Litigation Hold in Office 365 (Microsoft 365)

Litigation Hold in Office 365 (Microsoft 365)

A litigation hold in Office 365 (Microsoft 365) is a feature that preserves all email data within a user's mailbox, even if the user deletes emails. This feature is typically used to ensure that emails are preserved for legal or compliance reasons, especially during legal proceedings, investigations, or audits. When a litigation hold is applied, emails cannot be permanently deleted and will be retained for the duration of the hold, regardless of whether a user tries to delete them.

Here is a step-by-step process to set up and manage a litigation hold in Office 365 (now part of Microsoft 365), including detailed explanations for each step:

---

1. Prerequisites for Setting a Litigation Hold

Before applying a litigation hold, make sure:

• You have the necessary permissions. You need to be a Global Administrator, Compliance Administrator, or Exchange Administrator in the Microsoft 365 tenant.
• The user whose mailbox will be placed under litigation hold must have an Exchange Online mailbox (usually part of Microsoft 365 plans like Business, Enterprise, or Education).

---

2. Accessing Microsoft 365 Compliance Center

To apply a litigation hold, the Microsoft 365 Compliance Center is where you can manage holds, retention policies, and other compliance-related tasks.

1. Log in to Microsoft 365 Admin Center:

   • Go to the Microsoft 365 Admin Center.
   • Use your administrator credentials to log in.

2. Navigate to Microsoft 365 Compliance Center:

   • In the left-hand navigation menu, select Compliance to open the Microsoft 365 Compliance Center.
   • Alternatively, you can directly access the Compliance Center.

---

3. Enabling Litigation Hold on a User Mailbox

Step-by-Step Process to Enable Litigation Hold:

1. Go to the Microsoft 365 Compliance Center:

   • Once inside the Microsoft 365 Compliance Center, look for Information Governance or Data Lifecycle Management depending on your Microsoft 365 version.

2. Open the 'eDiscovery' Section:

   • In the Compliance Center, select eDiscovery under the Solutions menu.
   • Click on Core eDiscovery (or Advanced eDiscovery if your subscription supports it).
   • If you're in the Core eDiscovery section, you may see a list of Cases.

3. Select the User's Mailbox:

   • In the Core eDiscovery case or Advanced eDiscovery section, navigate to the Searches or Holds tab, depending on the exact version of the Compliance Center you're using.
   • Select the Holds option to create a new litigation hold.

4. Create a New Hold:

   • Click + New or Create hold.
   • A wizard will appear asking for details of the hold.

5. Select 'Mailbox' to Apply Hold:

   • You’ll be prompted to choose what data you want to hold. Select User mailboxes.
   • Enter the user's name or email address in the search box.
   • After selecting the user, the system will confirm if the user has an active Exchange Online mailbox.

6. Configure the Litigation Hold Settings:

   • Choose Litigation hold as the type of hold.
   • You can set a hold duration. By default, a litigation hold can last indefinitely, but you can also specify an end date for the hold if needed.
   • Retention settings: Decide if you want to retain all items (including deleted items) or a subset of the mailbox data.

7. Review and Apply the Hold:

   • Review the settings you have configured for the litigation hold.
   • Click Apply to activate the litigation hold on the selected user’s mailbox.

---

4. Verifying Litigation Hold is Enabled

Once the litigation hold is applied, it's important to verify that it has been successfully enabled.

1. Go to the User’s Mailbox in Exchange Admin Center:

   • In the Microsoft 365 Admin Center, navigate to Exchange under Admin centers.
   • Go to Recipients > Mailboxes.
   • Find the user’s mailbox and click on it.

2. Check the Litigation Hold Status:

   • Under the Mailbox Features section, locate Litigation Hold.
   • The status will be displayed here as Enabled.
   • You can also check the hold duration and hold details if configured.

---

5. Understanding How Litigation Hold Works

Once the litigation hold is applied, the following key behaviors occur:

1. Retention of Deleted Items:

   • Emails that the user deletes are not actually deleted. Instead, they are moved to a hidden folder within the mailbox called the Recoverable Items folder.
   • This folder can only be accessed by administrators or via specific eDiscovery searches, and the emails remain there until the litigation hold is removed or expires.

2. Cannot be Overridden by User Actions:

   • Even if a user tries to delete messages or empty their Deleted Items folder, the system preserves the messages and prevents permanent deletion.
   • Archive folders also cannot remove the held items.

3. Mailbox Size:

   • The emails retained under litigation hold contribute to the user’s mailbox size. If you anticipate the mailbox growing too large, you may need to manage retention policies or archive older items.
   • The data is stored securely on the server, and administrators have access to the retained data.

---

6. Managing Litigation Hold (Modify or Remove)

If you need to modify or remove the litigation hold from a user's mailbox, follow these steps:

1. Navigate to Compliance Center:
   • Go to the Microsoft 365 Compliance Center and access eDiscovery.
2. Access the Hold Section:
   • In the Holds section, select the litigation hold that you want to modify or remove.
3. Modify the Hold:
   • If you need to modify the hold (e.g., change the duration), select Edit and make the necessary changes.
4. Remove the Hold:
   • To remove the hold completely, select Remove hold. Be cautious, as this action will allow the user to delete messages, and the emails will no longer be preserved.

---

7. Searching for Data Under Litigation Hold (eDiscovery)

One of the most important aspects of litigation hold is the ability to perform an eDiscovery search to find preserved content. You can search for email content that is under litigation hold using Core eDiscovery or Advanced eDiscovery.

Steps to Search Data Under Litigation Hold:

1. Create a New eDiscovery Search:

   • Go to eDiscovery > Searches in the Compliance Center.
   • Click New Search and provide a name for the search.

2. Specify Search Criteria:

   • Define criteria like keywords, date ranges, or sender/recipient information.
   • Choose whether you want to search emails, OneDrive files, or SharePoint data (depending on your needs).

3. Run the Search:

   • Once the search is set up, run it. You’ll be able to view the results of emails or files that match your criteria.
   • If necessary, export the results for further investigation or legal action.

---

8. Key Points to Remember About Litigation Hold

• Legal Compliance: Litigation hold ensures that emails are preserved for legal, regulatory, or compliance reasons.
• Indefinite Duration: A litigation hold can last indefinitely until it is removed or changed by an administrator.
• User Deletions: Even if a user deletes emails, they remain accessible to administrators for legal purposes.
• Mailbox Size Impact: Emails held under litigation hold count toward the mailbox size limit, which may necessitate planning for mailbox growth.
• Data Integrity: Users cannot circumvent the hold; even if they try to delete emails, they will remain preserved on the server.

---

Conclusion

In Microsoft 365, the litigation hold feature is crucial for businesses that need to comply with legal requirements by ensuring that email data is preserved and cannot be tampered with or deleted during investigations or legal actions. By following the above steps, you can easily configure and manage litigation holds to ensure your organization meets its legal obligations.