Is Microsoft 365 / Exchange Online GoBD-compliant?

What the GoBD require

The GoBD are Germany’s principles for the proper keeping and retention of books, records and documents in electronic form and for data access. They are not a law of their own but an administrative directive from the Federal Ministry of Finance that tax authorities apply in audits. The governing BMF letter dates from 28 November 2019; it was amended on 11 March 2024 and most recently on 14 July 2025, mainly because of e-invoicing.

At their core are a few principles: traceability and verifiability, completeness, accuracy, timely recording, order and, above all, immutability. Records subject to retention must be available at all times throughout the retention period and it must be possible to make them readable without delay and evaluate them by machine. Received commercial or business letters and accounting documents must match the original visually, other records in content (Section 147(2) of the German Fiscal Code, AO). During a tax audit the authorities may inspect the data, have it evaluated by machine or have it transferred to them (Section 147(6) AO).

Which emails you have to keep

Not every message belongs in the archive. According to the GoBD, content and function decide, not the label (para. 121): emails that function as a commercial or business letter or as an accounting document must be kept in electronic form. Under Section 257(2) of the German Commercial Code (HGB), commercial letters are documents that concern a commercial transaction.

• Quotes, order confirmations, invoices and contracts by email: usually must be kept.
• Newsletters, pure scheduling messages or private messages: usually not.
• If an email is merely a “means of transport”, for an attached invoice for example, and contains no further information subject to retention itself, only the attachment has to be kept. The GoBD compare it to the paper envelope of old.

In day-to-day operations this distinction is hard to make reliably. It is therefore often more practical to archive business email automatically rather than having every message assessed individually. What is excluded and when data is deleted belongs in a retention policy that you agree with your tax adviser, with data protection in mind.

For how long? The retention periods

• 10 years: books and records, inventories, annual financial statements, management reports and the opening balance sheet (Section 147(3) AO, Section 257(4) HGB).
• 8 years: accounting documents, which usually include invoices. The Fourth Bureaucracy Relief Act shortened the period from 10 to 8 years. Since 1 January 2025 it also applies to older documents whose previous period had not yet expired at the end of 2024 (Article 97 Section 19a of the Introductory Act to the Fiscal Code). Special rules apply to banks, insurers and investment firms.
• 6 years: received and sent commercial and business letters, including the corresponding emails, and other tax-relevant documents.

The period starts at the end of the calendar year in which the email was received or sent or the document was created (Section 147(4) AO). It also does not expire as long as the records are relevant to taxes whose assessment period has not yet expired (Section 147(3) AO).

Is Microsoft 365 / Exchange Online enough for this?

Exchange Online stores email reliably and includes compliance features: archive mailboxes, retention policies via Microsoft Purview, Litigation Hold and journaling. Properly licensed and configured, these features cover individual GoBD requirements. They do not, however, add up to automatic GoBD compliance, and a few points are easily overlooked.

Where the built-in tools reach their limits

• Licensing: retention policies for mailboxes and Litigation Hold are included in Exchange Online Plan 2, Microsoft 365 Business Premium, E3 and E5, among others. Business Basic and Business Standard need the Exchange Online Archiving add-on.
• Journaling: an Exchange Online mailbox cannot be designated as a journaling mailbox. Journal reports must go to an on-premises system or a third-party archiving service. Microsoft itself calls journaling an older feature and recommends keeping data in the tenant with Microsoft 365 retention instead.
• Undeliverable journal reports: monitoring non-delivery reports is your responsibility. If the alternate journaling mailbox is unavailable as well, rejected reports are lost and cannot be recovered.
• Changeable holds: administrators with the right permissions can remove Litigation Hold and unlocked retention policies. A 30-day delay hold then applies, after which items marked for deletion are permanently removed. With the Legal Hold role, even this delay hold can be lifted early.
• Preservation Lock: retention policies can be locked via PowerShell. After that, nobody, not even a global administrator, can turn them off, delete them or shorten them. The lock is deliberately irreversible and therefore needs careful planning.

The decisive point: without Preservation Lock, retention in Microsoft 365 stays administratively changeable; with the lock it is fixed, but also irreversible. Whether your setup meets the GoBD also depends on things no setting provides: complete capture, a defined way to give auditors readable, machine-evaluable data, and procedural documentation.

What tamper-proof archiving has to deliver

• Complete, automatic capture of the relevant email traffic, ideally before anyone can delete anything.
• Immutability, secured through technical and organisational measures, with changes logged.
• Availability, readability and machine-evaluability across the entire retention period, including after a system change.
• Defined data access for tax audits (Section 147(6) AO): who provides which data, and how?
• A deletion and permissions concept, because data protection also limits how long and for whom personal data remains available.
• Procedural documentation that describes how archiving works. At its core, GoBD is also a process topic, not just a software question.

A separate archive: central archiving with MailStore

For Microsoft 365 and Exchange I use MailStore (MailStore Software GmbH, part of OpenText since December 2019), either on-premises as MailStore Server or hosted, for example as MailStore Cloud or EL mailarchive. The software stores complete, faithful copies of emails in a central archive and connects Microsoft 365, Exchange and Google Workspace via journaling or mailbox archiving. Users keep working through the familiar folder structure, full-text search or directly from Outlook.

MailStore Server backs tamper protection technically with SHA hash values of the email content and internal AES256 encryption. With Legal Hold enabled, no emails can be deleted from the archive regardless of any other settings. An auditing function logs the events the administrator defines, and a dedicated auditor user gives reviewers read access to the archives without being able to archive or export emails. According to the vendor, every new version is examined by an independent auditor against IDW PS 880. The attestation for version 26.3, dated 17 July 2026, confirms that the software, when used properly, enables accounting in line with German generally accepted accounting principles.

Whether the archive runs in house or hosted depends on your size and requirements. I compare the variants in the article MailStore on-premises or in the cloud. How I plan and look after archiving is described on the email archiving page.