In-Place Archive, In-Place Hold, Litigation Hold and In-place eDiscovery in Exchange Online


Exchange Online comes with a huge set of compliance features that enable Office 365 organisations to stay in control of their data and to meet legal an regulatory requirements specific for the countries they operate in. Features like litigation hold, in-place hold and eDiscovery are the cornerstones for compliance in Exchange Online. However, we see very often that people (IT admins included) make a lot of confusions between these features. And to make everything even worse, we also have an In-Place Archive, which is often associated with In-Place Hold due to the similar name. So in this blog post we want to shed some light on all these concepts. Sure you can find a TechNet documentation for each of this topics, but what we want to do is more like a synopsis; putting everything in one place so that we can spot the differences more easily.

So let's start with the "stranger". In-Place archive provides additional storage space for mailbox data. This is achieved by adding a secondary archive mailbox (called In-Place archive) to each user's primary mailbox once this feature is activated by an administrator. Users can then move emails from their primary mailbox to the archive mailbox and vice versa. The size of such an archive mailbox is virtually unlimited (limit is set to 100 GB initially, but can be raised by 70 GB by Office 365 support) for the E3, E5 plans. So, simply put, In-Place Archive is about email storage and not about compliance.

In-place hold and litigation hold are similar things. That's why the are treated in a single TechNet article. However, this is also the reason why confusion is generated. When a reasonable expectation of litigation exists, organizations are required to preserve electronically stored information (ESI), including email that's relevant to the case. This expectation often exists before the specifics of the case are known, and preservation is often broad. Organizations may need to preserve all email related to a specific topic or all email for certain individuals. And we can achieve this using in-place hold and litigation hold. 

So what's the difference? Litigation hold is normally used when you want to put an entire mailbox on hold. You can achieve this either using EAC, or PowerShell with: Set-Mailbox bsuneja@contoso.com -LitigationHoldEnabled $true. So this is an operation that you perform directly on a mailbox.

In-place hold, on the other side, is a little bit more about fine tuning, because it allows administrators to create hold based on different criteria, like keywords. In this scenario a created in-place hold could span across elements in several mailboxes at a time. For example, you can create an in-place hold on the keyword "contract" and all emails containing this keyword will be put on hold, no matter in which mailbox they are. That's why a mailbox could be subject to several holds at the same time (ex: for the keywords "contract" and "credit card"). And that's particular useful, since it wouldn't be wise to simply put all mailboxes on litigation hold (due to performance problems). What we could do, for example, is put the mailbox of the CEO on litigation hold and create other in-place holds using keywords. In this case Exchange Online would immutably preserve all email in the CEO's mailbox and all e-mails (no matter in which mailbox) that contain the defined keywords.

A final question would then be: Ok, I created holds, but how to I access those e-mails? And here, in-place eDiscovery joins the compliance game! In Exchange Online, the in-place eDiscovery feature is integrated with the in-place hold feature. So you use a common wizard to perform a search and place a hold based on that specific search criteria. Then, as long as you don't delete that search, new emails matching that criteria will be preserved.

Let's take a look in my Exchange Online Admin Center. As we can see, I performed the highlighted search on February 15th:

ediscovery2

But when I preview the results I can see also emails from last Monday, July 25th:

results

So this seems to be working well.

We hope that this post helped shedding some light on these very important compliance features in Exchange Online. Please don't hesitate to leave us a comment if you have any questions or if you would like to add anything to this information.

 

Comments (6)

  1. Is there a way to enable Litigation Hold only for the Archive Mailbox? Thanks Christian Schindler

    1. Thanks for the question. Unfortunately, there is no way to put only the archive mailbox on litigation hold. The PowerShell cmdlet to enable litigation hold can only be executed on the primary mailbox. It applies then for the archive mailbox too, if one exists. Also if we are in a hybrid environment and a users has his primary mailbox on premises and the archive in Exchange Online, the online archive is placed on hold too. However, there is no way to enable it only for the archive,

  2. Phil Brett says:

    Is there a storage limit to litigation hold in Exchange Online? Setting all users to litigation hold permanently for compliance reasons used to be an issue with on-prem Exchange.
    Cheers, Phil

    1. Hi Phil,

      Thank you for your question.
      First of all we need to clarify the architecture behind. Litigation Hold (and In Place Hold also) preserves items in the Recoverable Items folder in the user's mailbox. The default size for this folder is 30 GB. Depending on number and size of items deleted or modified, the size of the Recoverable Items folder of the mailbox may increase quickly. The Recoverable Items folder is configured with a high quota by default. We recommend that you monitor mailboxes that are placed on Litigation Hold on a weekly basis to ensure they don't reach the limits of the Recoverable Items quotas.

      Now, the Recoverable Items quota in Exchange Online for mailboxes that are not placed on litigation hold or in-place hold is 30 GB.
      However, for mailboxes placed on any type of hold this quota is 100 GB. That's why it would is recommended to use in-place holds, that can be very granular, instead of placing all mailboxes on litigation hold.

      Hope this helps

      Cheers

  3. Tom Bedell says:

    When I try to add a new mailbox to a 3 year hold I'm running into an ominous message that tells me "Removing the hold from this inactive mailbox could result in the mailbox being permanently deleted if this is the last hold on this mailbox. Do you still want to remove the hold for this inactive mailbox?" What's going on with this, if you know? Is there a different/better way to update the hold when I have a new mailbox to add? I'm currently forced to remove the mailboxes and re-add them all every time there's a new mailbox added but this is the first time we've seen this dialog. I'd be grateful for any insight you have, Dan.

    Have a good day.

    Regards,

    Tom

    1. Hi Tom,

      Thank you for sharing your question. Surely it is a useful one and gave me the idea to write a new blog post on it. However, this will have to wait until the first days of May, since I'm a lot on the road. You receive that dialogue, because at least one mailbox in that specific hold is an inactive mailbox. We consider a mailbox inactive when there is no Azure AD user associated to it. This happens, for instance, if a user leaves the company and admins remove the user. If the mailbox is on hold, then the mailbox data will be preserved and the mailbox is considered as being inactive. If you remove the hold that basically preserve that mailbox from deletion, then that specific mailbox will get deleted. So you have o be careful with that.
      Fortunately, we can edit existing holds via PowerShell. We can either add new mailboxes or or remove mailboxes from an existing hold. Using this procedure should avoid the process of always re-creating the hold. Hope this helps.

      Cheers,
      Dan

Skip to main content