Exchange Online Litigation Hold vs. In-Place Hold: How to Choose for eDiscovery

The decision: mailbox-wide preservation or targeted holds

When legal or compliance asks you to preserve a user's email in Exchange Online, you have two built-in mailbox-level mechanisms: Litigation Hold and In-Place Hold. Both stop items from being permanently deleted — even when the user empties Deleted Items or a retention policy would purge content — but they differ sharply in scope, administration effort, and flexibility.

The short version: use Litigation Hold when everything in the mailbox must be preserved indefinitely with minimal administration. Use In-Place Hold when you need to preserve only a query-defined subset of content, for a defined duration, or under multiple overlapping cases. One important caveat before you start: Microsoft has been steering customers toward Microsoft Purview eDiscovery holds (applied from the Purview compliance portal) as the long-term replacement for Exchange-based In-Place Holds, and has announced deprecation of the older tooling. Verify the current status in the Microsoft 365 message center before building new processes on In-Place Hold.

How the two options compare

Criterion	Litigation Hold	In-Place Hold
Scope	Entire mailbox — all folders, all item types	Whole mailbox or filtered by query (keywords, dates, senders, item types)
Duration	Indefinite, or a fixed number of days from when items were received/created	Per-hold duration relative to item age
Multiple concurrent holds	No — one setting per mailbox	Yes — a mailbox can be under several holds at once
Administration	Single mailbox property (LitigationHoldEnabled)	Requires creating and managing hold objects and linking them to mailboxes
Storage impact	High — preserves everything, including content the user deletes	Lower if query-scoped; only matching items are preserved
Typical use case	Employee under active litigation; executives under blanket retention requirements	Specific investigations; time-boxed preservation of relevant content only
Release behavior	Removing the hold releases everything at once	Individual holds can be removed without affecting others on the same mailbox

Trade-offs that matter in practice

Storage growth. Litigation Hold preserves every item, including deletions, for as long as the hold is active. Items a user "deletes" move into hidden recoverable-items folders and stay there. On busy mailboxes this adds up quickly, and if the Recoverable Items quota is exceeded, preservation itself can fail — so monitor quota usage on held mailboxes and plan archive mailboxes where needed.

Granularity vs. simplicity. In-Place Hold's query filtering sounds attractive, but a poorly constructed query can miss content the legal team assumed was preserved. Litigation Hold's all-or-nothing scope is blunt but defensible: there is no query to get wrong.

Overlapping cases. If a mailbox is subject to two separate investigations with different custodians and timelines, In-Place Hold lets each case attach its own hold; releasing one case doesn't disturb the other. With Litigation Hold you get one switch, so coordinating multiple matters on the same mailbox is harder.

Migration risk. Switching a mailbox from one hold type to another is not atomic. If you remove Litigation Hold before the replacement hold is fully applied, items can become eligible for permanent deletion in the gap. Always apply the new hold first, verify it, and only then remove the old one — and pilot the sequence on a test mailbox.

Implementation: enable Litigation Hold with PowerShell

Run these commands in Exchange Online PowerShell (the ExchangeOnlineManagement module) connected with an account holding the Recipient Management or eDiscovery Manager role. Replace the placeholder identity with the target user's UPN.

Connect-ExchangeOnline -UserPrincipalName [contact removed]

# Enable Litigation Hold with an optional duration (in days)
Set-Mailbox -Identity "[contact removed]" -LitigationHoldEnabled $true `
    -LitigationHoldDuration 2555

# Optionally record who placed the hold and why
Set-Mailbox -Identity "[contact removed]" `
    -LitigationHoldOwner "[contact removed]"

Omit -LitigationHoldDuration for an indefinite hold. The duration is measured from the date items were received or created, not from when the hold was enabled.

Implementation: query-based In-Place Hold

In-Place Holds are created through an In-Place eDiscovery & Hold object. The example below preserves only items containing a project keyword, received within a date range.

New-MailboxSearch -Name "Case-ProjectFalcon-Hold" `
    -SourceMailboxes "[contact removed]" `
    -SearchQuery 'subject:"Project Falcon" AND received>=01/01/2026 AND received<=06/30/2026' `
    -InPlaceHoldEnabled $true `
    -ItemHoldPeriod 365

-ItemHoldPeriod is in days; omit it for an indefinite hold. Note that New-MailboxSearch with holds is part of the older Exchange eDiscovery toolset — confirm it is still supported in your tenant, and prefer Purview eDiscovery (Standard or Premium) holds for new cases where your licensing allows.

Verification

Don't assume a hold applied silently. Check both the property state and the effective hold:

Get-Mailbox -Identity "[contact removed]" |
    Select-Object DisplayName, LitigationHoldEnabled, LitigationHoldDuration,
                  LitigationHoldOwner, InPlaceHolds

Expect LitigationHoldEnabled : True for the first example. For In-Place Holds, the InPlaceHolds property lists hold identifiers (prefixed with a hold type code) that you can match back to the mailbox search object with Get-MailboxSearch "Case-ProjectFalcon-Hold" | Select-Object Name, Status, InPlaceHoldEnabled. In the Exchange admin center, the same status appears under Recipients > Mailboxes > select the user > hold settings.

A functional check: sign in as the held user (or use a test mailbox under the same hold), delete an item, empty Deleted Items, then run an eDiscovery content search against the mailbox. The deleted item should still be returned. If it isn't, the hold is not preserving content as intended.

Limitations and cautions

• Neither hold type prevents users from editing or deleting items in their view — preservation happens in hidden folders, so the user experience is unchanged.
• Hold application is not instantaneous; allow time for the change to propagate before assuming preservation is active.
• Removing a hold makes previously preserved content eligible for deletion again, subject to retention policies and the recoverable-items window. Coordinate release with legal counsel.
• Exchange-based In-Place Hold tooling is being retired in favor of Purview eDiscovery. Treat any new In-Place Hold design as a candidate for Purview holds instead, and confirm current deprecation timelines in the message center before rollout.