nextxch Archive: Microsoft 365, Exchange, Google Workspace e IMAP nell'archivio GoBD

# 1. Admin > Compliance > Archive sources > New source, kind "SMTP journal"
#    Domains of the old environment: company.com · journal domain: archive.company.com
#    -> journal address e.g. journal-k3x9q2m7v1c8b4n6z5ta@archive.company.com (copy it)
# 2. Protection: IP ranges of the Exchange Online servers, TLS required, allowed envelope senders
# 3. Microsoft Purview: Solutions > Data lifecycle management > Exchange (legacy) > Journal rules
#    or Exchange Online PowerShell:
Set-TransportConfig -JournalingReportNdrTo journal-ndr@archive.company.com
New-JournalRule -Name "nextxch Archive" -JournalEmailAddress journal-k3x9q2m7v1c8b4n6z5ta@archive.company.com -Scope Global -Enabled $true
Get-JournalRule | Format-Table Name,Enabled,JournalEmailAddress,Scope
# 4. Send a test message: the source shows the original with all envelope recipients (including Bcc)

# Exchange Server (Exchange Management Shell)
New-JournalRule -Name "nextxch Archive" -JournalEmailAddress journal-k3x9q2m7v1c8b4n6z5ta@archive.company.com -Scope Global -Enabled $true

# Google Admin console: Menu > Apps > Google Workspace > Gmail > Routing > Configure
#   Messages to affect: inbound, outbound, internal inbound, internal outbound
#   Action: Modify message > Add more recipients > Advanced > journal address
#   Optional: do not deliver spam to this recipient, suppress bounces from this recipient
# Journal source in nextxch: format bcc or auto, IP ranges of Google's outbound servers, TLS required

{
  "host": "imap.oldhoster.com",
  "tls": "implicit",
  "auth": "password",
  "mode": "single",
  "username": "accounting@company.com",
  "address": "accounting@company.com",
  "excludeFolders": ["Drafts"],
  "since": "2016-01-01",
  "maxConnections": 2
}
# Secret: password (or oauthToken with xoauth2), in list mode accounts/<id>/password

# Entra admin center > App registrations > New registration "nextxch Archive" (single tenant)
# API permissions > Microsoft Graph > Application permissions:
#   Mail.Read, User.Read.All (+ GroupMember.Read.All with group filter) > Grant admin consent
# Certificates & secrets: upload a certificate (.cer) or create a client secret
{
  "tenantId": "company.onmicrosoft.com",
  "clientId": "11111111-2222-3333-4444-555555555555",
  "credentialType": "certificate",
  "cloud": "global",
  "userFilter": { "mode": "group", "groupId": "99999999-0000-0000-0000-000000000009" },
  "sinceUtc": "2019-01-01T00:00:00Z"
}
# Secrets: certificatePfx (Base64) + certificatePassword or clientSecret (the value, not the ID)

# Admin console: Security > Access and data control > API controls > Domain-wide delegation
#   client ID (numeric) + scopes:
#   https://www.googleapis.com/auth/gmail.readonly,
#   https://www.googleapis.com/auth/admin.directory.user.readonly
{
  "adminSubject": "admin@company.com",
  "domain": "company.com",
  "userFilter": "orgUnit",
  "orgUnitPath": "/Sales",
  "sinceUtc": "2018-01-01T00:00:00Z",
  "quotaUnitsPerUserMinute": 4800
}
# Secret: serviceAccountKey (JSON key file of the service account)

Retention      RetentionDays 0..36500 (0 = no WORM retention)
Mode           Normal | Governance | Compliance (default)
Legal hold     per source, also applies to already archived messages
Storage        local or S3 with Object Lock (like the rest of the GoBD archive)
Status         per mailbox: last run, next run, stored, duplicates, rejected, errors

# Search in an archived mailbox
curl -s "https://mail.company.com/api/compliance/search?archivedMailboxId=<id>&q=invoice&limit=100" -H "X-Api-Key: $KEY"

# Evidence export of an archived mailbox (202, status under GET /api/compliance/exports/{id})
curl -X POST https://mail.company.com/api/compliance/exports -H "X-Api-Key: $KEY" -H "Content-Type: application/json" \
  -d '{"scope":"mailbox","archivedMailboxId":"<id>","caseReference":"case 4711"}'

# Restore into a nextxch mailbox
curl -X POST https://mail.company.com/api/compliance/restore/jobs -H "X-Api-Key: $KEY" -H "Content-Type: application/json" \
  -d '{"source":"archive","account":"archived:<id>","target":"account","targetAccount":"successor@company.com"}'

GET    /api/admin/archive-sources                          sources, licence line, available kinds with fields
GET    /api/admin/archive-sources/license                  used, allowed, free, remaining
POST   /api/admin/archive-sources                          create a source
GET    /api/admin/archive-sources/{id}                     source, mailboxes, names of the secrets
PUT    /api/admin/archive-sources/{id}                     change (settings, retention, legal hold, schedule)
DELETE /api/admin/archive-sources/{id}                     delete
POST   /api/admin/archive-sources/{id}/test                connection test
POST   /api/admin/archive-sources/{id}/discover            discover mailboxes
GET    /api/admin/archive-sources/{id}/mailboxes           archived mailboxes
PUT    /api/admin/archive-sources/{id}/mailboxes/{mbxId}   {"enabled": true} within the licence line
POST   /api/admin/archive-sources/{id}/run                 fetch now, optionally {"mailboxId": "..."}
GET    /api/admin/archive-sources/{id}/runs                history (mailboxId, limit)

curl -X POST https://mail.company.com/api/admin/archive-sources -H "X-Api-Key: $KEY" -H "Content-Type: application/json" -d '{
  "kind": "Journal", "name": "Microsoft 365 journal", "journalDomain": "archive.company.com",
  "settings": { "domains": ["company.com"], "allowedSenderNetworks": ["203.0.113.0/24"], "requireTls": true },
  "retentionDays": 3650, "lockMode": "Compliance" }'