Since the early days of In-Place Hold, the number floating around (and documented) is a maximum of five In-Place Holds before Exchange holds all content, but it’s incorrect.
See the Updates section at the bottom of this article for the latest.
In Exchange 2013 and Exchange Online, you can use In-Place Hold to place messages (and other items, including archived Skype for Business/Lync conversations) on hold indefinitely or for a specified period. The two major benefits of In-Place Hold:
- Query-based hold: In-Place Hold allows you to specify query parameters and place a hold on items that match the query.
- Multiple holds: You can place a mailbox (user) on multiple In-Place Holds, often a requirement to manage holds for different cases or investigations.
Figure 1 Use an In-Place hold to preserve mailbox content
One of the limits I listed in eDiscovery Limits and Throttling Policies in Exchange Server and Office 365 is the maximum number of In-Place Holds you can place on a mailbox. You can find the Office 365/Exchange Online eDiscovery limits in Search limits for In-Place eDiscovery in Exchange Online.
| Description of limit | Limit | More info and workarounds |
|---|---|---|
| The maximum number of In-Place Holds that can be placed on a single mailbox. | 5 |
If more than five In-Place Holds are placed on a mailbox, then all content in that mailbox is placed on hold (and not just the content that matches the search criteria of any query-based hold.) All content is held until the total number of holds on a mailbox is reduced to five or less. Holding all mailbox content is similar in functionality to a Litigation Hold. |
| The maximum number of keywords that can be specified in all In-Place Holds placed on a single mailbox. | 500 |
If multiple In-Place Holds are placed on a user’s mailbox, the maximum number of keywords in all search queries is 500. That’s because Exchange Online combines all the keyword search parameters from of all In-Place Holds by using the OR operator. If there are more than 500 keywords in the hold queries, then all content in the mailbox is placed on hold (and not just that content that matches the search criteria of any query-based hold). All content is held until the total number of keywords in all In-Place Holds is reduced to 500 or less. Holding all mailbox content is similar in functionality to a Litigation Hold. |
When processing items to permanently delete them from a mailbox, the Email Lifecycle Assistant (aka the Managed Folder Assistant or MFA – you may have seen some old error messages refer to it as ELC assistant) must evaluate each item against the query parameters in each In-Place Hold. If a user is placed on more than a few In-Place Holds, it becomes resource-intensive to evaluate each item against the query parameters in each hold.
Since the early days of In-Place Hold, it’s been documented as five In-Place Holds. After some testing and digging, I can confirm it’s incorrect and the documentation is being updated.
As documented, the evaluation isn’t sequential. It happens in parallel by using the OR operator to combine multiple queries. For example, if one query is (patent AND filing) and another one is (Tailspin OR Contoso), the two queries are combined for evaluation purposes so the actual evaluation done is (patent AND filing) OR (Tailspin OR Contoso), and so on for each additional In-Place Hold. The operators (AND, OR, NOT, etc.) are not considered keywords.
The actual limit for In-Place Holds before they’re treated as Litigation Hold (all content is on hold) is a maximum of 500 keywords in all queries combined.
Updates
8/3/2016: In-Place Hold and Litigation Hold has been updated to state the following:
You can use In-Place Hold to place a user on multiple holds. When a user is placed on multiple holds, the search queries from any query-based hold are combined (with OR operators). In this case, the maximum number of keywords in all query-based holds placed on a mailbox is 500. If there are more than 500 keywords, then all content in the mailbox is placed on hold (not just that content that matches the search criteria). All content is held until the total number of keywords is reduced to 500 or less.
The following hold limit has been removed from Search limits for In-Place eDiscovery in Exchange Online:
| Description of limit | Limit | More info and workarounds |
|---|---|---|
| The maximum number of In-Place Holds that can be placed on a single mailbox. | 5 |
If more than five In-Place Holds are placed on a mailbox, then all content in that mailbox is placed on hold (and not just the content that matches the search criteria of any query-based hold.) All content is held until the total number of holds on a mailbox is reduced to five or less. Holding all mailbox content is similar in functionality to a Litigation Hold. |
{ 1 comment… read it below or add one }
Thanks for the great and timely clarification, Bharat!
{ 1 trackback }