Office 365 Litigation Hold

Posted on by

Litigation Hold is offered by Microsoft to preserve all mailbox content, including deleted items and original versions of modified items for a specified period which can be unlimited or until the Hold is removed from the mailbox.

Litigation Hold works by preserving items in the Recoverable Items folder in the user’s mailbox.  The default size for this folder is 30 GB which is then increased to 100GB when litigation hold is enabled.

Enabling Litigation Hold

Litigation Hold can be enabled either via EAC or Exchange Management Shell

EAC

Within the user’s mailbox properties, click Mailbox features.

Under Litigation hold: Disabled, click Enable to place the mailbox on Litigation Hold.

Within Litigation Hold duration (days) enter in how long mailbox items are held, leaving this box blank indicate held indefinitely

Exchange Management Shell

To place a specific mailbox on Litigation Hold for 2555 days (7 years) the following command can be used

Set-Mailbox bsuneja@contoso.com -LitigationHoldEnabled $true -LitigationHoldDuration 2555

To place all user mailboxes in the organization on Litigation Hold and sets the hold duration for one year (365 days) the following command can be used

Get-Mailbox -ResultSize Unlimited -Filter "RecipientTypeDetails -eq 'UserMailbox'" | Set-Mailbox -LitigationHoldEnabled $true -LitigationHoldDuration 365

How Litigation Hold works

  • Normally when a user deletes an item from their mailbox it is moved into the Recoverable Items folder. The item remains there until either the user purges the Recoverable Items folder or when the deleted item retention period expires, at this time it is moved to the Purges subfolder in the Recoverable Items folder and marked for permanent deletion.
  • When a mailbox is placed on Litigation Hold, items in the Purges subfolder are preserved for the hold duration specified by the Litigation Hold.

Things to consider

  • When using the above command to place all mailboxes into litigation hold, only mailboxes that exist at that time will be placed on hold. If new mailboxes are created later then the command will need to be run again.
  • The Recoverable Items folder has its own storage limit, so items in the folder do not count towards the mailbox storage limit. Preserving mailbox data for a long period of time will result in growth of the Recoverable Items folder in a user’s mailbox which could become full. This can be overcome by enabling auto-expanding Archive. See here for post on Archive mailbox

Info referenced from: https://docs.microsoft.com/en-us/exchange/policy-and-compliance/holds/litigation-holds?view=exchserver-2019

Leave a Reply