldEnabled):

• Litigation Hold / Purview Hold: Preserves deleted and modified items inside the Recoverable Items folder so they cannot be permanently purged. Online Archiving (MoveToArchive) continues to work normally because moving an item from the primary mailbox to the Online Archive does not delete it from compliance discovery.
• Retention Hold (RetentionHoldEnabled: $true) or ElcProcessingDisabled: $true: Designed to suspend the Managed Folder Assistant (ELC) from processing MRM policies on a mailbox (historically used when a user was on extended leave or vacation). When RetentionHoldEnabled is $true, Exchange MRM policies do not kick in at all—including MoveToArchive tags. Nothing moves to the In-Place Archive, and the primary mailbox steadily fills until it hits 99 GB.

---

2. Prerequisites & Governance Boundaries

Use this runbook whenever a user reports “mailbox full” alerts or cannot send or receive email in Exchange Online. The operational goal is two-fold: restore mail flow the same day, then identify and remediate why automated archiving or retention failed.

• Owner: Service Desk (L1/L2) for diagnosis and same-day unblock; L3 and client approval required for policy modifications, hold removal, or irreversible changes.
• Data Handling: In all tickets, runbook logs, and screenshots, sanitize client names, domains, and user addresses with placeholders such as <UPN> and <Client>.

Required Access & Tooling

• Role Assignment: Exchange Administrator or Recipient Management role in the target tenant.
• Exchange Online PowerShell: ExchangeOnlineManagement module installed (Connect-ExchangeOnline).
• Purview PowerShell: Security & Compliance PowerShell session for Purview policy inspection (Connect-IPPSSession).
• Incident Context: Active ticket containing the affected user’s <UPN> and the exact error message or Non-Delivery Report (NDR) code.

---

3. Step-by-Step Diagnostic Sequence (Read-Only)

Run Steps 1 through 6 in order and record every output in the ticket. Do not modify any mailbox settings, holds, or policies until all six diagnostic steps are complete.

Step 1: Check Quotas, Holds, and Archive State

Inspect the mailbox’s quota boundaries, hold flags, retention policy assignment, and archive status:

Get-Mailbox <UPN> | Format-List *Quota*, UseDatabaseQuotaDefaults, LitigationHoldEnabled, `
    InPlaceHolds, RetentionHoldEnabled, ElcProcessingDisabled, RetentionPolicy, `
    ArchiveStatus, AutoExpandingArchiveEnabled, RetainDeletedItemsFor

• Expected Baseline (EXO Plan 2): IssueWarningQuota = 98 GB, ProhibitSendQuota = 99 GB, ProhibitSendReceiveQuota = 100 GB.
• Red Flags to Watch For:
  • RetentionHoldEnabled : True or ElcProcessingDisabled : True (MRM archiving and retention are completely suspended).
  • ArchiveStatus : None (the Online Archive is not provisioned or active).

Step 2: Check Primary, Archive, and Recoverable Items Sizes

Query the real storage consumption across both the primary mailbox and the Online Archive:

Get-MailboxStatistics <UPN> | Format-List TotalItemSize, TotalDeletedItemSize
Get-MailboxStatistics <UPN> -Archive | Format-List TotalItemSize

• Compare TotalItemSize against ProhibitSendQuota (99 GB: outbound sending blocked) and ProhibitSendReceiveQuota (100 GB: inbound receiving blocked too).
• Compare TotalDeletedItemSize against the 30 GB RecoverableItemsQuota (100 GB if LitigationHoldEnabled or InPlaceHolds is present). If TotalDeletedItemSize is near 30 GB, standard deletions will fail.

Step 3: Identify the Largest Folders (Sorted by Raw Bytes)

Never sort directly on the raw FolderSize property—Exchange returns FolderSize as a formatted string (e.g., "14.2 GB (15,247,138,816 bytes)"), which sorts alphabetically as text and places kilobytes above gigabytes. Extract the raw byte integer to sort accurately:

Get-MailboxFolderStatistics <UPN> -IncludeOldestAndNewestItems |
  Sort-Object {[int64]($_.FolderSize -replace '.*\(([\d,]+) bytes\).*','$1' -replace ',','')} -Descending |
  Select-Object -First 10 Name, FolderSize, ItemsInFolder, OldestItemReceivedDate

• Check for a bloated Deleted Items or Inbox folder.
• Compare OldestItemReceivedDate in the largest folders against the age limit of the mailbox’s archive tag (e.g., if the archive policy moves items older than 2 years, but Inbox has items from 5 years ago, MRM is either blocked or not linked to an archive tag).

Step 4: Verify Whether MRM / ELC Is Actually Running

Pull the extended diagnostic logs from the mailbox to inspect the Managed Folder Assistant (ELC) execution timestamps and item counters. Run these as two separate lines (do not paste them onto a single line without a semicolon, or Export-MailboxDiagnosticLogs will throw a positional parameter error):

$log = Export-MailboxDiagnosticLogs <UPN> -ExtendedProperties
([xml]$log.MailboxLog).Properties.MailboxTable.Property | Where-Object Name -like "ELC*" | Format-Table Name, Value

Inspect the returned properties:

• ElcLastSuccessTimestamp: When the Managed Folder Assistant last completed a clean pass.
• ElcLastRunArchivedFromRootItemCount: How many items were moved to the archive during the last run.
• ElcLastRunDeletedFromRootItemCount: How many items were deleted from the primary mailbox during the last run.
• ElcLastRunUpdatedItemCount: How many items were tagged during the last run.

Step 5: Inspect the Real Exchange MRM Retention Tags

Look up every tag linked to the mailbox’s assigned Exchange RetentionPolicy and verify its true RetentionAction and AgeLimitForRetention:

(Get-RetentionPolicy "<PolicyName>").RetentionPolicyTagLinks |
  ForEach-Object { Get-RetentionPolicyTag $_ } |
  Format-Table Name, Type, RetentionAction, AgeLimitForRetention, RetentionEnabled -AutoSize

Verify that a Default Policy Tag (Type : All) with RetentionAction : MoveToArchive and RetentionEnabled : True is actually present in the policy—and take note of any active DeleteAndAllowRecovery or PermanentlyDelete tags that will immediately fire if you remove a hold.

Step 6: Check Microsoft Purview Retention Policies

Connect to Security & Compliance PowerShell to see which Purview compliance policies apply on top of Exchange MRM:

Connect-IPPSSession
Get-RetentionCompliancePolicy | Format-Table Name, ExchangeLocation, Enabled
Get-RetentionComplianceRule | Format-Table Policy, RetentionDuration, RetentionComplianceAction

[!CAUTION] If a Hold Is Found: Before touching RetentionHoldEnabled, inspect StartDateForRetentionHold, EndDateForRetentionHold, and RetentionComment on the mailbox, and query the Unified Audit Log to see who placed the hold and why. Always escalate to L3 and the client compliance owner before removing any hold.

---

4. Two-Phase Remediation Runbook

Always separate remediation into Phase A (Immediate Same-Day Unblock) so the user can get back to work, followed by Phase B (Root-Cause Fix) once approvals are in place. Steps marked [L3 Approval] require explicit sign-off from L3 engineering and the client before execution.

Phase A: Immediate Unblock (Same Day)

On Exchange Online Plan 2, you cannot simply raise ProhibitSendQuota—the mailbox is already at the hard 99 GB send ceiling (Set-Mailbox -ProhibitSendQuota 100GB will fail with “exceeds the maximum allowed”). You must free space inside the primary mailbox:

1. Manual Batch Move to Online Archive (Preferred): Have the user move old folders or large mail batches directly into their Online Archive using Outlook on the Web (OWA) or the Outlook desktop client. OWA processes server-side folder moves significantly faster than cached-mode Outlook. Manual moves to the Online Archive work even when RetentionHoldEnabled is $true, and nothing is deleted.
2. Small Targeted Deletions (2–5 GB): Alternatively, delete 2–5 GB of clearly disposable items (Junk Email or small batches from Deleted Items).
3. Avoid the Recoverable Items Trap: Do NOT bulk-empty a 20+ GB Deleted Items folder. Emptying Deleted Items moves those messages into Recoverable Items\Deletions, which is governed by a strict 30 GB quota (unless on Litigation/Purview Hold). Once Recoverable Items hits 30 GB, the user cannot delete anything at all.
4. Verify Mail Flow Resumption: Outbound sending resumes within minutes once TotalItemSize drops safely below ProhibitSendQuota (99 GB).

Phase B: Root-Cause Remediation

1. [L3 Approval] Remove a Stale Exchange Retention Hold

Once the client confirms that no legal or administrative hold requires RetentionHoldEnabled (or if it must remain, document the reason in -RetentionComment), disable the hold:

Set-Mailbox <UPN> -RetentionHoldEnabled $false

[!WARNING] Pre-Check Before Removing a Hold: Removing RetentionHoldEnabled immediately activates every tag in the mailbox’s Exchange retention policy—including DeleteAndAllowRecovery and PermanentlyDelete tags. Always review the output of Diagnostic Step 5 before running this command.

2. [L3 Approval] Enable Auto-Expanding Archive (If Archive Is Near 100 GB)

If the user’s Online Archive is approaching its initial 100 GB storage cap, enable Auto-Expanding Archive (included with Exchange Online Plan 2, scaling up to 1.5 TB). Note that enabling Auto-Expanding Archive is irreversible:

Enable-Mailbox <UPN> -AutoExpandingArchive

3. Trigger the Managed Folder Assistant (-FullCrawl)

After modifying any retention policy or hold setting, wait 30–60 minutes for directory and mailbox replication to settle so the assistant sees the updated configuration, then trigger a full MRM crawl:

Start-ManagedFolderAssistant <UPN> -FullCrawl

4. [L3 Approval] Assign a Dedicated Per-User Archive Policy (If Needed)

If the default archive tag’s age limit (e.g., Default 2 year move to archive) is too slow for a high-volume mailbox, create and assign a dedicated per-user retention policy with a shorter MoveToArchive tag (such as 1 year or 6 months). Never edit a tenant’s Default MRM Policy for a single user—it applies to every mailbox in the organization.

5. Staged Cleanup for Bloated Deleted Items (Client Decision)

If a mailbox has tens of gigabytes sitting in Deleted Items:

• If disposable: Empty in controlled batches that stay comfortably below the remaining free space in Recoverable Items (30 GB ceiling), waiting for the RetainDeletedItemsFor purge window (14 days by default) to clear between batches.
• If required for retention: Move the contents into the Online Archive in batches rather than deleting them.

---

5. Verification, ELC Counter Analysis & Preventive Monitoring

A mailbox storage ticket is only resolved when the user can send and receive and you have verified that automated archiving (not accidental deletion) is what reduced the primary mailbox size.

5.1 Post-Remediation Verification Checklist

• Mail Flow Restored: User confirms they can both send and receive email.
• Primary Mailbox Headroom: Primary TotalItemSize is well below ProhibitSendQuota (99 GB).
• MRM Execution Verified: Re-run Diagnostic Step 4 after the MRM cycle; confirm ElcLastSuccessTimestamp has updated and ElcLastRunArchivedFromRootItemCount is greater than 0.
• Conservation of Data Check: Confirm the Online Archive TotalItemSize grew by roughly the same amount that the primary mailbox shrank. If the primary mailbox shrank without corresponding growth in the Online Archive, items were deleted, not archived—immediately inspect TotalDeletedItemSize and ElcLastRunDeletedFromRootItemCount.
• Recoverable Items Health: Confirm TotalDeletedItemSize remains below its 20 GB warning threshold. If it exceeds 20 GB, schedule a follow-up check for the purge date (Deletion Date + RetainDeletedItemsFor).

[!NOTE] Interpreting ELC Counters Accurately: A high ElcLastRunDeletedFromRootItemCount value is not automatic proof that MRM deleted the user’s primary mail folders. Cross-check the counter against the specific tags that actually carry a delete action (frequently only Junk Email or Deleted Items), the oldest-item dates from Step 3, and the Unified Audit Log (Search-UnifiedAuditLog -Operations SoftDelete,HardDelete) before recording a root cause.

5.2 Tenant-Wide Preventive Monitoring (Monthly Audit)

Rather than waiting for VIP users to hit the 99 GB wall, run a monthly audit across the tenant to surface mailboxes with stale retention holds or disabled ELC processing, and alert whenever primary mailboxes cross 90% of ProhibitSendQuota:

# Audit all mailboxes where Exchange MRM archiving/retention is suspended
Get-Mailbox -ResultSize Unlimited |
  Where-Object { $_.RetentionHoldEnabled -or $_.ElcProcessingDisabled } |
  Format-Table Name, UserPrincipalName, RetentionHoldEnabled, ElcProcessingDisabled, RetentionComment -AutoSize

---

6. Quick Troubleshooting Reference Matrix

Symptom	Likely Cause	Fix
Can’t send; primary near 99 GB; archive exists but is small or unchanged	RetentionHoldEnabled is $true, or ElcProcessingDisabled is $true	Run Diagnose Steps 1 & 4; execute Remediate B1 with L3/client approval.
Set-Mailbox -ProhibitSendQuota 100GB fails with “exceeds the maximum allowed”	Mailbox is already at the Exchange Online Plan 2 license ceiling (99 GB send)	Free space in the primary mailbox (move to Archive); do not try to raise the quota.
User says “I can’t send or receive” after emailing themselves, but external mail arrives	Mailbox is between ProhibitSendQuota (99 GB) and ProhibitSendReceiveQuota (100 GB)	Explain the split quota; free 2–5 GB immediately so TotalItemSize drops below 99 GB.
Start-ManagedFolderAssistant -FullCrawl completes with all ELC counters at 0	Hold/policy change hasn’t replicated yet, or no items are older than the archive tag	Wait 30–60 minutes after policy/hold changes and re-run; verify OldestItemReceivedDate.
Primary mailbox shrank, but Online Archive didn’t grow	Items were deleted (by user or an MRM/Purview delete tag), not archived	Check TotalDeletedItemSize, inspect active delete tags, and check Search-UnifiedAuditLog.
Deletions fail or user cannot empty Deleted Items	Recoverable Items has hit its 30 GB quota	Stop all deletions until the purge window clears, or move items to the Online Archive instead.
Tags named "Delete" do not delete anything	Tag RetentionAction was modified in the past while keeping the old display name	Always read RetentionAction in PowerShell (Step 5); ask client to rename misleading tags.
Get-RetentionCompliancePolicy is not recognized	Cmdlet belongs to Security & Compliance PowerShell, not Exchange Online PowerShell	Run Connect-IPPSSession before querying Purview policies.
Export-MailboxDiagnosticLogs throws a positional parameter error	Both lines of Step 4 were pasted as a single line without a statement separator	Run as two separate lines, or separate them with ;.
Folder size list sorts inaccurately (GB listed below KB)	FolderSize is a formatted string and sorts alphabetically by default	Use the regex byte-extraction sort in Diagnostic Step 3.
Outlook desktop says “Mailbox Full”, but OWA sends and receives fine	Local Outlook cached-mode .ost file has reached its client-side size limit (default 50 GB)	Adjust cached Exchange mode sync slider or .ost registry limits on the workstation.
External senders report bounce messages	Primary mailbox reached the 100 GB ProhibitSendReceiveQuota	Inspect the NDR status code (5.2.2 = mailbox full) and execute Phase A unblock.

---

7. Rollback, Escalation & Ticket Documentation

7.1 Irreversible Actions & Rollback Procedures

• Irreversible Operations: Enabling AutoExpandingArchive cannot be disabled once turned on, and permanently purged items cannot be recovered. Never execute either without documented L3 and client approval.
• Emergency Hold Rollback: If removing RetentionHoldEnabled triggers unexpected deletions, immediately re-apply the hold with an audit comment and investigate:

  Set-Mailbox <UPN> -RetentionHoldEnabled $true -RetentionComment "Paused pending review - <Ticket#>"

• Recovering Deleted Items: Items deleted in error remain recoverable inside Recoverable Items for the duration of RetainDeletedItemsFor (14 days by default). Users can self-restore via OWA (Deleted Items > Recover items deleted from this folder) or admins can run Restore-RecoverableItems.
• Policy Rollback: If a newly assigned per-user retention policy causes unintended behavior, revert to the previous policy immediately:

  Set-Mailbox <UPN> -RetentionPolicy "<PreviousPolicyName>"

7.2 Escalation Matrix

Scenario	Escalation Path
Hold discovered on mailbox with no documented reason or ticket history	Escalate to L3, then client compliance/IT contact
Removing a hold, enabling auto-expanding archive, or changing retention policies	Requires L3 approval + Client approval prior to execution
Microsoft Purview policy with Delete or KeepAndDelete action implicated	Escalate to L3 / Compliance Owner
Suspected legal hold, litigation, or active eDiscovery requirement	Escalate to L3 and Client Legal before any deletion
Same-day mail flow unblock not achieved within 4 hours	Escalate to L3

7.3 Standardized Ticket Notes Template

Copy and populate this block when documenting or escalating the ticket:

Issue: <UPN> unable to send/receive; mailbox full alert.
Findings:
  - Primary Mailbox: <X> GB vs ProhibitSendQuota <Y> GB / ProhibitSendReceiveQuota <Z> GB
  - Online Archive: <X> GB / <Y> GB (ArchiveStatus: <Active/None>, AutoExpanding: <True/False>)
  - Recoverable Items: <X> GB / 30 GB (RetainDeletedItemsFor: <X> days)
  - Holds & ELC: RetentionHoldEnabled=<T/F>; ElcProcessingDisabled=<T/F>; LitigationHold=<T/F>
  - Largest Folder: <FolderName> (<X> GB, Oldest Item: <Date>)
  - Assigned MRM Policy: <PolicyName>
Root Cause: <e.g., Stale RetentionHoldEnabled=True prevented MRM MoveToArchive tags from running>
Actions Taken: <e.g., User moved 4 GB to Online Archive via OWA; removed RetentionHoldEnabled and ran Start-ManagedFolderAssistant -FullCrawl> (Approved by <Name>, <Date>)
Pending / Follow-up: <Client decisions, follow-up date to verify ElcLastRunArchivedFromRootItemCount and Recoverable Items purge>