Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
This article describes the limits in Microsoft Purview eDiscovery.
Tip
Get started with Microsoft Security Copilot to explore new ways to work smarter and faster using the power of AI. Learn more about Microsoft Security Copilot in Microsoft Purview.
Case limits
The following table lists the limits for cases in eDiscovery.
| Description of limit | eDiscovery feature support | Premium eDiscovery feature support |
|---|---|---|
| Maximum number of cases for an organization. | 10,000 | 50,000 |
Case and review set limits
The following table lists the limits for cases and review sets in eDiscovery with premium feature support.
Tip
Want to try premium eDiscovery features? See the subscription requirements for Microsoft 365 Enterprise E5 licensing.
| Description of limit | Premium eDiscovery feature support |
|---|---|
| Total number of documents that can be added to a case (for all review sets in a case). | 40 million |
| Total file size per load set. This limit includes loading non-Office 365 into a review set. | 1 TB |
| Maximum number of load sets per case. | 200 |
| Maximum number of review sets per case. | 20 |
| Maximum number of tag groups per case. | 1,000 |
| Maximum number of unique tags per case. | 1,0001 |
Export limits
The following table lists the limits when exporting the results of a search.
| Description of limit | eDiscovery feature support | Premium eDiscovery feature support |
|---|---|---|
| Maximum amount of exportable data from a single search. | 2 TB1 | 5 TB |
| Maximum an organization can export in a single day.2 | 2 TB | 5 TB |
| Maximum size of PST file that can be exported. | 10 GB3 | 10 GB |
| Maximum size per export package. | 40 GB | 40 GB |
| Maximum number of exports or reports displayed in Content Search or eDiscovery cases. | 1,000 | 2,000 |
| Rate at which content from mailboxes are exported | 2GB per hour per mailbox | 2GB per hour per mailbox |
Note
1If the search results are larger than 200 GB, consider using date ranges, or other types of filters to decrease the total size of the search results. 2This limit is reset daily at 12:00AM UTC. 3If the search results from a user's mailbox are larger than 10 GB, the search results for the mailbox are exported in two (or more) separate PST files. If you choose to export all search results in a single PST file, the PST file is spilt into additional PST files if the total size of the search results is larger than 10 GB.
Hold limits
The following table lists the limits for holds associated with an eDiscovery case.
| Description of limit | eDiscovery feature support | Premium eDiscovery feature support |
|---|---|---|
| Maximum number of hold policies for an organization. | 10,000 | 20,000 |
| Maximum number of mailboxes in a single case hold. This limit includes the combined total of user mailboxes, and the mailboxes associated with Microsoft 365 Groups, Microsoft Teams, and Viva Engage Groups. |
1,000 | 2,000 |
| Maximum number of sites in a single case hold. This limit includes the combined total of OneDrive sites, SharePoint sites, and the sites associated with Microsoft 365 Groups, Microsoft Teams, and Viva Engage Groups. | 100 | 2000 |
Indexing limits
The following table lists the indexing limits in eDiscovery with premium feature support.
Tip
Want to try premium eDiscovery features? See the subscription requirements for Microsoft 365 Enterprise E5 licensing.
| Description of limit | Premium eDiscovery feature support |
|---|---|
| Maximum number of characters extracted from a single file. | 10 million2 |
| Maximum size of a single file. | 150 MB2 |
| Maximum depth of embedded items in a document. | 252 |
| Maximum size of files processed by Optical Character Recognition (OCR). | 24 MB2 |
| Maximum Advanced indexing throughput | 2 GB per hour |
Indexing limits for email messages
The following table describes the indexing limits that might result in an email message being returned as an unindexed item or a partially indexed item in the results of a search.
| Indexing limit | Maximum value | Description |
|---|---|---|
| Maximum attachment size 1 | 150 MB | The maximum size of an email attachment that is parsed for indexing. Any attachment that's larger than this limit won't be parsed for indexing, and the message with the attachment is marked as partially indexed. |
| Maximum number of attachments | 250 | The maximum number of files attached to an email message that is parsed for indexing. If a message has more than 250 attachments, the first 250 attachments are parsed and indexed, and the message is marked as partially indexed because it had additional attachments that weren't parsed. |
| Maximum attachment depth | 30 | The maximum number of nested attachments that are parsed. For example, if an email message has another message attached to it and the attached message has an attached Word document, the Word document and the attached message is indexed. This behavior continues for up to 30 nested attachments. |
| Maximum number of attached images | 0 | An image that's attached to an email message is skipped by the parser and isn't indexed. |
| Maximum time spent parsing an item | 30 seconds | A maximum of 30 seconds is spent parsing an item for indexing. If the parsing time exceeds 30 seconds, the item is marked as partially indexed. |
| Maximum parser output | 2 million characters | The maximum amount of text output from the parser that's indexed. For example, if the parser extracted 8 million characters from a document, only the first 2 million characters are indexed. |
| Maximum annotation tokens | 2 million | When an email message is indexed, each word is annotated with different processing instructions that specify how that word should be indexed. Each set of processing instructions is called an annotation token. To maintain the quality of service in Office 365, there's a limit of 2 million annotation tokens for an email message. |
| Maximum body size in index | 67 million characters | The total number of characters in the body of an email message and all its attachments. When an email message is indexed, all text in the body of the message and in all attachments is concatenated into a single string. The maximum size of this string that is indexed is 67 million characters. |
| Maximum unique tokens in body | 1 million | As previously explained, tokens are the result of extracting text from content, removing punctuation and spaces, and then dividing it into words (called tokens) that are stored in the index. For example, the phrase "cat, mouse, bird, dog, dog" contains five tokens. But only four of these are unique tokens. There's a limit of 1 million unique tokens per email message, which helps prevent the index from getting too large with random tokens. |
Note
1 Parsing is the process where the indexing service extracts text from the attachment, removes unnecessary characters like punctuation and spaces, and then divides the text into words (in a process called tokenization), that are then stored in the index.
Process limits
The following table lists the process limits in eDiscovery.
| Description of limit | eDiscovery feature support | Premium eDiscovery feature support |
|---|---|---|
| Maximum number of concurrent processes in your organization. | 50 | 100 |
| Maximum number of concurrent processes that a single user can start at one time. | 25 | 50 |
| Maximum number of concurrent tenant-wide processes (for example, tenant-wide searches) in your organization. | 5 | 50 |
| Maximum number of concurrent tenant-wide processes (for example, tenant-wide searches) that a single user can start at one time. | 5 | 25 |
| Maximum number of jobs per day in your organization.1 | 500 | 1,000 |
Note
These limits are reset daily at 00:00 UTC.
Review set download limits
The following table lists the review set download limits in eDiscovery with premium feature support.
Tip
Want to try premium eDiscovery features? See the subscription requirements for Microsoft 365 Enterprise E5 licensing.
| Description of limit | Premium eDiscovery feature support |
|---|---|
| Total file size or maximum number of documents downloaded from a review set. | 3 MB or 50 documents5 |
Review set export limits
The following table lists the limits when exporting documents from a review set in eDiscovery with premium feature support.
Tip
Want to try premium eDiscovery features? See the subscription requirements for Microsoft 365 Enterprise E5 licensing.
| Description of limit | Premium eDiscovery feature support |
|---|---|
| Maximum size of a single export. | 5 million documents or 500 GB, whichever is smaller. |
Review set viewer limits
The following table lists the review set viewer limits in eDiscovery with premium feature support.
Tip
Want to try premium eDiscovery features? See the subscription requirements for Microsoft 365 Enterprise E5 licensing.
| Description of limit | Premium eDiscovery feature support |
|---|---|
| Maximum number of items displayed per page in a review set. | 1,000 |
Note
Use default or custom filters to adjust the displayed items in a review set as needed.
Search limits
The following table lists the search limits for Exchange mailboxes and SharePoint sites in eDiscovery with premium feature support.
Tip
Want to try premium eDiscovery features? See the subscription requirements for Microsoft 365 Enterprise E5 licensing.
| Description of limit | Limit |
|---|---|
| Maximum number of locations for a single search.1 | 1000 |
| Maximum number of Sensitive Information Types per search query.2 | 20 |
| Maximum number of participants per search query.2 | 25 |
Note
1 This limit includes the combined total of user mailboxes, and the mailboxes associated with Microsoft 365 Groups, Microsoft Teams, and Viva Engage Groups.
For more information about specific limits, see the following articles:
The following table lists limits for the Export as report and the export search results:
| Description of limit | Limit |
|---|---|
| Total items | 1 million |
| Total locations | 500,000 |
| Exported results (items) | 500,000 |
| Exported results (locations) | 100,000 |
Search times
Microsoft collects performance information for searches run by all organizations. While the complexity of the search query can impact search times, the biggest factor that affects how long searches take is the number of mailboxes searched.
Although Microsoft doesn't provide a Service Level Agreement for search times, the following table lists average search times for collection searches based on the number of mailboxes included in the search.
| Number of mailboxes | Average search time |
|---|---|
| 100 | 30 seconds |
| 1,000 | 45 seconds |
| 10,000 | 4 minutes |
| 25,000 | 10 minutes |
| 50,000 | 20 minutes |
| 100,000 | 25 minutes |
Themes limits
The limits described in this section are related to manually defining the maximum number of themes in settings for a case in eDiscovery with premium feature support.
Tip
Want to try premium eDiscovery features? See the subscription requirements for Microsoft 365 Enterprise E5 licensing.
| Description of limit | Premium eDiscovery feature support |
|---|---|
| Minimum number of the maximum number of defined themes. | 3 |
| Maximum number of defined themes. | 10,000 |
Viewer limits
| Description of limit | Limit |
|---|---|
| Maximum size of an Excel file viewable in the native viewer. | 4 MB |
Reference notes
1 This is the maximum number of tags that you can create in a case. This limit isn't related to the number of tagged documents.
2 Including more than 20 SITs or 25 participants might result in search query timeouts.
3 Any item that exceeds a single file limit shows up as a processing error.
4 When searching SharePoint and OneDrive locations, characters in the URLs of searched sites count against this limit. The total number of characters consists of:
- All characters in both the Users and Filters fields.
- All search permissions filters that apply to the user.
- The characters from any location properties in the search, including ExchangeLocation, PublicFolderLocation, SharPointLocation, ExchangeLocationExclusion, PublicFolderLocationExclusion, SharePointLocationExclusion, and OneDriveLocationExclusion. For example, including all SharePoint sites and OneDrive accounts in the search counts as six characters, as the word "ALL" appears for both the SharePointLocation and OneDriveLocation field.
5 For nonphrase queries (a keyword value that doesn't use double quotation marks) we use a special prefix index. This tells us that a word occurs in a document, but not where it occurs in the document. To do a phrase query (a keyword value with double quotation marks), we need to compare the position within the document for the words in the phrase. This means that we can't use the prefix index for phrase queries. In this case, we internally expand the query with all possible words that the prefix expands to; for example, time* can expand to "time OR timer OR times OR time-x OR time boxed OR ...". The limit of 10,000 is the maximum number of variants the word can expand to, not the number of documents matching the query. There's no upper limit for nonphrase terms.
6 This limit applies to downloading selected documents from a review set. It doesn't apply to exporting documents from a review set. For more information about downloading and exporting documents, see Export reference for eDiscovery.