Legal Hold in Microsoft 365: What to Turn On and What to Check

Legal Hold in Microsoft 365: What to Turn On and What to Check

A legal hold in Microsoft 365 is two things at once: a decision by your attorney that certain information must be preserved, and a set of settings your IT administrator uses to make that happen. Microsoft gives you two main tools. A mailbox-level Litigation Hold preserves a single user's Exchange Online mailbox. A Microsoft Purview eDiscovery hold can also cover OneDrive, SharePoint, Teams and Microsoft 365 groups. For anything beyond a simple mailbox issue, the second tool is usually the one you need.

This guide is written for small business owners, office managers and administrators, including law firms, dental practices and nonprofits. It explains what each hold does, how to place one, how to verify it, and how to release it without destroying evidence. It is general information, not legal advice. Your attorney decides when a hold is required and what it covers.

TL;DR

• A Litigation Hold preserves everything in a user's mailbox, including deleted items and original versions of edited items. It does not cover files, Teams or SharePoint.
• A Purview eDiscovery hold is the broader option: mailboxes, OneDrive accounts, SharePoint sites, Teams and Microsoft 365 groups, each added explicitly.
• Counsel decides when a hold is needed. IT carries it out. Do not delete documents, licenses or accounts to "clean up" while a hold may apply.
• Several preservation controls can overlap, so check every one before you change or release anything.
• Map your Microsoft 365 data before a dispute starts. It makes every later decision faster.

Table of Contents

• What a legal hold is, and who owns it
• Litigation Hold vs. eDiscovery hold
• How to place a mailbox on Litigation Hold
• How to create a broader hold in Purview
• Verify the hold before you trust it
• What not to do during a hold
• Turning off a legal hold safely
• A small business checklist for before a dispute
• Our perspective: a hold is only as good as your map
• When to bring in IT support
• FAQ
• Sources

What a legal hold is, and who owns it

A legal hold (also called a litigation hold) suspends normal deletion for information that may be relevant to a dispute. The duty to preserve is a legal obligation, not a software feature. The U.S. Department of Justice's own procedures say that preservation duties can arise before a lawsuit is filed when litigation is reasonably anticipated. Those procedures call for written notice to likely custodians, confirmation that they understand the obligation, and coordination between counsel and IT. Private businesses are not DOJ agencies, but the process is a sound model.

Oklahoma practitioners describe the same pattern. One Oklahoma employment law firm notes that Microsoft 365 retention settings can delete emails, chats and files before a dispute reaches court, and that once litigation is reasonably anticipated, employers must take reasonable steps to preserve relevant electronic evidence.

Two points keep owners out of trouble:

1. The hold is a process, not a checkbox. Counsel identifies the people and systems involved, issues written instructions and gets confirmation. IT then suspends routine destruction.
2. Preserving is not producing. Federal discovery practice separates preservation from discoverability and privilege. Holding an item does not concede that it is relevant, admissible or non-privileged.

Litigation Hold vs. eDiscovery hold

Microsoft's documentation describes a layered model. Several mechanisms can independently preserve content, and they do not all cover the same places.

Microsoft states that a Litigation Hold preserves all mailbox content, including deleted items and original versions of modified items, and that an enabled archive mailbox is also held. A mailbox hold on its own leaves files, chats and collaboration data outside the preserved scope, which is why Microsoft's Litigation Hold documentation points larger matters toward eDiscovery.

How hold duration actually works

If you set a duration, it is counted from when an item was received or created, not from the day you enabled the hold. Leaving the duration blank creates an indefinite hold that lasts until someone removes it, per Microsoft's Litigation Hold page. A time-based hold can eventually let older items be purged. Agree on the duration with your attorney and document it. For most small business disputes, indefinite is the safer default until counsel says otherwise.

How to place a mailbox on Litigation Hold

This is the quick path for a single mailbox. Per Microsoft's admin center instructions:

1. In the Microsoft 365 admin center, go to Users > Active users and select the person.
2. Open Mail settings and choose Manage litigation hold.
3. Turn the hold on.
4. Optionally enter a duration, a note for the user and an information URL.
5. Save.

Licensing is the usual blocker. Microsoft says the mailbox needs Exchange Online Plan 2, or Exchange Online Plan 1 plus a separate Exchange Online Archiving license. If "Manage litigation hold" is missing or unavailable, missing licensing is one of the possible reasons. Check the license before you assume something is broken.

One more practical note: Litigation Hold and in-place hold are generally transparent to the user, so a person will not necessarily know their mailbox is held unless you tell them. That is why your written hold notice to custodians matters. The notice is the legal instruction. The setting only enforces it.

How to create a broader hold in Purview

When a dispute involves documents, Teams conversations or SharePoint libraries, use a Purview eDiscovery case. The workflow in Microsoft's hold creation guide comes down to four steps:

1. Identify custodians and data sources. Who touched this matter? Which mailboxes, OneDrive accounts, SharePoint sites and Teams are involved?
2. Create the case and add a hold policy.
3. Choose locations (mailboxes, OneDrive accounts, SharePoint sites, Teams, Microsoft 365 groups) and configure the hold.
4. Monitor the policy status until it shows as applied, then confirm the scope rather than assuming it.

Microsoft says held content stays preserved until the location is removed, the hold is released or the hold policy is deleted.

The scope gaps that catch small businesses

• Groups and Teams do not include members' personal data. Microsoft states that placing a Microsoft 365 group or Teams group on hold covers the group's mailbox and site, but not each member's mailbox or OneDrive unless those users are added explicitly. If your office lives in Teams, this is the easiest gap to fall into.
• A user's mailbox does not automatically include their Teams or group content. Add those locations on purpose.
• The SharePoint Recycle Bin is not indexed for eDiscovery search, so content sitting only there cannot be found and held through that search workflow. This is one more reason to act before people start deleting.

Verify the hold before you trust it

A green checkmark in the admin center is not proof. Microsoft recommends using Exchange Online PowerShell to check mailbox hold status, as described in its guide to identifying mailbox hold types. Run Get-Mailbox for the user and read these properties:

• LitigationHoldEnabled: a simple true or false for Litigation Hold.
• InPlaceHolds: lists eDiscovery holds as GUIDs, commonly beginning with the UniH prefix.
• ComplianceTagHoldApplied: indicates retention labels are involved.
• SingleItemRecoveryEnabled, DelayHoldApplied and DelayReleaseHoldApplied: other mechanisms that can keep content around.

Check organization-level holds as well. A mailbox showing LitigationHoldEnabled as False is not necessarily free of preservation controls. Retention policies, labels, eDiscovery holds, Single Item Recovery and delay holds can each still apply.

Write down what you find, the date, and who confirmed it. If a court later asks how you preserved data, a dated record helps your attorney answer.

What not to do during a hold

Do not delete documents just because a hold is active. And do not start deleting to "make room" or reduce risk. A hold exists so relevant content is not permanently deleted, and removing the wrong data can create litigation risk. Ask counsel first.

Do not remove a license or delete a user account as a shortcut. Microsoft documents that a deleted Exchange Online mailbox is normally retained for 30 days, but hold status and the deletion path affect recoverability, and a held mailbox may not be removable at all. This matters most during employee offboarding. If a departing employee may be a custodian, stop the standard offboarding script and call your attorney and your IT provider.

Do not rely on a retention policy as a substitute. A retention policy is a business-as-usual rule. A hold is a legal override. They can coexist, but one does not replace the other. Our guide on setting up email retention in Microsoft 365 covers the day-to-day side, and our small business data retention policy guide covers the policy that sits behind it.

Turning off a legal hold safely

Releasing a hold is riskier than placing one. Microsoft warns that deleting a hold policy releases the associated sites and mailboxes and can result in permanent deletion of preserved content. A safe sequence looks like this:

1. Counsel confirms in writing that the matter is closed or preservation is no longer required.
2. Identify the exact hold type and every overlapping hold on each affected location.
3. Document the approval, including who approved it and when.
4. Release the specific hold through the control that created it: disable the Litigation Hold, or release the eDiscovery hold in the case.
5. Wait and verify. Microsoft advises allowing up to 240 minutes for a change to apply, and a delay hold can keep content for up to 30 days after a hold is removed.

That is the answer to the common complaint "I removed the hold, but deletion still fails." Another preservation mechanism is probably still in effect. Diagnose before you override.

A small business checklist for before a dispute

The DOJ's guidance on electronic discovery stresses that an information-system inventory completed before litigation makes it easier to decide what must be preserved and to document normal retention and destruction practices. For a small business, that translates to a short list:

• A current map of where client and business data lives: Exchange, OneDrive, SharePoint, Teams, and any file server or line-of-business software.
• A record of which Microsoft 365 licenses each person has, so Litigation Hold is available when needed.
• A written retention schedule that people actually follow.
• An offboarding procedure with a "stop and check" step for possible custodians.
• A named contact at your law firm and at your IT provider who talk to each other.

Law firms carry extra duties to their clients. Our 9 steps to secure Microsoft 365 for law firms covers MFA, Purview and backups for that setting.

Our perspective: a hold is only as good as your map

We support small businesses in Norman, Moore and Oklahoma City, from dental practices to law firms and nonprofits. The legal hold mistakes we worry about are rarely exotic. They are ordinary gaps: the mailbox was held but the Teams chat was not, a license was missing on the day it mattered, or an offboarding script deleted an account before anyone asked a lawyer.

Our view is that a hold should never be an emergency improvisation. Know where your data lives before you need to freeze it. Keep documentation of what you configured and why. And treat backup as a separate safety net: a hold keeps data from being purged inside Microsoft 365, while a tested backup is what you fall back on after ransomware or an administrator error. Neither replaces the other, and both should be verified, not assumed.

We also believe the explanation should be in plain language. Your attorney should be able to read what IT did and why, without translation.

— Nicholas

When to bring in IT support

If you already have a dispute on the horizon, the first call is to your attorney. The second is to whoever administers your Microsoft 365 tenant. If that is nobody, or a part-time favor from a relative, we can help. Our Microsoft 365 support covers setup and management, including licensing and retention, and our backup and recovery service gives you a separate, tested copy of your data. We offer same-day response and no long-term contracts. To see where your setup stands today, start with the 10-minute readiness audit.

FAQ

How do I do a legal hold in Office 365?

For one mailbox, open the user in the Microsoft 365 admin center, choose Manage litigation hold under Mail settings, and enable it. For a dispute that involves files, Teams or SharePoint, create a Purview eDiscovery case and add a hold policy for each relevant location. Have your attorney define the scope first.

Should you delete documents during a legal hold?

No, not without your attorney's approval. A hold is meant to stop relevant content from being permanently deleted, and removing the wrong data can create litigation risk. Pause routine cleanup, offboarding deletions and license removals until counsel says otherwise.

How do I turn off a litigation hold in Office 365?

First get written confirmation from counsel that preservation is no longer required. Then identify every overlapping hold, document the approval, and release the specific Litigation Hold or eDiscovery hold. Allow time for the change to apply, and check for delay holds or retention policies before expecting normal deletion.

What does a litigation hold in Office 365 do?

It preserves all content in a user's Exchange Online mailbox, including deleted items and the original versions of modified items, plus the archive mailbox if enabled. It does not by itself preserve OneDrive files, SharePoint sites or Teams content. Those need a Purview eDiscovery hold.

Sources

• Place a mailbox on Litigation Hold (Microsoft Learn)
• Place a mailbox on litigation hold, Microsoft 365 admin (Microsoft Learn)
• Create a Litigation hold (Microsoft Learn)
• Create holds in eDiscovery (Microsoft Learn)
• Identify Exchange mailbox hold types in eDiscovery (Microsoft Learn)
• Manage hold policies for eDiscovery cases (Microsoft Learn)
• Delete or restore user mailboxes in Exchange Online (Microsoft Learn)
• Justice Manual 4-1.000, Assignment of Responsibilities (U.S. DOJ)
• Stipulation and Order Regarding Discovery Procedure, U.S. v. Google LLC (U.S. DOJ)
• DOJ guidance on information-system inventory (U.S. DOJ)
• Preserving Digital Evidence in Oklahoma Employment Cases (Addison Law)

Recommended

• 9 Steps to Secure Microsoft 365 for Law Firms: MFA, Purview, Backups
• Setting Up Email Retention in Microsoft 365: An Admin's Guide
• Keep Overrides Under 5%: Microsoft 365 DLP Rollout for IT Admins