Important Information about Group Expansion for In-Place Holds

Exchange 2013, Exchange 2016, and Exchange Online in Office 365 all support In-Place Hold. In-Place Hold allows compliance administrators to retain specific data in Exchange for eDiscovery in an immutable fashion.

In-Place Hold differs from Litigation Hold in a few key ways. Litigation Hold allows you to hold all contents of one or more mailboxes. In-Place Hold allows you to define what data to hold (keywords, specific senders/recipients, and start/end dates, and the types of data, such as emails or calendar items). Both In-Place and Litigation Hold allow you to specify how long to hold this data.

When you configure a new In-Place Hold you have the option to place a group on hold. You need to be aware that group membership is expanded at the time the In-Place Hold is created, and the sources of the In-Place Hold do not automatically adjust if the group membership changes.

For example, I'll create an In-Place Hold for the members of Keith's Group.

Creating a new In-Place Hold for members of Keith's Group

I configure the search parameters, enable the In-Place Hold, and click Finish. Exchange then displays the following warning:

To enable In-Place Hold for the mailbox search, the distribution groups specified in the "Source mailboxes" field must be expanded. The task can expand the group members and save the expanded mailboxes as the source mailboxes of the mailbox search. Do you want to expand the group?

You have to click OK to continue. If you click Cancel it will not save the In-Place Hold.

Warning about group expansion

If you edit the new In-Place hold you will see that Keith's Group has been replaced with the members of the group at the time the In-Place hold was created.

Expanded group

There is no longer any link between Keith's Group and the new In-Place Hold sources. If the group membership changes, you will need to edit the mailbox sources for the In Place Hold manually.

Note that this expansion behavior is the same, whether you use distribution groups, mail-enabled security groups, or dynamic distribution groups.