In-Place Archive, In-Place Hold, Litigation Hold and In-place eDiscovery in Exchange Online


Exchange Online comes with a huge set of compliance features that enable Office 365 organisations to stay in control of their data and to meet legal an regulatory requirements specific for the countries they operate in. Features like litigation hold, in-place hold and eDiscovery are the cornerstones for compliance in Exchange Online. However, we see very often that people (IT admins included) make a lot of confusions between these features. And to make everything even worse, we also have an In-Place Archive, which is often associated with In-Place Hold due to the similar name. So in this blog post we want to shed some light on all these concepts. Sure you can find a TechNet documentation for each of this topics, but what we want to do is more like a synopsis; putting everything in one place so that we can spot the differences more easily.

So let’s start with the “stranger”. In-Place archive provides additional storage space for mailbox data. This is achieved by adding a secondary archive mailbox (called In-Place archive) to each user’s primary mailbox once this feature is activated by an administrator. Users can then move emails from their primary mailbox to the archive mailbox and vice versa. The size of such an archive mailbox is virtually unlimited (limit is set to 100 GB initially, but can be raised by 70 GB by Office 365 support) for the E3, E5 plans. So, simply put, In-Place Archive is about email storage and not about compliance.

In-place hold and litigation hold are similar things. That’s why the are treated in a single TechNet article. However, this is also the reason why confusion is generated. When a reasonable expectation of litigation exists, organizations are required to preserve electronically stored information (ESI), including email that’s relevant to the case. This expectation often exists before the specifics of the case are known, and preservation is often broad. Organizations may need to preserve all email related to a specific topic or all email for certain individuals. And we can achieve this using in-place hold and litigation hold. 

So what’s the difference? Litigation hold is normally used when you want to put an entire mailbox on hold. You can achieve this either using EAC, or PowerShell with: Set-Mailbox bsuneja@contoso.com -LitigationHoldEnabled $true. So this is an operation that you perform directly on a mailbox.

In-place hold, on the other side, is a little bit more about fine tuning, because it allows administrators to create hold based on different criteria, like keywords. In this scenario a created in-place hold could span across elements in several mailboxes at a time. For example, you can create an in-place hold on the keyword “contract” and all emails containing this keyword will be put on hold, no matter in which mailbox they are. That’s why a mailbox could be subject to several holds at the same time (ex: for the keywords “contract” and “credit card”). And that’s particular useful, since it wouldn’t be wise to simply put all mailboxes on litigation hold (due to performance problems). What we could do, for example, is put the mailbox of the CEO on litigation hold and create other in-place holds using keywords. In this case Exchange Online would immutably preserve all email in the CEO’s mailbox and all e-mails (no matter in which mailbox) that contain the defined keywords.

A final question would then be: Ok, I created holds, but how to I access those e-mails? And here, in-place eDiscovery joins the compliance game! In Exchange Online, the in-place eDiscovery feature is integrated with the in-place hold feature. So you use a common wizard to perform a search and place a hold based on that specific search criteria. Then, as long as you don’t delete that search, new emails matching that criteria will be preserved.

Let’s take a look in my Exchange Online Admin Center. As we can see, I performed the highlighted search on February 15th:

ediscovery2

But when I preview the results I can see also emails from last Monday, July 25th:

results

So this seems to be working well.

We hope that this post helped shedding some light on these very important compliance features in Exchange Online. Please don’t hesitate to leave us a comment if you have any questions or if you would like to add anything to this information.

 

Comments (4)

  1. Is there a way to enable Litigation Hold only for the Archive Mailbox? Thanks Christian Schindler

    1. Thanks for the question. Unfortunately, there is no way to put only the archive mailbox on litigation hold. The PowerShell cmdlet to enable litigation hold can only be executed on the primary mailbox. It applies then for the archive mailbox too, if one exists. Also if we are in a hybrid environment and a users has his primary mailbox on premises and the archive in Exchange Online, the online archive is placed on hold too. However, there is no way to enable it only for the archive,

  2. Phil Brett says:

    Is there a storage limit to litigation hold in Exchange Online? Setting all users to litigation hold permanently for compliance reasons used to be an issue with on-prem Exchange.
    Cheers, Phil

    1. Hi Phil,

      Thank you for your question.
      First of all we need to clarify the architecture behind. Litigation Hold (and In Place Hold also) preserves items in the Recoverable Items folder in the user’s mailbox. The default size for this folder is 30 GB. Depending on number and size of items deleted or modified, the size of the Recoverable Items folder of the mailbox may increase quickly. The Recoverable Items folder is configured with a high quota by default. We recommend that you monitor mailboxes that are placed on Litigation Hold on a weekly basis to ensure they don’t reach the limits of the Recoverable Items quotas.

      Now, the Recoverable Items quota in Exchange Online for mailboxes that are not placed on litigation hold or in-place hold is 30 GB.
      However, for mailboxes placed on any type of hold this quota is 100 GB. That’s why it would is recommended to use in-place holds, that can be very granular, instead of placing all mailboxes on litigation hold.

      Hope this helps

      Cheers

Skip to main content