Limits for Content Search in the Office 365 Security & Compliance Center

Note:  The limits in this topic are different from the current limits for In-Place eDiscovery in Exchange Online and for the eDiscovery Center in SharePoint Online.

Various limits are applied to the Content Search feature in the Office 365 Security & Compliance Center. This include searches run on the Content search page and searches that are associated with an eDiscovery case. These limits help to maintain the health and quality of services provided to Office 365 organizations. There are also limits related to the indexing of email messages in Exchange Online for search. You can't modify the Content Search or email indexing limits, but you should be aware of them so that you can take these limits into consideration when planning, running, and troubleshooting Content Searches.

Contents

Content Search limits

Indexing limits for email messages

More information

Content Search limits

The following table lists the search limits in the Security & Compliance Center.

Description of limit

Limit

The maximum number of mailboxes or sites that can be searched in a single Content Search

No limit

The maximum number of Content Searches that can run at the same time in your organization.

No limit

The maximum number of items per user mailbox that are displayed on the preview page when previewing Content Search results.

100

The maximum number of items found in all user mailboxes that are displayed on the preview page when previewing Content Search results. The newest items are displayed.

1,000

The maximum number of user mailboxes that can be previewed for search results. If there are more than 1000 mailboxes that contain content that matches the search query, only the top 1000 mailboxes with the most search results will be available for preview.

1,000

The maximum number of items found in SharePoint and OneDrive for Business sites that are displayed on the preview page when previewing Content Search results. The newest items are displayed.

200

The maximum number of sites (in SharePoint and OneDrive for Business) that can be previewed for search results. If there are more than 200 total sites that contain content that matches the search query, only the top 200 sites with the most search results will be available for preview.

200

The maximum number of items per public folder mailbox that are displayed on the preview page when previewing Content Search results.

100

The maximum number of items found in all public folder mailboxes that are displayed on the preview page when previewing Content Search results.

200

The maximum number of public mailboxes that can be previewed for search results. If there are more than 500 public folder mailboxes that contain content that matches the search query, only the top 500 public folder mailboxes with the most search results will be available for preview.

500

The maximum number of characters for the search query (including operators and conditions) for a Content Search.

Mailboxes: 10,000

Sites: 4,000 when searching all sites or 2,000 when searching up to 20 sites1

Maximum number of variants returned when using a prefix wildcard to search for an exact phrase in a search query or when using a prefix wildcard and the NEAR or ONEAR Boolean operator.

10,0002

The minimum number of alpha characters for prefix wildcards; for example, time*, one*, or set*.

3

The maximum number of mailboxes in a Content Search that you can delete items in by doing a "search and purge" action (by using the New-ComplianceSearchAction -Purge command). If the Content Search that you're doing a purge action for has more source mailboxes than this limit, the purge action will fail. For more information about search and purge, see Search for and delete email messages in your Office 365 organization.

50,000

Notes: 

  • 1   When searching SharePoint and OneDrive for Business locations, the characters in the URLs of the sites being searched are counted against this limit.

  • 2    For non-phrase queries (a keyword value that doesn't use double quotation marks) we use a special prefix index. This tells us that a word occurs in a document, but not where it occurs in the document. To do a phrase query (a keyword value with double quotation marks), we need to compare the position within the document for the words in the phrase. This means that we can't use the prefix index for phrase queries. In this case, we internally expand the query with all possible words that the prefix expands to; for example, "time*" can expand to "time OR timer OR times OR timex OR timeboxed OR …". 10,000 is the maximum number of variants the word can expand to, not the number of documents matching the query. There is no upper limit for non-phrase terms.

Return to top

Indexing limits for email messages

The following table describes the indexing limits that might result in an email message being returned as an unindexed item or a partially indexed item in the results of a Content Search.

Indexing limit

Maximum value

Description

Maximum attachment size (excluding Excel files)

150 MB

The maximum size of an email attachment that will parse for indexing. Any attachment that's larger than this limit won't be parsed for indexing, and the message with the attachment will be marked as unindexed.

Note: Parsing is the process where the indexing service extracts text from the attachment, removes unnecessary characters like punctuation and spaces, and then divides the text into words (in a process called tokenization), that are then stored in the index.

Maximum size of Excel files

4 MB

The maximum size of an Excel file located on a site or attached to an email message that will be parsed for indexing. Any Excel file that's larger than this limit won't be parsed, and the file or the email the message with the file attachment will be marked as unindexed.

Maximum number of attachments

250

The maximum number of files attached to an email message that will be parsed for indexing. If a message has more than 250 attachments, the first 250 attachments are parsed and indexed, and the message is marked as partially indexed because it had additional attachments that weren't parsed.

Maximum attachment depth

30

The maximum number of nested attachments that are parsed. For example, if an email message has another message attached to it and the attached message has an attached Word document, the Word document and the attached message will be indexed. This behavior will continue for up to 30 nested attachments.

Maximum number of attached images

0

An image that's attached to an email message is skipped by the parser and isn't indexed.

Maximum time spent parsing an item

30 seconds

A maximum of 30 seconds is spent parsing an item for indexing. If the parsing time exceeds 30 seconds, the item is marked as partially indexed.

Maximum parser output

2 million characters

The maximum amount of text output from the parser that's indexed. For example, if the parser extracted 8 million characters from a document, only the first 2 million characters are indexed.

Maximum annotation tokens

2 million

When an email message is indexed, each word is annotated with different processing instructions that specify how that word should be indexed. Each set of processing instructions is called an annotation token. To maintain the quality of service in Office 365, there is a limit of 2 million annotation tokens for an email message.

Maximum body size in index

67 million characters

The total number of characters in the body of an email message and all its attachments. When an email message is indexed, all text in the body of the message and in all attachments is concatenated into a single string. The maximum size of this string that is indexed is 67 million characters.

Maximum unique tokens in body

1 million

As previously explained, tokens are the result of extracting text from content, removing punctuation and spaces, and then dividing it into words (called tokens) that are stored in the index. For example, the phrase "cat, mouse, bird, dog, dog" contains 5 tokens. But only 4 of these are unique tokens. There is a limit of 1 million unique tokens per email message, which helps prevent the index from getting too large with random tokens.

Return to top

More information

There are additional limits related to different aspects of Content Search, such as exporting search results and content indexing. For a description of these limits, see the following topics:

For information about Content Searches, see:

Return to top

Expand your skills
Explore training
Get new features first
Join Office Insiders

Was this information helpful?

Thank you for your feedback!

Thank you for your feedback! It sounds like it might be helpful to connect you to one of our Office support agents.

×