Microsoft 365 email archiving for RIAs

For an SEC-registered adviser, Microsoft 365 email archiving means keeping the sent and received mail that Rule 204-2 covers. An archiver reads that mail through a Microsoft Graph app that a tenant administrator consents to and can revoke. Purview retention is a separate question, covered below.

What this means for your firm

• Decide who can grant admin consent; if that is outsourced IT, tell them before you start, because the consent step is theirs.
• Know the scope before consent: two read-only application permissions, with mail access across every mailbox in your tenant by default.
• If your firm uses an archiving policy, ask your administrator whether older mail has moved to the online-archive mailbox, which Graph does not expose.

Turret asks for no permission that can send, delete or modify mail, and queues flagged outbound mail for your reviewer.

Price your own mailbox count: use the archiving cost calculator.

Rule

Sent and received written communications relating to advice, funds, orders and performance, kept not less than five years from the end of the fiscal year of the last entry, the first two years in an appropriate office of the adviser (Rule 204-2(a)(7), (e)(1)).^[1]

Permissions

Two Microsoft Graph application permissions, Mail.Read and User.Read.All, both requiring administrator consent. Neither sends, deletes or modifies mail.^[2]

Who consents

Microsoft’s admin-consent page names Privileged Role Administrator for any Graph permission. Turret’s setup screen asks for a Global Administrator.^[4]

What is captured

Sent and received mail in the user’s primary mailbox, Deleted Items included. Not the online-archive mailbox, and not hard-deleted mail.

Review scope

Outbound mail only. Inbound mail is archived and is not pattern-matched.

Rule 204-2 of the Investment Advisers Act is the recordkeeping rule. Paragraph (a)(7) reaches email by function, not by technology:

(7) Originals of all written communications received and copies of all written communications sent by such investment adviser relating to:

(i) Any recommendation made or proposed to be made and any advice given or proposed to be given;

(ii) Any receipt, disbursement or delivery of funds or securities;

17 CFR 275.204-2(a)(7), lead-in and items (i) and (ii)^[1]

Items (iii) and (iv) add order placement and performance. Paragraph (e)(1) sets the clock for these records:

… shall be maintained and preserved in an easily accessible place for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser.

17 CFR 275.204-2(e)(1)^[1]

Two things follow.

1. The rule covers both directions, but only written communications relating to the listed subjects. An archive keeps all sent and received mail; the rule defines which of those messages are required records.
2. The rule asks for a record that is kept, not a mailbox that happens to still hold the message. A mailbox is a working surface, and users delete and move mail.

A third-party archiver reads mail from outside your tenant, through the Microsoft Graph API, using an application that an administrator in your tenant approves. Turret’s application holds two application permissions, meaning the app acts without a signed-in user rather than as one particular person.

• Mail.Read. Microsoft’s permissions reference describes it as: “Allows the app to read mail in all mailboxes without a signed-in user.”^[2] Administrator consent is required. It is the narrowest application permission that returns message bodies; Mail.ReadBasic.All omits them. Note the scope in that sentence: all mailboxes in the tenant, by default.
• User.Read.All. Lists the users in the tenant, so the archiver knows which mailboxes exist.

Turret does not request any permission that sends, deletes or modifies mail.

Who can grant consent

Microsoft’s admin-consent documentation lists Privileged Role Administrator as the role that can grant consent for apps requesting any permission for any API. It lists Cloud Application Administrator, Application Administrator and AI Administrator for consent except Microsoft Graph application permissions, which is what Mail.Read is.^[4] That page does not name Global Administrator. Turret’s setup screen asks the person to sign in as a Global Administrator. The Microsoft consent screen may label the app as unverified.

Turret’s flow uses a single-use link that expires in five minutes, and it records your Microsoft tenant only after a test read through Graph and a check that your firm’s domain belongs to that tenant.

Scoping. The default is every mailbox. Microsoft documents a way to narrow app access to specific mailboxes, and two of its own pages disagree about which. The Graph permissions reference still tells administrators to configure an application access policy. The Exchange Online page, last updated August 2026, says “RBAC for Applications replaces Application Access Policies”, and the old Graph link now lands on that page. Treat the Exchange page as current.^[3]

One caution from it matters to anyone attempting this: permissions are a union of what Microsoft Entra ID grants and what Exchange RBAC assigns, so leaving the Entra Mail.Read grant in place beside a scoped assignment “results in no effective resource scoping.” An archiver can only keep what it can read, and which mailboxes your records require is a judgment for your CCO and counsel.

Revoking. The grant lives in your tenant, so you end it there. In the Microsoft Entra admin center, under Enterprise applications, find the Turret application. Deactivating it, in Microsoft’s words, “prevents token issuance and user sign-in while preserving the application configuration.” Deleting it, which needs the Cloud Application Administrator or Application Administrator role, leaves it “in a suspended state in the recycle bin for 30 days.”^[5] The security page lists what is and is not in place.

For IT readers. Turret reads mail only through Microsoft Graph. Microsoft’s documented Outlook limits apply per app ID and mailbox combination: “10,000 API requests in a 10-minute period” and “Four concurrent requests.”^[8] Turret holds itself to four concurrent requests per mailbox, keeps per-mailbox byte and fetch budgets, and halves its pace when Microsoft signals a throttle.

Exchange Web Services is not part of this. Microsoft’s deprecation page says “October 2026: EWS starts to be disabled globally for all organizations” and “April 2027: EWS is fully disabled.”^[9] Turret reads through Graph, not EWS.

• Included. Sent and received mail in the user’s primary mailbox, Deleted Items included. Microsoft’s Graph documentation says listing messages returns “the Deleted Items and Clutter folders” along with the rest.^[6] Turret requests immutable message identifiers, so a message a user files into another folder, or deletes, is not archived a second time. Subfolders of Drafts and Junk are captured.
• Skipped. The Drafts and Outbox folders themselves, in both directions (a message in the Outbox has not been sent; it is captured once it has). The Junk folder itself, for received mail. On the received side, Teams chat logs that Exchange stores in a conversationhistory folder.
• Attachments. Attachments are archived with their name, type and size, but the text inside them is not scanned.
• Not reached. First, the online-archive mailbox, the separate in-place archive mailbox. Microsoft’s Graph documentation says “The API does not support accessing in-place archive mailboxes”, and Turret reads only what Graph exposes today.^[7] Second, hard-deleted mail: Turret does not read Exchange’s Recoverable Items. The page on whether email archiving captures deleted email draws the same line for both providers.

Review scope. Archiving and surveillance are different jobs. Turret’s pattern review runs on outbound mail only. Inbound mail is archived and never pattern-matched, on either provider; the Google Workspace page sets out that provider’s scope.

As of October 17, 2026, Microsoft’s Purview licensing page lists Microsoft 365 E3, E5, A3, A5, G3, G5 and Business Premium for retention on the Exchange mailbox location, with Exchange Plan 2 and Exchange Online Archiving also named. Business Basic and Business Standard appear on that page only against Teams chats. Read “not listed” as a prompt to ask Microsoft about your plan, not as “unavailable”.^[10]

Communication Compliance, the Purview review feature, needs a higher-tier license: Microsoft says covered users need a Microsoft Purview Suite license, an Office 365 E3 license with the Advanced Compliance add-on, or an Office 365 E5 subscription.^[11] The Vault answer makes the same case for Google: an archive is a record kept outside the mailbox.

1. Decide who in the firm can sign in with a role that is allowed to grant the consent. If it is an outsourced IT provider, tell them before you start, because the consent step is theirs.
2. Read the two permissions as they are: read-only, tenant-wide by default, revocable by you in Entra.
3. Be clear about the two limits, the online-archive mailbox and hard-deleted mail. If your firm uses an archiving policy, ask your administrator whether older mail has already moved there.
4. Check your license against Microsoft’s Purview page before you rely on Purview for retention, and treat supervision as its own question.

Turret connects to Microsoft 365 through app-only Microsoft Graph, using the two read-only permissions above. It keeps sent and received mail for 7 years, while you subscribe, and runs its pattern review on outbound mail only. The security page lists exactly what is and is not in place.

The Email product is $99 a month for 5 monitored mailboxes, plus $25 a month for each additional monitored mailbox, with a 15-day free trial and no setup fee.

Sources opened October 17, 2026.

1. 17 CFR 275.204-2, books and records to be maintained by investment advisers (eCFR)
2. Microsoft Graph permissions reference, Mail.Read
3. Microsoft Learn, Role Based Access Control for Applications in Exchange Online
4. Microsoft Learn, Grant tenant-wide admin consent to an application
5. Microsoft Learn, Delete an enterprise application
6. Microsoft Graph, List messages
7. Microsoft Graph, Outlook mail API overview
8. Microsoft Graph, service-specific throttling limits (Outlook)
9. Microsoft Learn, Deprecation of Exchange Web Services in Exchange Online
10. Microsoft Purview service description (retention licensing)
11. Microsoft Purview, Communication Compliance plan
12. Microsoft Learn, Manage Communication Compliance policies