Microsoft Purview offers several ways that your organization can prevent mailbox content from being permanently deleted. This allows your organization to retain content to meet compliance regulations or during legal and other types of investigations. Here's a list of the retention features (also called holds) in Microsoft Purview and Microsoft 365:
Litigation Hold: Holds that are applied to user mailboxes in Exchange Online.
Holds: Holds that are associated with a Microsoft Purview eDiscovery (Standard) case in the Microsoft Purview compliance portal. eDiscovery holds can be applied to user mailboxes and the corresponding mailbox for Microsoft 365 Groups and Microsoft Teams.
In-Place Hold: Holds that are applied to user mailboxes by using the In-Place eDiscovery & Hold tool in the Exchange admin centre in Exchange Online.
Microsoft Purview retention policies: Can be configured to retain (or retain and then delete) the content in user mailboxes in Exchange Online and the corresponding mailbox for Microsoft 365 Groups and Microsoft Teams. You can also create a retention policy to retain Skype for Business Conversations, which are stored in user mailboxes.
Two types of Microsoft Purview retention policies can be assigned to mailboxes
o Specific location retention policies are those assigned to specific users' content locations. You use the Get-Mailbox cmdlet in Exchange Online PowerShell to get information about retention policies assigned to specific mailboxes.
o Organization-wide retention policies: These are policies that are assigned to all content locations in your organization. You use the Get-OrganizationConfig cmdlet in Exchange Online PowerShell to get information about organization-wide retention policies.
Microsoft Purview retention labels: If a user applies a Microsoft Purview retention label (one that's configured to retain content or retain and then delete content) to any folder or item in their mailbox, a hold is placed on the mailbox as if the mailbox was placed on Litigation Hold or assigned to a Microsoft Purview retention policy.
Create a Litigation Hold
You can place a mailbox on Litigation hold to retain all mailbox content, including deleted items and the original versions of modified items. When you place a user mailbox on Litigation hold, content in the user's archive mailbox (if it's enabled) is also retained. When you create a hold, you can specify a hold duration (also called a time-based hold) so that deleted and modified items are retained for a specified period and then permanently deleted from the mailbox. You can also retain content indefinitely (called an infinite hold) until the litigation hold is removed. If you do specify a hold duration period, it's calculated from the date a message is received or a mailbox item is created.
Here's what happens when you create a Litigation hold.
Items that are permanently deleted by the user are retained in the Recoverable Items folder in the user's mailbox for the duration of the hold.
Items purged from the Recoverable Items folder by the user are retained for the hold duration.
The storage quota for the Recoverable Items folder is increased from 30 GB to 110 GB.
Items in the user's primary and archive mailboxes are retained.
Assign an Exchange Online Plan 2 license.
To place an Exchange Online mailbox on Litigation hold, it must be assigned an Exchange Online Plan 2 license. If a mailbox is assigned an Exchange Online Plan 1 license, you would have to assign it a separate Exchange Online Archiving license to place it on hold.
Place a mailbox on Litigation hold.
Here are the steps to place a mailbox on Litigation hold using the Microsoft 365 admin center.
Go to the Microsoft 365 admin center and then select Users > Active users.
Select the user that you want to place on Litigation hold.
On the properties flyout page, select the Mail tab, and then under More actions, select Manage litigation hold.
4. On the Manage litigation hold flyout page, select the Turn on Litigation hold checkbox and then enter the following optional information:
Hold duration (days): Use this box to create a time-based hold and specify how long mailbox items are held when the mailbox is placed on Litigation hold. The duration is calculated from the date a mailbox item is received or created. When the hold duration expires for a specific item, that item will no longer be preserved. If you leave this box blank, items are preserved indefinitely or until the hold is removed. Use days to specify the duration.
Note visible to the user: Use this box to inform the user their mailbox is on Litigation hold. The note will appear on the Account Information page in the user's mailbox if they use Outlook 2010 or later. To access this page, users can select File in Outlook.
Web page with more information for the user: Use this box to direct the user to a website for more information about Litigation hold. This URL appears on the Account Information page in the user's mailbox if they are using Outlook 2010 or later. To access this page, users can select File in Outlook.
Select Save Changes on the Litigation hold flyout page to create the hold.
How does Litigation hold work?
In the normal deleted item workflow, a mailbox item is moved to the Deletions subfolder in the Recoverable Items folder when a user permanently deletes it (Shift + Delete) or deletes it from the Deleted Items folder. A deletion policy (a retention tag configured with a Delete retention action) also moves items to the Deletions subfolder when the retention period expires. When a user purges an item in the Recoverable Items folder or when the deleted item retention period expires for an item, it's moved to the Purges subfolder in the Recoverable Items folder and marked for permanent deletion. It will be purged from Exchange the next time the mailbox is processed by the Managed Folder Assistant (MFA).
When a mailbox is placed on Litigation hold, items in the Purges subfolder are preserved for the hold duration specified by the Litigation hold. The hold duration is calculated from the original date an item was received or created and defines how long items in the Purges subfolder are held. When the hold duration expires for an item in the Purges subfolder, the item is marked for permanent deletion and will be purged from Exchange the next time the mailbox is processed by the MFA. If an indefinite hold is placed on a mailbox, items will never be purged from the Purges subfolder.
The following illustration shows the subfolders in the Recoverable Items folders and the hold workflow process.
Comentarios