M365 Retention for Law Firms: Policies, Holds and Backups

M365 Retention for Law Firms: Policies, Holds and Backups

A law firm should set up Microsoft 365 retention in three separate layers: a retention policy that keeps records for a defined period, a litigation hold that freezes data when a dispute is foreseeable, and an independent backup for recovery. Microsoft 365 handles the first two natively, though the hold features depend on your license. It does not replace the third. Most problems we see come from treating these as one setting.

This guide is for managing partners, office administrators, and whoever at your firm ends up owning IT. It explains what each layer does, what the rules say, and how to configure them without keeping everything forever or deleting something you were required to preserve.

TL;DR

• A retention policy is routine, automatic housekeeping. A litigation hold is a deliberate act that stops deletion once a claim is reasonably foreseeable. One does not satisfy the other.
• No single "7-year law" covers every law firm file. Your retention periods should come from your state bar guidance, the type of matter, and your malpractice carrier, and be written down.
• In Microsoft 365, the longest retention period wins, so overlapping policies and holds can quietly grow your storage.
• eDiscovery holds require an eligible license on every user you preserve. Check licensing before you need a hold, not after.
• Retention is not backup. Keep a separate, tested recovery copy of Exchange, SharePoint, OneDrive, and Teams data.

Table of Contents

• Retention policy, litigation hold, and backup: three different jobs
• What the rules actually require
• How Microsoft 365 retention works
• Litigation holds: the part that fails in practice
• Licensing: check before you need it
• Retention is not backup
• A starter configuration for a small firm
• Our perspective
• Getting help with the setup
• FAQ
• Sources

Retention policy, litigation hold, and backup: three different jobs

These terms get used interchangeably, including by vendors. They are different tools with different triggers.

The federal judiciary's Pocket Guide for Judges on electronic discovery makes the legal point clearly: the duty to preserve arises once litigation is reasonably foreseeable, not when a complaint lands, and routine retention practices must be suspended and the hold communicated repeatedly. A retention policy that deletes on schedule is lawful housekeeping right up until the moment it deletes something it should not have.

What the rules actually require

There is no universal seven-year rule. Seven years is a common convention, but your obligations depend on the kind of work you do.

For Oklahoma firms, the Oklahoma Bar Association's guidance is a useful anchor. According to an Oklahoma Bar Journal article on file retention and destruction, the Oklahoma Rules of Professional Conduct give no specific instructions on file retention, but Rule 1.15(a) requires complete records of client account funds and property to be kept for five years after the representation ends. The same article notes that many matters warrant longer retention: estate planning and probate, guardianship and adoption, matters involving minors, corporate records, intellectual property, real estate title work, and anything you might need to defend a malpractice claim. It also advises checking with your malpractice carrier and having a written file retention and destruction policy that you follow consistently.

If you practice in another state, check that state's bar guidance. The principle holds everywhere: the retention period is a decision about the file, not a default in a software setting.

The ethical layer matters too. The American Bar Association's guidance on technology and confidentiality expects lawyers to know where client data lives, including on phones and tablets, and to apply reasonable safeguards. That makes your retention design a data-mapping exercise before it is a configuration exercise. Our piece on why legal client data requires special protection covers that side in more depth.

How Microsoft 365 retention works

Microsoft Purview gives you two building blocks, described in Microsoft's retention settings documentation:

• Retention policies apply to whole locations such as Exchange mailboxes, SharePoint sites, OneDrive accounts, and Teams messages. They can retain, delete, or retain then delete.
• Retention labels apply to individual items or folders, and can be applied manually or automatically. These suit matter-based rules, such as "keep for X years after the matter closes."

For most small firms, a sensible starting structure looks like this:

1. Email and OneDrive: a policy that retains for the period your written policy sets, then deletes or flags for review.
2. Matter workspaces in SharePoint or Teams: labels tied to matter type (for example, probate versus general civil), so closed estate files are not treated like a closed collections matter.
3. Teams chat: a shorter, explicit policy. Informal chats are discoverable, so decide deliberately whether to keep them.
4. Exclusions: anything that must never be auto-deleted, such as trust accounting records, should sit under a longer rule.

The principle that surprises people

When several retention rules or holds touch the same item, the longest retention wins. Nothing is permanently deleted until every applicable requirement has expired. That is protective, but it means a forgotten hold or an overly long policy keeps data, and storage, indefinitely. Review your active policies and holds on a calendar, not when the storage warning shows up.

Timing is not instant

Retention is evaluated by background jobs. Microsoft's documentation notes that expired items can pass through a soft-delete stage before permanent deletion, and that a newly created eDiscovery hold can take up to 24 hours to take effect. For the details of what is preserved and where, see Microsoft's pages on retention for Exchange and retention for Teams. The practical lesson: place holds early, and do not assume a click equals instant protection.

For a click-by-click walkthrough of the email side, see our admin guide to setting up email retention in Microsoft 365.

Litigation holds: the part that fails in practice

A hold is a legal and procedural act first, a technical one second. The American Bar Association's litigation section has a practical look at preserving ESI noting that courts act when loss of relevant electronic information prejudices the other side, even if the loss was unintentional. That is the exposure: not malice, but an auto-delete rule that nobody paused.

A workable hold procedure for a small firm:

1. Decide who can trigger a hold. Usually the managing partner or the responsible attorney, with a named backup.
2. Identify custodians. Attorneys, paralegals, assistants, and anyone who touched the matter. Ask where they keep work, including personal devices and chat apps.
3. Issue a written notice to custodians and to whoever administers your IT.
4. Apply the technical hold in Microsoft Purview to the relevant mailboxes, OneDrive accounts, and sites, and confirm it took effect.
5. Pause conflicting deletion. Check that no policy, label, or manual cleanup process is still purging the same content.
6. Document everything: who was notified, when, what was preserved, and when the hold was confirmed.
7. Review and release only when counsel confirms the matter is resolved.

Proportionality matters as well. The judges' pocket guide warns that blanket preservation can be prohibitively expensive and encourages targeted, defensible preservation, often supported by an early exchange of information about IT systems. A current map of where your data lives makes that conversation far easier.

Common mistakes

• Assuming the retention policy is the hold. It is not, as the comparison table above shows.
• Forgetting recycle bins and "temporary" files. Relevant material must be preserved wherever it sits.
• Ignoring departed staff. A former employee's mailbox and OneDrive may be the key custodian data. Do not let offboarding delete it while a hold is active.
• Skipping the documentation. Showing a reasonable, timely process is your defense if preservation is later questioned.

Licensing: check before you need it

This is where small firms get caught. According to Microsoft's guidance on creating eDiscovery holds, an eDiscovery hold requires an eligible license on every user whose content you preserve, and frontline subscriptions such as Office 365 F1 and F3 do not include the rights to be the target of a hold. Microsoft points to its security and compliance licensing guidance for what each subscription includes and suggests an add-on, such as a compliance add-on, where a subscription falls short.

Two consequences:

• Audit your license mix now. A receptionist or intern on a lower tier is a gap if their mailbox could ever be relevant.
• Do not wait until a demand letter arrives to upgrade licenses. A hold placed on an unsupported user is not a supported configuration.

Licensing changes, so confirm current tiers with Microsoft's documentation or your IT provider before buying.

Retention is not backup

Retention keeps content from being deleted under defined rules. It does not protect you from every way data disappears: a compromised account that deletes mail, a ransomware event that encrypts synced files, an admin error, or a tenant-level problem. Backup is a separate copy, stored independently, with its own retention and a restore you have actually tested.

For a law firm, we recommend you can answer these questions in writing:

• RPO: how much recent work could you lose? (Last night's backup means up to a day.)
• RTO: how long until attorneys can work again after a bad day?
• Coverage: does the backup include Exchange, SharePoint, OneDrive, and Teams, or only mail?
• Immutability: can an attacker with admin credentials delete the backups?
• Test date: when did you last restore a real mailbox or document library and verify it?

It is also worth thinking about what happens when a laptop or drive fails outright. Hardware recovery has its own security considerations, and this guide to data security during recovery is a helpful read on handling confidential data when a device has to leave your office. Client data on a failed drive is still privileged data. Our 9 steps to secure Microsoft 365 for law firms covers MFA, Purview, and backups together.

A starter configuration for a small firm

Use this as a discussion draft with your partners, not a finished policy.

Then add a yearly review, a hold drill (can you place a hold and prove it in an afternoon?), and a restore test.

Our perspective

We work with small law firms in Norman, Moore, and Oklahoma City, and the pattern is consistent. Firms rarely lack a retention setting. They lack a written decision behind it. Someone turned on a one-size policy years ago, nobody recorded why, and nobody knows whether a hold would work if the phone rang tomorrow.

Our advice is to start with the paperwork, not the portal. Decide your retention periods by matter type, name who can call a hold, and only then configure Microsoft 365 to match. Test it. Run a mock hold on a dummy mailbox, confirm in Purview that it applies, and write down how long it took. Restore a file from backup and time that too.

We would also rather tell you plainly that Microsoft 365 alone is not a complete answer. Retention, holds, and backup are three controls, and a firm that has only one is exposed in the other two ways. We explain these in plain language, because the partner who has to approve the policy should understand it, and because a policy nobody understands will not be followed.

— Nicholas

Getting help with the setup

If you would like a second set of eyes on your retention design, our Microsoft 365 support covers policy setup and licensing review, and our backup and recovery service handles the independent copy and restore testing. You can start with the 10-minute readiness audit, which is free, to see where your firm stands. We offer same-day response and no long-term contracts.

FAQ

What is the M365 retention policy?

It is a Microsoft Purview rule that automatically keeps, deletes, or keeps then deletes content in locations like Exchange, SharePoint, OneDrive, and Teams. It is meant for long-term records management. It is not a litigation hold and does not replace one.

Is there a seven-year retention requirement for law firms?

Not as a single universal rule. Requirements vary by state and by matter type. In Oklahoma, for example, Rule 1.15(a) sets five years after representation for client account records, and the Oklahoma Bar Association notes that many files should be kept longer. Put your periods in a written policy.

What is the difference between a retention policy and a litigation hold in Microsoft 365?

A retention policy is routine and scheduled. A hold is a targeted preservation of a person's or site's content for a specific matter, triggered by a decision that litigation is reasonably foreseeable. Because the longest retention wins, a hold prevents deletion even if a policy says to delete.

Do I need a higher license for litigation holds?

Possibly. Microsoft states that eDiscovery holds need an eligible license on each preserved user, and that frontline plans such as F1 and F3 do not qualify. Check Microsoft's current licensing guidance or ask your IT provider before you need to place a hold.

Sources

• Managing Discovery of Electronic Information: A Pocket Guide for Judges
• A Practical Look at Preserving ESI, American Bar Association
• Configure Microsoft 365 retention settings, Microsoft Learn
• Create holds in eDiscovery, Microsoft Learn
• Learn about retention for Exchange, Microsoft Learn
• Learn about retention for Teams, Microsoft Learn

Recommended

• 9 Steps to Secure Microsoft 365 for Law Firms: MFA, Purview, Backups
• Setting Up Email Retention in Microsoft 365: An Admin's Guide
• Why Legal Client Data Requires Special Protection