Last updated: 21 July 2026
Two ways admins actually do this at scale — scripted, IT-run deletion, or company-wide self-serve cleanup — and how to do either without breaking retention policy or legal hold.
Two approaches
Precise and fully IT-controlled — content search and purge workflows can target specific criteria across specific mailboxes. Doesn't scale well as a recurring task: every cleanup request becomes IT time, and it requires Exchange Online admin permissions most employees rightly don't have.
Admin subscribes once; every employee gets a scoped tool to clean only their own mailbox — bulk-delete by sender, age, or size. Removes IT from routine cleanup entirely, while admins retain control over the plan and seats, not individual actions.
Before you run anything
Litigation Hold, In-Place Hold, and retention policies all preserve a copy of an item regardless of user or admin deletion — confirm what's configured on a mailbox before assuming a bulk delete is a clean, total removal.
Grouping by sender and clearing years of newsletters or notification emails rarely touches anything business-critical — a good first bulk-delete target, especially paired with unsubscribing so the mailbox doesn't just fill back up.
Deleted mail moves to Deleted Items and a recoverable-items store before permanent purge after Microsoft's retention window — a bulk delete is recoverable for a period afterward, not an irreversible action, unless a hard-purge is deliberately used.
A one-off scripted purge solves today's ticket. The mailbox fills up again next year. Giving employees their own cleanup tool — scoped only to what they're allowed to touch — turns a recurring IT project into something that never needs a ticket at all.
Yes, in a few different ways: PowerShell with the Exchange Online management module (e.g. Search-Mailbox or the Content Search + purge workflow in the compliance centre) for admin-driven, IT-only cleanup; or a company-wide tool that lets each employee clear their own mailbox, which scales far better than IT running scripted deletes against every mailbox one at a time.
It shouldn't, if the hold or retention policy is actually in place and the deletion method respects it. Exchange Online's In-Place Hold, Litigation Hold, and retention policies all work by preserving a copy of an item regardless of user or admin deletion — properly built bulk-delete tooling works within that constraint rather than around it. Always verify holds are correctly configured before running any bulk deletion, admin script or otherwise.
PowerShell scripts are precise but require IT time for every request and don't scale to "every mailbox in the company, regularly" without becoming a recurring project. Self-serve tooling — where each employee runs their own Smart Sweep or Storage Cleanup, scoped to only their own mailbox — removes IT from the loop entirely for routine cleanup, while admins still control the plan, seats, and any org-wide policy.
This is usually the safest category to bulk delete — grouping by sender and clearing years of accumulated newsletters or notification emails rarely touches anything business-critical, and unsubscribing at the same time stops the mailbox from filling back up. It's a good first target for any company-wide cleanup.
Not immediately. Deleted items move to the Deleted Items folder (and from there, typically a recoverable-items store) before being permanently purged after Microsoft's retention window — so a bulk delete is recoverable for a period afterward, not instantly irreversible, unless a hard-delete/purge action is deliberately used.
For a single one-off cleanup, a carefully written script is fine. The risk shows up over time: a script has to be maintained as Microsoft's PowerShell modules and Graph API change, re-tested against hold/retention edge cases, and re-run manually every time cleanup is needed again — none of which happens automatically the way it does with a maintained tool. For a recurring, company-wide need rather than a single cleanup, that ongoing maintenance burden is usually the deciding factor, not the initial script-writing effort.
One licence, one company domain — no per-mailbox IT time, no scripts to maintain, respects retention policy and legal hold by design.