Proofpoint Migration Case StudyProofpoint journal archive,
into Microsoft 365.

Organisation

US healthcare provider (name withheld)

Sector

Healthcare · USA

Source

Proofpoint journal archive

Destination

Exchange Online, governed by Microsoft Purview

Timeline

Whole dataset migrated in a few months

Result

Proofpoint retired

The situation

The provider had already moved its mailboxes from on-premises Exchange to Microsoft 365. Proofpoint still handled two jobs: filtering inbound mail and journalling every message for compliance. Consolidating both into Microsoft 365 would cut licensing costs and leave one platform to manage, but only if compliance coverage never lapsed.

The journal archive raised a specific problem. Journal data has to be retained and searchable for eDiscovery, but it shouldn't appear in anyone's mailbox. Staff shouldn't suddenly find thousands of journalled copies in their Outlook.

How the project ran

1. Replace the services before removing them. Microsoft Defender took over Proofpoint's filtering and threat protection. Journalling was recreated in Exchange Online, backed by retention policies, so new mail was covered before any history moved.
2. Extract in parallel. Several Proofpoint exports ran at once to shorten extraction time.
3. Map every message to a person. Metadata and SMTP addresses were mapped to Microsoft 365 identities, keeping the chain of custody intact so no record was missed.
4. Place data out of sight. Journal items went into the Recoverable Items folder in Exchange Online. That folder is hidden from users but fully searchable by compliance teams.
5. Handle current staff and leavers differently. For current employees, journal data was added silently to their archive mailboxes. For people who had left, new mailboxes were created and placed under retention so their records stayed governed.
6. Prove it with eDiscovery. Test searches in Microsoft Purview, across Exchange, OneDrive, SharePoint and Teams, confirmed the migrated data could be found.

Results

• The whole Proofpoint journal dataset migrated within a few months
• Journal data searchable in Purview eDiscovery and hidden from users
• Leavers' records retained under policy in dedicated mailboxes
• Proofpoint retired, with lower licensing costs
• A full audit trail and no disruption to users

What this means for your project

Journal archives are the hardest part of most archive exits, because they serve compliance rather than people. The answer is to treat them that way: replace journalling first, place historical data where only compliance can see it, plan explicitly for leavers, and validate with the eDiscovery searches your legal team will actually run. The same approach applies to journal archives from Enterprise Vault, Mimecast and other platforms.

Related