You a web application that provides access to legal documents that are stored on Azure Blob Storage with version level immutability policies. Documents are protected with both time-based policies…

Overwriting existing documents would fail under an active time-based retention policy (even with `AllowProtectedAppendWrites` enabled, as it applies to appends, not overwrites), meaning it does not fail *only* when a legal hold is in effect.

Adding data to documents (append operations) is allowed when time-based retention policies with `AllowProtectedAppendWrites` and/or legal holds are both active. However, once the time-based policy expires, leaving only the legal hold, append operations are prevented because a legal hold generally prohibits all modifications, and `AllowProtectedAppendWrites` is specifically tied to the expired time-based policy, causing the operation to fail.

Deleting documents would fail under an active time-based retention policy, meaning it does not fail *only* when a legal hold is in effect.

While 'creating document' typically refers to creating a new blob not directly restricted by immutability on other blobs, in a strict legal hold context, specific application-level 'document creation' or 'finalization' operations, particularly those that result in a new version or commit to an immutable state, could be blocked. This operation would succeed under an active time-based policy (especially with `AllowProtectedAppendWrites` permitting incremental writes) but fail when solely a legal hold is in effect, ensuring no new content enters the legally held scope.