Litigation Hold

-

 

⚖️ What is Litigation Hold?

Litigation Hold is a feature in Microsoft Exchange / Microsoft 365 that preserves mailbox content (like emails, calendar items, etc.) even if the user deletes them.

It's used when an organization is under investigation, in a legal dispute, or needs to preserve data for compliance reasons.

🔐 Purpose of Litigation Hold:

  • Prevents deletion or alteration of mailbox data.

  • Keeps all versions of items (even edits).

  • Ensures that data is preserved for as long as needed—even if the user tries to get rid of it.

🧩 Types of Holds in Microsoft 365:

There are two main types:

1. 🏛️ Litigation Hold (Mailbox-Level Hold)

Where it's applied: Directly on an Exchange mailbox (via PowerShell or Exchange Admin Center)

Key Features:

  • Captures all mailbox content (emails, calendar, contacts, etc.).

  • Preserves deleted and edited items.

  • Items are held in the "Recoverable Items" folder.

  • You can set:

    • Hold duration (infinite or time-bound)

    • Start immediately or schedule it

Use case: When a specific user's mailbox needs to be preserved during litigation.

2. 🔍 eDiscovery Hold / In-Place Hold (via Core eDiscovery)

Where it's applied: Through Microsoft Purview Compliance Portal, under eDiscovery cases

Key Features:

  • Can target specific content using filters (e.g., keywords, date ranges, sender, recipients).

  • Can apply hold across multiple mailboxes, SharePoint, Teams, OneDrive, etc.

  • More flexible and granular than standard Litigation Hold.

Use case: During a legal investigation or internal inquiry involving multiple users or teams.

🧠 Advanced Type (via Advanced eDiscovery):

In Advanced eDiscovery, holds become even more dynamic and context-aware:

  • You can define custodians (users under investigation).

  • Use AI to detect relevant data.

  • Manage notifications and workflows around the hold.

🔄 Quick Comparison Table:

FeatureLitigation HoldeDiscovery/In-Place Hold
ScopeWhole mailboxSpecific content (filtered)
Applies toExchange Online onlyExchange, SharePoint, Teams
GranularityLowHigh
Applied viaExchange Admin / PowerShellMicrosoft Purview (Compliance Center)
Use casePreserve full mailboxTargeted legal/investigative hold

🧪 Real-life Scenario:

Your company is sued, and legal needs all email from an employee preserved.
✅ Use Litigation Hold.

HR is investigating a leak and needs to preserve only Teams chats with specific keywords from 5 users.
✅ Use eDiscovery Hold via Core or Advanced eDiscovery.

Popular posts from this blog

Autodiscover

-
  "Autodiscovery" (or  Autodiscover , more precisely in Microsoft terms) is a service that automatically configures email clients, mainly Outlook, to connect to mailboxes without users having to enter all the settings manually. 💡  What is Autodiscover? Autodiscover  is a Microsoft Exchange service that provides configuration information to email clients (like Outlook or mobile devices) so they can set themselves up with minimal user input. 🔧  What Does Autodiscover Do? When a user enters just their  email address and password , Autodiscover helps the client automatically find: Mail server addresses (Exchange or Microsoft 365) Mailbox settings Calendar and contact URLs Offline address book (OAB) settings Outlook Anywhere settings Unified Messaging (if used) Internal and external URLs 🧠  How It Works (Simplified Flow): User opens Outlook and enters their email address + password. Outlook sends a request to the  Autodiscover service : Tries a few ...
Read more

Azure Active Directory (Azure AD)

-
  Azure Active Directory (Azure AD)  is Microsoft’s  cloud-based identity and access management service , which is the cloud counterpart to the traditional  on-premises Active Directory (AD) . While  Active Directory (AD)  is designed for managing users, groups, and devices within an organization's  internal network ,  Azure AD  extends this functionality to manage identities across cloud-based resources, applications, and services. Azure AD helps organizations manage user access to cloud services (like  Office 365 ,  Azure services ,  third-party apps , etc.) and provides features like  Single Sign-On (SSO) ,  Multi-Factor Authentication (MFA) , and more — all while maintaining security and compliance in the cloud. Key Differences Between Active Directory (AD) and Azure Active Directory (Azure AD): Deployment Location : AD  is  on-premises , running in an organization's internal network. Azure AD  is...
Read more

Active Directory (AD)

-
   Active Directory (AD)  is a  directory service  developed by Microsoft to manage and organize a network's resources, such as users, computers, printers, and other devices. It’s a central component in managing permissions, security, and access control across the entire network. AD allows admins to control who can access what within the network and apply policies and settings consistently. Here’s a more detailed breakdown of  Active Directory : Key Features of Active Directory: Directory Service : It acts as a  centralized database  for storing and managing directory information (like users, computers, groups, and resources). It uses  LDAP (Lightweight Directory Access Protocol)  for communication between client machines and the server. User Authentication and Authorization : Active Directory ensures  only authorized users  and  computers  can access the network resources. It enforces  user policies  (like ...
Read more