Exchange Online increases eDiscovery mailbox limit and boasts better performance too

The Office 365 Roadmap is a great place to look for information about what’s coming up in the cloud-based versions of the Office servers and potentially new versions of their on-premises counterparts. Browsing the “Rolling Out” section recently, I noticed that an entry saying “Exchange eDiscovery mailbox search limit increased to 10K mailboxes,” which prompted some investigation.

Exchange 2013 and Exchange Online share the Search Foundation with SharePoint. The introduction of the Search Foundation led to a reduction in the number of mailboxes that you could include in a single eDiscovery search. Exchange 2010 can search up to 25,000 mailboxes in a single operation and you can update the system registry to increase this limit at the expense of using additional memory.

By default, Exchange 2013 on-premises servers can only include 5,000 mailboxes in an eDiscovery search, which means that you have to split up mailboxes into separate searches if this maximum is met. Clearly this is an inconvenience and a regression in functionality when compared to Exchange 2010, albeit in the realization that Exchange 2010 operates a somewhat simpler search regime (it doesn’t include public folders for instance).

Exchange 2013 is even more of a resource hog than its predecessors. The introduction of the Search Foundation is one of the reasons why Exchange 2013 uses more memory and CPU than before and I imagine that Microsoft was pretty cautious about allowing eDiscovery searches to go higher than 5,000 mailboxes.

You can change the default throttling policy to increase the number of mailboxes that can be searched by Exchange 2013. However, I don’t know of anyone who has managed to successfully change the policy to allow Exchange 2013 to search 25,000 mailboxes in a single operation. I’d love to hear of anyone who has managed to do this and to learn what effect the change had on overall system performance.

But different rules apply within Office 365 because Microsoft controls the entire environment. It’s also true that substantially more hard performance data now exists about how Exchange 2013 and the Search Foundation operate in production. All of which means that Microsoft is now happy for Exchange Online eDiscovery searches to span up to 10,000 mailboxes. You can't change the throttling policy to increase this number for Exchange Online.

The same limit applies to the maximum number of mailboxes that can be placed on in-place hold within an eDiscovery search. Behind the scenes, the Information Store does a reasonable amount of processing to ensure that items subject to an in-place hold don’t disappear from user mailboxes covered by the hold.

Coming back to the Office 365 roadmap, I was interested to note the assertion that “the speed of eDiscovery search queries against large number of mailboxes is improved by 10x and the reliability of these searches has also been improved.” Quite. It’s hard to prove that a search really is ten times faster so all I can say is that search results do seem to be returned faster. In fact, you might not have time to go and get a cup of coffee while waiting for a search to complete. As to the statement on reliability, I wasn’t aware that searches weren’t so reliable before, but it’s good to know that all is now well.

A casual browse of an Internet search for blogs and other articles about Exchange 2013 eDiscovery searches indicates that this is not an area that has been as well explored as other parts of the product (this post is a good one for those moving from Exchange 2010). But then again, perhaps people don’t like to discuss the kind of eDiscovery searches that they are running. After all, some of those searches might be a tad embarrassing…

Follow Tony@12Knocksinna