Exchange Online archiving and litigation hold
How Exchange Online keeps mail beyond the primary mailbox — archive mailboxes, retention, and legal hold.
Exchange Online has three overlapping mechanisms for keeping mail longer than a user might want to keep it: archive mailboxes, Purview retention policies, and holds (litigation, eDiscovery, in-place). Knowing which to reach for matters for compliance and capacity.
Archive mailboxes
A user's primary mailbox is 50 or 100 GB. The archive mailbox is a second mailbox that extends that — same user, accessed in Outlook as a separate folder tree. Once enabled (and on plans that support auto-expanding archive, up to 1.5 TB):
- Older items can be moved automatically by the default Messaging Records Management (MRM) policy.
- Users can drag items into the archive themselves.
- Archive content is searchable in Outlook and in Purview.
Archive isn't about compliance — it's primarily a capacity tool for users with very large mailbox histories.
Purview retention policies
Retention policies in Microsoft Purview keep content for a defined period and (optionally) delete it at the end. Applied to Exchange:
- They preserve content even if a user deletes it — items go to a hidden preservation hold folder.
- They can scope to specific mailboxes (manually or via adaptive scopes).
- They define retain only, delete only, or retain then delete.
Retention policies are the modern way to enforce email retention. They replace older Exchange-specific retention tags for most scenarios.
Holds
Holds preserve content for legal or investigation purposes:
- Litigation hold preserves all content in a mailbox indefinitely (or for a set period). Users can still delete items in the UI — content stays in preservation hold and is recoverable.
- eDiscovery hold is per-case and per-custodian, preserving only content relevant to a specific eDiscovery case.
- In-place hold is the legacy version, being retired in favour of the above.
Holds override retention policies — held content can't be deleted by retention.
How they layer
A mailbox can have a 7-year retention policy, be on litigation hold, and have an enabled archive — all at once. Each system is checked independently before any deletion. Effectively, the strictest preservation wins.
Operational watchpoints
- Preservation hold can grow surprisingly large. Monitor mailbox size in reports.
- Removing a hold doesn't immediately delete preserved content — retention still applies.
- Holds survive offboarding: a held mailbox becomes an inactive mailbox, retained without a licence until the hold is released.
For most tenants: a Purview retention policy at 7 years, plus litigation hold on accounts under investigation, plus archive mailboxes for power users. Document the policy and revisit it annually.