Legal Hold in Office 365: A Compliance-Ready Guide

For most legal preservation needs in Microsoft 365, use Microsoft Purview eDiscovery holds or Microsoft 365 retention policies — not Exchange Litigation Hold. Litigation Hold still works, but it covers Exchange mailboxes only. Purview holds and retention policies span mailboxes, SharePoint sites, OneDrive accounts, and Teams content in a single policy.

Two actions to take right now:

• Confirm that every target user holds an eligible license (Exchange Online Plan 2 or a Microsoft 365 E3/E5 plan) and that you have eDiscovery Manager or Compliance Administrator permissions in Microsoft Purview.
• Create a Purview eDiscovery hold scoped to the correct data locations — user mailboxes, SharePoint sites, OneDrive accounts, and Teams group mailboxes — before any other step.

One timing fact that trips up nearly every first-time implementation: holds can take up to 24 hours to replicate across all services. Do not assume preservation is immediate; it can take some time to become active after you click Save.

Pro Tip: If you are responding to active litigation, create the Purview hold first and document the timestamp. That timestamp is your legal defensibility anchor — everything else is operational cleanup.

Key Takeaways

Purview eDiscovery holds and Microsoft 365 retention policies are the modern, defensible approach to data preservation in Office 365 — Exchange Litigation Hold remains valid only for Exchange-specific, mailbox-only scenarios.

Table of Contents

• How do you place a legal hold in Office 365?
• What licenses and permissions do you need to create holds?
• Which Office 365 data locations do you need to target?
• Litigation Hold vs. eDiscovery holds vs. retention policies: which do you use?
• How do you verify a hold is working and fix common problems?
• How do you safely release a hold and document the action?
• What governance controls keep holds accurate and auditable over time?
• The part most compliance guides skip
• Rivell handles the operational side of Microsoft 365 compliance
• Sources

How do you place a legal hold in Office 365?

The fastest path to preservation runs through Microsoft Purview. Here is the sequence, followed by the Exchange PowerShell alternative for mailbox-only scenarios.

Creating a Purview eDiscovery hold

1. Sign in to the Microsoft Purview portal and navigate to eDiscovery > Cases.
2. Open an existing case or create a new one. Every hold lives inside a case.
3. Select Hold policies, then Create policy.
4. Name the policy and add a description that references the case number or matter name.
5. Add data sources: select individual users (mailboxes + OneDrive), Microsoft 365 groups, SharePoint sites, or Teams.
6. Choose Infinite hold to preserve all content, or configure a query-based hold to filter by keyword, date range, or sender/recipient.
7. Review and submit. The portal confirms the policy was created; allow up to 24 hours for full propagation.

Pro Tip: Use query-based holds when the matter is narrow — a specific date range or a named custodian’s communications. Infinite holds on large mailboxes accelerate Recoverable Items growth and can push storage costs up fast.

Placing an Exchange mailbox on Litigation Hold

For Exchange-only scenarios, PowerShell is the most reliable path:

# Check current hold status
Get-Mailbox -Identity [email protected] | FL LitigationHoldEnabled, LitigationHoldDate, LitigationHoldOwner

# Enable Litigation Hold
Set-Mailbox -Identity [email protected] -LitigationHoldEnabled $true

# Optional: set a hold duration in days (blank = indefinite)
Set-Mailbox -Identity [email protected] -LitigationHoldEnabled $true -LitigationHoldDuration 2555

You can also enable Litigation Hold from the Exchange Admin Center: go to Recipients > Mailboxes, open the user, select Mailbox features, and toggle Litigation Hold on. The EAC path works fine for one-off cases; PowerShell is faster when you are placing holds on a list of custodians.

• After enabling, verify with Get-Mailbox | FL LitigationHoldEnabled to confirm the flag is set.
• Run Get-OrganizationConfig | FL InPlaceHolds to see organization-level hold policies.
• Use Invoke-HoldRemovalAssistant to force a hold-state refresh on a mailbox that is not reflecting changes within the expected window.

What licenses and permissions do you need to create holds?

Getting the licensing wrong is the most common reason a hold silently fails. Check every target user’s assigned subscription before you add them to a policy.

Core license requirements

• Exchange Online Plan 2 includes Litigation Hold capability natively. A mailbox on Exchange Online Plan 1 requires the Exchange Online Archiving add-on to be eligible for hold.
• Microsoft 365 E3 covers standard eDiscovery holds and retention policies for most organizations.
• Microsoft 365 E5, E5 Compliance, or E5 eDiscovery add-ons unlock premium Purview features: query-based custodian holds, advanced analytics, and the full eDiscovery (Premium) case workflow.
• Frontline SKUs (Office 365 F1/F3) cannot be targets of eDiscovery holds. If a frontline worker is a custodian in your matter, you need to upgrade or reassign their license before adding them to the hold policy.

Role-based access

License-to-capability reference

Which Office 365 data locations do you need to target?

The most common gap in a legal hold is a missing data location. Teams is the worst offender because its content is split across three separate storage services.

Teams content storage mapping

According to Microsoft’s guidance on preserving Teams content, the storage locations break down like this:

The practical consequence: preserving a Teams channel investigation requires placing both the team’s group mailbox and its associated SharePoint site on hold. Targeting only the mailbox leaves all channel files unpreserved.

Common scenario mappings

• Individual custodian: Place the user’s mailbox and OneDrive on hold. If the custodian participates in Teams channels, also add the relevant team mailboxes and SharePoint sites.
• Team-level investigation: Add the group mailbox, the SharePoint team site, and each member’s individual mailbox (for private channel and 1:1 chat content).
• Cross-team matter: Enumerate every team involved, add each group mailbox and site, then add individual user mailboxes for any private channel participants.

A few operational caveats worth flagging:

• Group membership snapshot: When you add a Microsoft 365 group as a data source, membership is captured at the moment the policy is created. Members added to the group after that point are not automatically placed on hold. Update the policy manually when the team roster changes.
• SharePoint recycle bin: Content in the recycle bin is not indexed and may not be captured by a query-based hold. Use infinite holds when you cannot rule out deleted content.
• Site URL accuracy: SharePoint site URLs must be exact. A truncated or redirected URL silently fails to add the site to the hold scope.

For guidance on preserving shared documents and confirming share origins between OneDrive and SharePoint, secure document sharing practices are worth reviewing alongside your hold mapping.

Litigation Hold vs. eDiscovery holds vs. retention policies: which do you use?

These three tools solve related but distinct problems. Using the wrong one creates either gaps in preservation or unnecessary administrative burden.

Microsoft 365 retention policies are the right tool for long-term, organization-wide data lifecycle management. They span multiple workloads, support configurable retention windows, and handle automated deletion. Microsoft recommends retention policies over Litigation Hold for broad, ongoing compliance programs.

Purview eDiscovery holds are case-scoped and designed for active legal matters. They preserve content until an administrator releases them, and if content is subject to both an eDiscovery hold and a retention policy, the eDiscovery hold takes precedence — the retention policy’s deletion action is suspended until the hold is released.

Exchange Litigation Hold is Exchange-specific and indefinite by default. It still works, but it does not cover SharePoint, OneDrive, or Teams files. Use it only when you need to preserve Exchange mailbox content and cannot use Purview.

Pro Tip: Avoid using eDiscovery holds instead of a retention policy because eDiscovery holds lack automated release and configurable retention windows, requiring active case management. Leaving eDiscovery holds active for long periods can increase storage and compliance risks.

Three practical scenarios:

• Regulatory audit with a two-year window: Use a retention policy scoped to the relevant workloads. Set a two-year retention period. No case management required.
• Active employment litigation: Create a Purview eDiscovery case, add a hold scoped to the custodian’s mailbox, OneDrive, and any relevant Teams. Document the case number.
• Exchange-only archive preservation (legacy tenant): Enable Litigation Hold on the mailbox via PowerShell. Confirm the Exchange Online Plan 2 license is assigned.

How do you verify a hold is working and fix common problems?

Verification is not optional. A hold that looks active in the UI may not have propagated, or a delay hold may be masking a real problem.

Verification steps

1. In Microsoft Purview, go to eDiscovery > Cases > [your case] > Hold policies and check the policy status. A green checkmark indicates the policy applied successfully.
2. Run the hold status report from the Purview portal to see per-location status and any failed locations.
3. Check mailbox hold fields via PowerShell:

Get-Mailbox -Identity [email protected] | FL LitigationHoldEnabled, InPlaceHolds, DelayHoldApplied, DelayReleaseHoldApplied

4. Check organization-level holds:

Get-OrganizationConfig | FL InPlaceHolds

5. If a policy is failing, retry it from the eDiscovery hold status report in the Purview portal.

Hold prefix reference

The InPlaceHolds field on a mailbox contains encoded strings. Each prefix identifies the hold source:

Troubleshooting checklist

• License check: Confirm the target user’s subscription is Exchange Online Plan 2, M365 E3, or higher. Frontline SKUs block hold placement silently.
• Group snapshot: If a new team member is missing from the hold, update the hold policy to re-expand group membership.
• Delay holds: If a mailbox still shows as on hold after you removed all known holds, check for DelayHoldApplied or DelayReleaseHoldApplied. These are system-imposed and require the Invoke-HoldRemovalAssistant cmdlet to clear.
• Propagation window: Allow 24 hours before concluding a hold has failed. Check again after that window before escalating.
• Failed policy retry: From the hold status report, select the failed location and choose Retry to force re-application.

How do you safely release a hold and document the action?

Releasing a hold without proper documentation is a legal risk. The release process has three layers: the technical action, the legal sign-off, and the audit record.

Release workflow

1. Obtain written sign-off from legal counsel confirming the matter is closed or the preservation obligation has ended.
2. Export any required evidence sets from the Purview case before releasing the hold. Once released, content subject only to that hold may become eligible for deletion.
3. In Microsoft Purview, navigate to the case, open Hold policies, and either delete the policy or disable it.
4. For Litigation Hold, run:

Set-Mailbox -Identity [email protected] -LitigationHoldEnabled $false

5. Wait for the system delay window. Delay holds such as DelayHoldApplied or DelayReleaseHoldApplied may keep items preserved for a period after the hold is removed. This is expected behavior, not a bug.
6. Document the release in your internal change log.

What to capture in the change record

• Who authorized the release (name, title, date)
• Case reference number or matter name
• Date and time the hold policy was deleted or disabled
• Export ID if an evidence set was exported before release
• Confirmation that legal counsel reviewed and approved

Storage and quota considerations

Enabling Litigation Hold increases the Recoverable Items folder quota for the affected mailbox. Before releasing a long-running hold, review Recoverable Items growth to understand whether storage will contract significantly post-release and whether any downstream backup or disaster recovery plans need to account for that change.

Single Item Recovery (SIR) behavior also changes after a hold is released. Items that were preserved solely by the hold become eligible for permanent deletion once the delay window expires. If those items have evidentiary value, export them before release.

What governance controls keep holds accurate and auditable over time?

Legal hold is not a one-time action. Holds drift: licenses change, team rosters expand, and cases get forgotten. A governance framework prevents those gaps from becoming legal exposure.

Daily and weekly operational checks

• Review the Purview hold status report for failed policies and retry any that show errors.
• Monitor Recoverable Items growth across custodian mailboxes and set alerts before quotas are hit.
• Run a license drift check: confirm that every custodian still holds an eligible subscription. A license downgrade silently removes hold eligibility.
• Check for new team members on group-based holds and update policies where the roster has changed.

Runbook outline

A defensible hold operation needs a documented runbook. At minimum, it should cover:

• Roles and responsibilities: Who has eDiscovery Manager permissions, who approves hold creation and release, and who handles escalation.
• Step-by-step Purview and Exchange tasks: The exact sequence from case creation through hold policy creation, verification, and release.
• Escalation path: What happens when a hold fails to apply, when a custodian’s license is insufficient, or when legal counsel requests an emergency preservation.
• Evidence export steps: How to export content from a Purview case before releasing a hold, including chain-of-custody documentation.
• Retention vs. hold decision matrix: A simple table that maps matter type and duration to the correct tool (retention policy vs. eDiscovery hold vs. Litigation Hold).

Governance controls

• Apply change control to hold creation and release — no hold should be added or removed without a ticket and an approver.
• Set a periodic review cadence (quarterly is common) to audit active holds, confirm cases are still open, and verify custodian license status.
• Align retention labels in Microsoft Purview with your hold policies so that content released from a hold falls into the correct retention category automatically.
• Send custodian notifications when a hold is placed. Purview includes a built-in legal hold notification workflow within eDiscovery (Premium) cases. For standard cases, a documented email to the custodian and their manager is the minimum acceptable record.

Pro Tip: For law firms and healthcare organizations, a managed IT provider can centralize hold lifecycle operations, maintain the runbook, and provide auditable export support. Rivell’s Microsoft 365 compliance work for law firms covers exactly this operational layer.

The part most compliance guides skip

The technical steps for a legal hold in Office 365 are well-documented. What gets organizations into trouble is not the configuration — it is the assumption that configuration equals compliance.

Three patterns appear repeatedly in real environments. First, Teams holds placed on the group mailbox only, with the SharePoint site left uncovered. The admin followed a guide that predated Teams file storage behavior, and nobody tested whether channel files were actually preserved. Second, group membership snapshots that were never updated. A key witness joined the team three weeks after the hold was created. Their messages were never preserved. Third, Recoverable Items growth that nobody monitored. A mailbox on Litigation Hold for two years quietly consumed storage until it hit quota, at which point new items stopped being preserved without any alert firing.

The common thread is that holds were treated as infrastructure — set once, assumed to be running. Compliance-grade preservation requires the same operational discipline as any other monitored system: regular checks, documented changes, and a clear owner for each active hold.

Managed services reduce this risk not by doing something technically complex, but by making the operational layer systematic. Rivell brings over 25 years of managed IT experience to Microsoft 365 environments, including compliance implementations for law firms and regulated industries where hold defensibility is not optional.

Rivell handles the operational side of Microsoft 365 compliance

Running legal holds correctly means more than clicking the right buttons in Purview. It means license audits before custodians are added, runbooks that survive staff turnover, Recoverable Items monitoring before quotas are hit, and documented release workflows that hold up in court.

Rivell’s managed IT services cover the full Microsoft 365 compliance stack: implementation and licensing assessment, eDiscovery hold lifecycle management, custodian notification workflows, evidence export support, and the auditable change logs that regulated industries require. For organizations in New Jersey managing active litigation or regulatory obligations, Rivell takes ownership of the operational layer so your legal team gets clean, defensible evidence and your IT team is not rebuilding the process from scratch each time a new matter opens.

Contact Rivell for a Microsoft 365 compliance assessment and find out exactly where your current hold configuration has gaps.

Sources

The following Microsoft Learn pages are the authoritative references for the procedures and licensing rules covered in this guide:

• Place a mailbox on Litigation Hold
• Create holds in eDiscovery

Recommended

• Microsoft Office 365 Implementation & Consulting Services NJ
• On-Premises Backup: A Practical Guide for IT Decision-Makers
• Who Phishing Targets: What Security Pros Need to Know
• NJ SMB Guide to HIPAA Compliance & Cybersecurity in Healthcare IT – Rivell