In-Place Archive, In-Place Hold, Litigation Hold and In-place eDiscovery in Exchange Online

Exchange Online comes with a huge set of compliance features that enable Office 365 organisations to stay in control of their data and to meet legal an regulatory requirements specific for the countries they operate in. Features like litigation hold, in-place hold and eDiscovery are the cornerstones for compliance in Exchange Online. However, we see very often that people (IT admins included) make a lot of confusions between these features. And to make everything even worse, we also have an In-Place Archive, which is often associated with In-Place Hold due to the similar name. So in this blog post we want to shed some light on all these concepts. Sure you can find a TechNet documentation for each of this topics, but what we want to do is more like a synopsis; putting everything in one place so that we can spot the differences more easily.

So let's start with the "stranger". In-Place archive provides additional storage space for mailbox data. This is achieved by adding a secondary archive mailbox (called In-Place archive) to each user's primary mailbox once this feature is activated by an administrator. Users can then move emails from their primary mailbox to the archive mailbox and vice versa. The size of such an archive mailbox is virtually unlimited (limit is set to 100 GB initially, but can be raised by 70 GB by Office 365 support) for the E3, E5 plans. So, simply put, In-Place Archive is about email storage and not about compliance.

In-place hold and litigation hold are similar things. That's why the are treated in a single TechNet article. However, this is also the reason why confusion is generated. When a reasonable expectation of litigation exists, organizations are required to preserve electronically stored information (ESI), including email that's relevant to the case. This expectation often exists before the specifics of the case are known, and preservation is often broad. Organizations may need to preserve all email related to a specific topic or all email for certain individuals. And we can achieve this using in-place hold and litigation hold. 

So what's the difference? Litigation hold is normally used when you want to put an entire mailbox on hold. You can achieve this either using EAC, or PowerShell with: Set-Mailbox bsuneja@contoso.com -LitigationHoldEnabled $true. So this is an operation that you perform directly on a mailbox.

In-place hold, on the other side, is a little bit more about fine tuning, because it allows administrators to create hold based on different criteria, like keywords. In this scenario a created in-place hold could span across elements in several mailboxes at a time. For example, you can create an in-place hold on the keyword "contract" and all emails containing this keyword will be put on hold, no matter in which mailbox they are. That's why a mailbox could be subject to several holds at the same time (ex: for the keywords "contract" and "credit card"). And that's particular useful, since it wouldn't be wise to simply put all mailboxes on litigation hold (due to performance problems). What we could do, for example, is put the mailbox of the CEO on litigation hold and create other in-place holds using keywords. In this case Exchange Online would immutably preserve all email in the CEO's mailbox and all e-mails (no matter in which mailbox) that contain the defined keywords.

A final question would then be: Ok, I created holds, but how to I access those e-mails? And here, in-place eDiscovery joins the compliance game! In Exchange Online, the in-place eDiscovery feature is integrated with the in-place hold feature. So you use a common wizard to perform a search and place a hold based on that specific search criteria. Then, as long as you don't delete that search, new emails matching that criteria will be preserved.

Let's take a look in my Exchange Online Admin Center. As we can see, I performed the highlighted search on February 15th:

ediscovery2

But when I preview the results I can see also emails from last Monday, July 25th:

results

So this seems to be working well.

We hope that this post helped shedding some light on these very important compliance features in Exchange Online. Please don't hesitate to leave us a comment if you have any questions or if you would like to add anything to this information.