Microsoft 365 offers several ways that your organization can prevent mailbox content from being permanently deleted. This allows your organization to retain content to meet compliance regulations or during legal and other types of investigations.
Litigation Hold: Holds that are applied to user mailboxes in Exchange Online.
In-Place Hold: Holds that are applied to user mailboxes by using the In-Place eDiscovery & Hold tool in the Exchange admin centre in Exchange Online.
eDiscovery Hold: Holds that are associated with a Core eDiscovery case in the security and compliance centre. eDiscovery holds can be applied to user mailboxes and the corresponding mailbox for Microsoft 365 Groups and Microsoft Teams.
Microsoft 365 retention policies: Can be configured to retain (or retain and then delete) the content in user mailboxes in Exchange Online and the corresponding mailbox for Microsoft 365 Groups and Microsoft Teams. You can also create a retention policy to retain Skype for Business Conversations, which are stored in user mailboxes.
'Archiving', 'retention policies', and 'litigation holds' are different terms related to Exchange Online data retention, and administrators should be aware of when to use what.
Litigation holds
Litigation Hold helps you place user mailboxes on hold, i.e., retain all the contents of a mailbox, including deleted items and the original versions of modified items. It is a functionality of the eDiscovery feature in Exchange Online that is helpful in freezing crucial data. When a mailbox is placed on litigation hold, Items in the user's primary and the archive mailboxes (if enabled) are retained.
When you create a litigation hold, you can specify the time duration for which you want the items retained, after which they will be deleted. You can also just place an infinite hold on the mailbox, wherein the content will be retained indefinitely unless you remove the hold.
As the name suggests, the primary function of a Litigation Hold is to protect data in case there is a lawsuit in action, and some emails might be evidence. That is what the whole eDiscovery is there for. But you can use it, as many other companies do, as a means to backup sensitive data, just in case.
A Litigation Hold process usually goes through a lifecycle such as the below:
1. A Trigger event (like a court order or a notification from the internal legal team)
2. Analyze the duty to preserve
3. Define the scope of the hold – the custodians, the type of data, etc.
4. Implement the Hold
5. Enforce the Hold
6. Modify the Hold (as needed)
7. Frequently Monitor the Hold
8. Remove the Hold
Detailed Setup Guide
Preparation
Ensure that the mailbox involved has either an Exchange Online Plan 2 license or an Exchange Online Archiving license for Plan 1.
Activation
Navigate to the Exchange admin centre.
Select the mailboxes to place on hold.
Choose "Litigation Hold" and specify the duration of the hold, or select "indefinite" if the end date is unknown.
Provide a clear description of the hold, which is helpful for audits and tracking.
Key Concepts
Scope of Preservation: Litigation Hold preserves all mailbox content, including deleted items and original versions of modified items.
Access and Use: Users can continue to work with their email and other services as usual without impacting their day-to-day activities, ensuring that the hold is transparent to the user but fulfils legal requirements.
Best Practices
Regular Reviews: Conduct audits of Litigation Holds to ensure they are still necessary and correctly applied.
Clear Communication: Inform affected users about the hold and its implications for transparency and compliance.
Advanced Features for Enhanced Management
eDiscovery Integration: Utilize Office 365 eDiscovery tools to search, hold, and export data related to specific cases directly from the compliance centre, enhancing the capabilities of Litigation Holds.
Automation Tools: Consider using third-party tools or services that integrate with Office 365 to automate the management and tracking of Litigation Holds, reducing manual effort and improving accuracy.
In-Place holds
It is integrated with In-Place eDiscovery. Allows you to search and preserve all or select based on time and/or query parameters.
This type of hold is a query-based hold where you can apply the hold either on a complete mailbox or the content of the mailbox based on date, time, subject, sender, recipient, etc.
This is now often called a legacy search hold and replaced by a retention hold.
Delay holds
Whenever a "Litigation" hold is disabled for a mailbox, a delay hold is automatically applied to that specific mailbox.
This type of hold is applied and is kept intact for 30 days. In case we need to manually / forcefully remove a mailbox using the PowerShell command, we need to remove the delay hold if the litigation hold was recently removed.
Organization-Wide Hold
This type of hold is applied when the hold is placed on the entire organization and contents.
A quick comparison of Litigation Hold vs. Retention Policy
