Archiving, eDiscovery, and preservation in Office 365 Education

Here is a common archiving/eDiscovery/compliance FAQ I put together based on several education customer discussions:

If I currently have a 3rd party on-premises archiving solution does Exchange in-place archiving in Office 365 do the same thing?

No, it is not an exact match of functionality since we have more granular capabilities in Exchange Online where we break out archival of email (Exchange In-Place Archiving) from the preservation of email (Exchange In-Place Hold).

As you can imagine because we are more granular in capabilities, this is the an area which leads to quite a bit of confusion for everyone since there are multiple definitions of Exchange “archiving”. These two capabilities can be complementary or separate if need be where in a lot of on premises Exchange archiving solutions they are one in the same.

Exchange Online’s In-Place archiving is separate ‘mailbox’ for storing older email to be archived. The best analogy about Exchange In-Place Archiving is this is a server side/cloud based PST. You can delete mail from your PST on premises and the same is true for Exchange in-place archiving. 

In-Place Archive mailbox end user OWA view

If the your goal is to achieve PRESERVATION of email (e.g. 3 year retention) which is what 99.9% of customers are looking for when replacing their older 3rd party Exchange archiving solution than the only way to accomplish this is with Exchange In Place Hold. This will preserve content in both primary mailbox and in-place Archive mailbox as well as Lync conversations.

Determining if a mailbox has an Exchange In-Place Hold. PowerShell can also be used for bulk enablement.

What is the difference between ‘Litigation Hold’ and ‘Exchange In-place Hold’?

This is another area that has created confusion for several customers.  Exchange Litigation Hold is legacy functionality from Exchange 2010 and Exchange In-Place Hold is new functionality from Exchange 2013 or the new Exchange Online.

The recommendation is the leverage Exchange In-place hold over Litigation Hold as it provides more granular functionality such as time based holds, etc. It is also a good idea to mention you want to enable ‘In-place hold’ over ‘litigation hold’ to avoid enabling legacy features by accident.

Litigation hold remains only to support migration from 2010 litigation hold mailboxes to the new Exchange Online.  See differences here under ‘In-Place Hold and Litigation Hold’.

What components do I get with add-on Exchange Online Archiving SKU with Office 365?

You get two features with the EOA add-on SKU for Office 365:

• Exchange In-Place Hold  - see here fore more info
• Unlimited Exchange In-Place Archiving – see here for more info

You can also get this functionality with the Exchange Plan 2 license as well as the A3 license.  See here and here for more info on licensing options.

Are my Exchange Online unlimited in-place archives tamper proof and preserved by default?

Not by default. Unlimited Exchange In-place Archives mean the archive mailbox is unlimited in size (100 GB default but can be increased to a larger size via escalation) and unlimited in retention duration.  If a retention policy is created to archive mail every 180 days, for example, mail is moved from the primary mailbox to the archive mailbox however it is NOT preserved and mail can be altered in those archives.  Any mail in the in place archive can be found using in place eDiscovery and also can be found in the Outlook 2010+ or OWA browser as well. This allows for easy discoverability and clean end user access to their archived email.

To preserve and prevent tampering of these In-place Archives in the In-Place Archive mailbox or mail which is in the primary mailbox, you must enable Exchange In-Place hold on the mailboxes in question.  This will log any alterations and preserve any emails deleted from the primary or archive mailbox.

 

How many eDiscovery types are in Office 365? What licenses do I need for it or them?

Two types.  Exchange In-Place eDiscovery using Exchange Administration Console and eDiscovery Center as part of SharePoint Online.  Exchange in place eDiscovery is included with the A2 license for both admin console and for searches and SharePoint eDiscovery Center requires A3 license for both admin queries and for the users which are searched.

Exchange In-Place eDiscovery console  more on this here

SharePoint eDiscovery Center – more on this here

Are there any limits on eDiscovery search size in Exchange Online? If yes, how do you get around it?

Yes, Exchange in-place eDiscovery is capped at 5,000 mailboxes for search size using the EAC GUI. We designed this to be for smaller searches on average we found most customers search no more than 20 mailboxes at a time.  If a customer wants more than 5000 they must use PowerShell to query larger mailbox sets. See here for search-mailbox options.

SharePoint eDiscovery search also has limits of 100 SharePoint sources, 1500 exchange sources, and 500 keywords.

What are the four “in-place” compliance/retention features in Office 365? What licenses do I need for each? What does each one do?

I put together a matrix to help with this:

Where can I learn more details on these topics discussed above?

This is a great starting site here. It has very useful videos walking through the Exchange In-Place components discussed above.

See here and here for more details on archiving and retention.

More on SharePoint In-Place Hold and eDiscovery see here.

Best reference I have seen for limits and licensing on eDiscovery is here.

Comments

• Anonymous
  January 01, 2003
  Gilbert, if you remove an in place hold license such as A3 from a mailbox and replace it with A2 it will not preserve the email after that point. If you remove the mailbox you can preserve the content if you make the mailbox inactive see the steps here:http://technet.microsoft.com/library/dn144876(v=exchg.150).aspx
• Anonymous
  January 08, 2014
  Pingback from Review: Microsoft Office 365 vs. Google Apps | Techbait Tech News
• Anonymous
  May 12, 2014
  What if i remove the user's license that had been "in place hold" what will happen to the user's mail database? will the database be deleted, how long it will last? what will be the significance effect of removing the license??
  
  
• Anonymous
  September 10, 2014
  Is there a message rate limit on how many emails per mailbox can be collected during an ediscovery? I've been told only 30 emails/minute. if that is true, is there a way around it? thanks
• Anonymous
  April 07, 2015
  Can you please update this - Microsoft released information last week that you can now do up to 10,000 mailboxes in a search instead of 5,000..
• Anonymous
  May 29, 2015
  This is a very common question I get from customers and also they want to know how they can globally