Office 365 process backups retain the original version and any modified versions of each item. Even if a user deletes an item from their mailbox using any version of Outlook, Office 365 retains the item for discovery. Also, during litigation hold: On the Compliance Details page, click Add/Remove from Archive. The Microsoft Purview eDiscovery (Premium) solution in Microsoft 365 builds on the existing eDiscovery and analytics capabilities in Office 365. This new solution, called eDiscovery (Premium), provides an end-to-end workflow for curating, collecting, reviewing, analyzing, and exporting content that responds to your organization`s internal and external surveys. In addition, legal teams can manage the entire legal hold notification workflow to communicate with custodians involved in a case. Therefore, messages (related to public folder hierarchy synchronization) that contain the phrase „HierarchySync“ in the subject line are not retained. Note visible to the user: Use this field to inform the user that their mailbox is on litigation hold. The hint appears on the Account Information page in the user`s mailbox if the user is using Outlook 2010 or later. To access this page, users can click File in Outlook.

When a mailbox, SharePoint site, or OneDrive account is removed from an archive, a „deferred store“ is configured. There is a 30-day delay to ensure that the data is not permanently deleted from the content location. During these 30 days, IT administrators and legal departments have the option to search for and/or restore content to be deleted. The timeline holds the work slightly different for each Office 365 workload, so we`ll explain in more detail below. When a new hold is created, you can set a hold duration. This basically means that all deleted or modified data will be retained for the retention period and then permanently deleted. Other options are to keep the data indefinitely or until the suspension is removed. Mailboxes: A deferred retention area is configured for a mailbox the next time the Managed Folder Wizard processes the mailbox and detects that an eDiscovery hold has been removed.

Specifically, deferred retention is applied to a mailbox when the Managed Folder Wizard sets one of the following mailbox properties to True: If a content location is part of multiple storage areas in the same case, retention requests are combined by the OR operators when you browse that content location with the option for all content in the case. If a content location is part of two different breakpoints, one based on a query and the other infinite (where all content is put on hold), then all content is a search because of infinite pause. Of course, as a company with Microsoft Office 365, end users cannot view, change, or delete legal retention periods for their data. This is a purely IT or perhaps legal team process, depending on your organizational structure, that is done from time to time. When a store associated with an eDiscovery case is placed on a mailbox, the deleted items are moved from the Deletes subfolder to the DiscoveryHolds subfolder and retained until the mailbox is released from the eDiscovery store. Each hold you create has a hold report that allows you to quickly view all the items that have been added to that hold. By default, suspend reports are scheduled to run at 11:00 p.m., which is the first time you can view all items associated with a hold. Your administrator can configure when these reports are generated at any time or run the reports manually. For more information about configuring report schedules, see the links in See Also. Stay transparent to the user by not having to stop risk management (MRM). If your organization is sued, you will be asked for certain electronically stored information (ESI). Specifically, your organization may be required to retain the contents of an employee`s mailbox or provide all documents related to a case.

A value of True indicates that litigation/In-Place eDiscovery hold searches are enabled in the mailbox for queued items. When a user tries to edit or delete content on a site that is in the archive, SharePoint first checks whether the content has changed since the suspend was applied. If this is the first change since the hold was applied, SharePoint copies the content to the retention library, and then allows the user to edit or delete the original content. Note that any content in the site can be copied to the preservation retention library, even if the content does not match the filter of the eDiscovery set that initiated the suspension. After administrators confirm the retention period and the types of vault alerts they want to send, they can save the lock to take effect. When a user`s mailbox is searched, Microsoft 365 or Microsoft Teams groups to which the user belongs are not searched. When you set up a Microsoft 365 Groups or Microsoft Team store, only the group mailbox and group site are retained. Group members` mailboxes and OneDrive for Business sites aren`t locked unless you explicitly add them as managers or specify their data sources. Therefore, if you need to put a Microsoft 365 group or team on hold for a specific admin, you need to associate the group site and group mailbox with the admin (see Manage managers in eDiscovery (Premium)). If the Microsoft 365 group or Microsoft team does not belong to a single custodian, consider adding the source to a vault. Select the content locations you want to keep. You can store mailboxes, sites, and public folders in the archive.

For more information about retaining Teams content, see Set legal retention for a Microsoft Teams user or team. If a deferred archive is set for the mailbox (if any of the preceding properties are set to True), the mailbox is still considered pending indefinitely, as if the mailbox had placed an archive for litigation. After 30 days, the delay lock expires and Microsoft 365 automatically attempts to remove the delay lock (by setting the DelayHoldApplied or DelayReleaseHoldApplied property to False) so that the lock is removed. After one of these properties is set to False, the corresponding items marked for deletion are deleted the next time the mailbox is processed by the Managed Folder Wizard. Teams is based on Office 365 groups. Therefore, placing Office 365 Groups in eDiscovery hold is similar when Teams content is denied. Organizations with at least one E3 plan or equivalent add-on licenses can take advantage of Office 365`s core eDiscovery features, which allow them to perform litigation hold for teams, retention of OneDrive disputes, and more. From the Office O365 Compliance Center, admins can run the Office 365 Legal Hold Assistant to enable searches with specific Teams and OneDrive accounts.

From there, you can let the wizard retrieve the contents of specific keywords and queries. Advanced collection tactics that include Teams Litigation Hold require PowerShell coding to run. For many software applications, the application of a statutory retention obligation does not inform the end user that this has occurred (if it triggers unusual and potentially onerous behavior). Query-based retentions should not be used to perform targeted retention, such as keeping documents in a specific folder or site, or using other location-based retention criteria. This can lead to unexpected results. We recommend that you use non-location-based retention criteria, such as keywords, date ranges, or other document properties, to preserve site documents. After a mailbox, SharePoint site, or OneDrive account is removed from an eDiscovery archive, deferred retention is applied. This means that the actual removal of the lock is delayed by 30 days to prevent the permanent deletion of data from a content location. This allows administrators to find or restore deleted content after an eDiscovery hold is removed. Details about how deferred retention works for mailboxes and sites vary.

In the Managed By field, type the name of the person or group responsible for the records manager responsible for managing the archive.