Exchange Online archiving and litigation hold

Exchange Online has three overlapping mechanisms for keeping mail longer than a user might want to keep it: archive mailboxes, Purview retention policies, and holds (litigation, eDiscovery, in-place). Knowing which to reach for matters for compliance and capacity.

Archive mailboxes

A user's primary mailbox is 50 or 100 GB. The archive mailbox is a second mailbox that extends that — same user, accessed in Outlook as a separate folder tree. Once enabled (and on plans that support auto-expanding archive, up to 1.5 TB):

• Older items can be moved automatically by the default Messaging Records Management (MRM) policy.
• Users can drag items into the archive themselves.
• Archive content is searchable in Outlook and in Purview.

Archive isn't about compliance — it's primarily a capacity tool for users with very large mailbox histories.

Purview retention policies

Retention policies in Microsoft Purview keep content for a defined period and (optionally) delete it at the end. Applied to Exchange:

• They preserve content even if a user deletes it — items go to a hidden preservation hold folder.
• They can scope to specific mailboxes (manually or via adaptive scopes).
• They define retain only, delete only, or retain then delete.

Retention policies are the modern way to enforce email retention. They replace older Exchange-specific retention tags for most scenarios.

Holds

Holds preserve content for legal or investigation purposes:

• Litigation hold preserves all content in a mailbox indefinitely (or for a set period). Users can still delete items in the UI — content stays in preservation hold and is recoverable.
• eDiscovery hold is per-case and per-custodian, preserving only content relevant to a specific eDiscovery case.
• In-place hold is the legacy version, being retired in favour of the above.

Holds override retention policies — held content can't be deleted by retention.

How they layer

A mailbox can have a 7-year retention policy, be on litigation hold, and have an enabled archive — all at once. Each system is checked independently before any deletion. Effectively, the strictest preservation wins.

Operational watchpoints

• Preservation hold can grow surprisingly large. Monitor mailbox size in reports.
• Removing a hold doesn't immediately delete preserved content — retention still applies.
• Holds survive offboarding: a held mailbox becomes an inactive mailbox, retained without a licence until the hold is released.

For most tenants: a Purview retention policy at 7 years, plus litigation hold on accounts under investigation, plus archive mailboxes for power users. Document the policy and revisit it annually.

Why "the strictest preservation wins" matters operationally

Because holds, retention policies, and archive settings all evaluate independently and the strictest outcome always governs, an admin trying to reduce mailbox size by shortening a retention policy can be genuinely confused when preserved content doesn't shrink — a litigation hold placed on that mailbox six months ago for an unrelated matter is silently overriding the shorter retention period, and nothing in the retention policy's own configuration screen will show that. The practical habit this creates: before troubleshooting "why is this mailbox still huge despite our retention policy," check for an active hold on that specific mailbox first, since it's a more common explanation than a retention policy misconfiguration.

Frequently asked questions

Does putting a mailbox on litigation hold notify the user? No — litigation hold is silent by default; the user's day-to-day experience of deleting items is unchanged, which is deliberate for internal-investigation scenarios, though a formal litigation matter may separately require a legal hold notification process (handled through eDiscovery Premium) specifically so the custodian is informed and can acknowledge the preservation obligation.

What happens to archive mailbox content when a user is offboarded? It follows the same path as the primary mailbox — if the account becomes an inactive mailbox under a hold or retention policy, the archive's content is preserved and searchable right alongside the primary mailbox's, not treated as a separate retention scope that needs its own configuration.