Understanding Litigation Hold Office 365 and How to Enable It

Enterprises dealing with lawsuits or initial investigations use this compliance feature to safeguard ESI (Electronically Stored Information),as it is a first and most critical legal obligation.

So, if you’re an IT administrator and tasked to secure this data by implementing a Microsoft 365 Litigation Hold, stay tuned till the end! This technical guide will uncover “What exactly does a litigation hold do in Office 365?” and how to enable it for individual users and all users.

What is Litigation Hold Office 365 and How does it Work?

A Litigation Hold (or Legal Hold) in Microsoft 365 is a compliance feature that prevents users or automated policies from permanently deleting mailbox data. It “freezes” the original and modified items. Even if it gets deleted, the items can be searched in the hidden Recoverable Items Folder and exported via eDiscovery (for legal, regulatory, or investigative purposes).

Here’s how the hidden subfolders changes its operations when mailbox hold M365 is active:

• Deletion: This subfolder stores the soft-deleted (Deleted Items Folder) items. Usually, they expire after 14 days, but an Office 365 Litigation Hold stops the process.
• Purges: When a user tries to “hard delete’ an item, the respective items land in this subfolder and get locked. Instead of getting destroyed by the Managed Folder Assistant in normal circumstances.
• Versions: Using Microsoft’s “Copy-on-write” page protection, it instantly generates & saves a copy of the original item when a user modifies the sent email, calendar event, or contract before the modifications are saved.
• Substrate Holds: It stores the copies of modified or deleted Teams messages in this specific Exchange Subfolder.

Note: In-Place Hold Office 365 was an older Exchange feature that allowed query-based holds. Microsoft has retired it for the new eDiscovery hold Office 365 feature.

Normally, when an employee deletes an email or an automated background process deletes old messages, the data is deleted from Microsoft’s service forever! But an Office 365 Litigation Hold suspends this action.

So what happens if an employee deletes an email while on hold?

When an employee deletes an email while on hold, the email gets deleted from the inbox and the Deleted Items folder (as he/sheexpected). But Exchange intercepts the permanent deletion and sends the email into the hidden Recoverable Items folder, where eDiscovery managers can retrieve it easily. As for edited items, the original version is saved.

And if you’re wondering, “How is a Litigation Hold different from a retention policy?”, check out the given infographic to understand the difference between a M365 Litigation Hold and O365 preservation policy or retention label.

Can an employee tell if their account is on Litigation Hold?

No, employees cannot tell if their account is on Office 365 Litigation Hold by default. The hold runs completely in the backend. And it doesn’t send any notification to the employees.

However, if the legal team reckons an employee should be aware that his/her mailbox is on hold, an admin can configure the “Note visible to the user” field when setting up a Microsoft 365 Litigation Hold. It will send a note in the File tab within the user’s desktop Outlook application (Outlook 2010 or newer).

So, how do I put a user’s mailbox on legal hold? Let’s find out in the next section.

People Also Explored: Retention Policies in Office 365: Zero to Hero Guide

How to Enable Litigation Hold in Office 365? 3 Proven Methods

Microsoft 365 offers a few different methods depending on the data and users for Litigation Hold. So, how to set up Litigation Hold in Microsoft 365? Simply choose the method based on what you want to freeze (just emails or emails plus Teams and OneDrive files) and the users involved.

Method #1: Via Microsoft Purview Compliance Portal

Microsoft Purview Compliance Portal is the industry standard and most-recommended method to enable a Litigation Hold in Office 365. It utilizes eDiscovery Holds that allow users to propagate the hold across the Microsoft 365 ecosystem. The following are the prerequisites for configuring a Microsoft 365 Litigation Hold:

• Office 365 legal hold license requirement: eDiscovery Hold requires a qualifying enterprise license (Office 365 E3, E5, or Microsoft 365 Business Premium with specific add-ons.
• Frontline worker licenses (such as F1 or F3) are not supported.
• eDiscovery Manager or eDiscovery Administrator role group (within the Purview permission settings).

Step #1: Open Microsoft Purview and Create an eDiscovery Case

• Go to the Microsoft Purview compliance portal and log in using admin credentials.
• In the left navigation pane, scroll down to eDiscovery and click Standard (or Premium, depending on the license.
• Right-click Create a case (name it appropriately) and save it.

Step #2: Create the Office 365 Litigation Hold

• Select the created case and click on the Holds tab (at the top of the screen).
• Click Create >> name your hold (use a descriptive name) >> hit Next.

Step #3: Choose Custodians to Freeze

• Toggle on Exchange email, SharePoint sites, or Exchange public folders.
• Click Choose users, groups, or teams. It will specify the exact data that needs to be placed on hold.

Step #4: Submit and Sync

• Optional Step: Enter specific keywords or specify the date range in the query section to freeze the emails containing those keywords. To freeze everything, leave the query section blank.
• Lastly, review the settings and click Submit. It will take anywhere from 12 to 24 hours to apply across all Microsoft 365 services.

To monitor the exact status of the freeze, use the Microsoft Purview dashboard. It displays statuses like Draft, In Progress, or On.

Method #2: Using the Exchange Admin Center

• Go to Microsoft 365 Admin Center >> log in.
• Expand the left menu >> click Exchange. It will open the Exchange Admin Center,
• Go to Recipients and select Mailboxes.
• Search for the target user and click the display name. This will open the properties pane.
• In the properties pane, click the Others tab and select Manage litigation hold under the Litigation hold section.
• Toggle the switch to On, and configure one of the three optional fields:
• Hold duration: leave blank for an infinite hold, or enter a number of days.
• Note: A message will display to the user in Outlook (leave blank for silent hold)
• URL: Organization’s legal guidelines link.
• Finally, click Save. The Litigation Hold Office 365 will be active within 60 minutes.

Method #3: The Exchange Online PowerShell (Automation)

Enabling a Litigation Hold via Exchange Online PowerShell allows IT administrators to apply, modify, and verify holds at scale and with sheer precision. Here are the prerequisites for enabling a Litigation Hold in Office 365 PowerShell:

• Connection with backend Exchange Servers.
• Modern Exchange Online PowerShell module (V3)
• Account with Exchange Administrator Role

Step #1: Run PowerShell as an Administrator and Connect to the Backend Exchange Servers

Open PowerShell as an Administrator [Press Win + X >> Terminal (Admin)] and run the given command:

# Install the module if you don’t have it

Install-Module -Name ExchangeOnlineManagement -Force

# Connect to your tenant (prompts for modern authentication/MFA)

Connect-ExchangeOnline

Step #2: Apply the Litigation Hold

• The Infinite Hold: The data remains locked until an administrator explicitly runs a command to remove the hold. (Replace [email protected] with your credentials

Set-Mailbox -Identity "[email protected]" -LitigationHoldEnabled $true

• Time-Based Hold (Duration): To hold items for a particular period.(Replace [email protected] with your credentials)

Set-Mailbox -Identity "[email protected]" -LitigationHoldEnabled $true -LitigationHoldDuration 2555

Note: The duration-based Litigation Hold Office 365 is calculated based on the date the item was received or created, not the date it’s enabled. It means if you set a 2555-day (7-year) litigation hold, the email received 6 years ago will be held for 1 more year.

• The Document Hold (Adding Legal Context): To stamp the mailbox with the Litigation Hold’s owner and a comment.

Set-Mailbox -Identity "[email protected]" -LitigationHoldEnabled $true -LitigationHoldOwner "Legal Dept - Project Titan" -RetentionComment "Do not remove hold without contacting General Counsel."

Step #3: Bulk Hold via CSV

Want to know how to enable Litigation Hold Office 365 for all users? Simply create a CSV file named holds.csv (with a single column header named EmailAddress). Add the row with the target email addresses, save it to your C:\ drive, and run the given script:

# Import the CSV and loop through each address

$Users = Import-Csv "C:\holds.csv"

foreach ($User in $Users) {
Write-Host "Applying hold to $($User.EmailAddress)..." -ForegroundColor Cyan
Set-Mailbox -Identity $User.EmailAddress -LitigationHoldEnabled $true
}
Write-Host "Bulk hold process complete." -ForegroundColor Green

Step #4: Verify the Litigation Hold Office 365

Verifying the Litigation Hold in Office 365 is a critical step. It is proof of a successful Litigation Hold and is often demanded by the legal departments. To verify a Litigation Hold in Office 365, use the given script in PowerShell:

#Extract the exact hold status (including applied date and applied user)

Get-Mailbox -Identity "[email protected]" | Format-List LitigationHoldEnabled, LitigationHoldDate, LitigationHoldOwner, LitigationHoldDuration

Expected Output:

• LitigationHoldEnabled: True
• LitigationHoldDate: 7/22/2026 10:15:00 AM
• LitigationHoldOwner: [email protected]
• LitigationHoldDuration: Unlimited

Step #5: Enable Auto-Expanding Archiving

Do you know that when a Litigation Hold is executed via PowerShell, Microsoft immediately increases the hidden Recoverable Items folder quota from 30 GB to 110 GB?

Yes, Microsoft executes this silently in the background. But the issue occurs when the user receives a massive amount of email and stays on hold for years. The Recoverable Items folder maxes out and blocks the user from sending or deleting any emails.

So, to prevent this, enable Auto-Expanding Archiving. It prevents users from being blocked (from sending or deleting any emails) when the 110 GB quota hits the limit. To do so, run the given commands:

# Enable the standard archive

Enable-Mailbox -Identity "[email protected]" -Archive

# Enable auto-expansion to prevent storage caps

Enable-Mailbox -Identity "[email protected]" -AutoExpandingArchive

Also Check Out: Here’s “Microsoft Office 365 Backup and Recovery Policy” Guide

How to manage Litigation Holds during tenant migrations?

Managing Microsoft 365 litigation holds during tenant to tenant migration (due to corporate mergers, acquisitions, or divestitures) can be overwhelming & intense for IT administrators.

The reason is quite simple: Standard mailbox migration methods (such as basic IMAP sync, standard Exchange cutover, or basic API scripts) only extract the visible IPM mailbox items (Inbox, Sent Items, user folders). Skipping hidden subfolders like Purges, Versions, and DiscoveryHolds inside the non-IPM Recoverable Items Folder.

The Effect: The enterprise migrates users on legal hold without moving these non-IPM folders, leaving legally binding ESI evidence in the source tenant or lost upon decommissioning. Resulting in exposure to severe spoliation penalties in legal proceedings.

Bonus: Best Practice Migration Checklist for Held Accounts:

• Create a CSV export of all hold custodians in the source tenant using PowerShell.
• Pre-provision destination account by creating destination accounts and assigning Exchange Online Plan 2 (for Enterprise E3/E5) licenses.
• Before starting the data transfer, activate Litigation Hold on the target mailboxes in the destination tenant.
• Use the SysTools enterprise-grade migration tool to completely transfer primary, archive, and historical folder contents.
• Verify item counts and checksums by running a Purview eDiscovery search across both the source and destination mailboxes. Especially before shutting down the source tenant.

Related Post: Split Office 365 Tenant Smoothly: Easily Migrate After Divestiture and Spin-Off

Conclusion

Microsoft 365 Litigation Hold is a critical compliance feature for enterprises facing a lawsuit or conducting an internal investigation. It is a process for preserving user data for legal investigation. So, if you’re assigned to implement a Microsoft 365 Litigation Hold, choose a suitable method shared in this comprehensive guide to establish a hold across your entire Microsoft 365 ecosystem.

Also, for any further queries related to Office 365 Litigation Hold or beyond, you can reach out to us at [email protected] for free, tailored solutions!

Helpful Reads:

• How to Fix Office 365 Archiving Not Working?
• How to Restore Deleted Mailbox in Office 365 Beyond the Retention Period?
• Things to Know About Microsoft Office 365 Email Archiving Solution
• Office 365 Deleted Item Recovery – Know Simple Steps

FAQs (Frequently Asked Questions)

Q.1 How to turn off Litigation Hold in Office 365?
Follow the given steps to turn off Litigation Hold in Office 365:
Open Exchange Admin Center >> Recipients >> Mailboxes.
Select the user >> open the Others or Mailbox features tab.
Toggle Litigation Hold to Off. The changes may take up to 4-6 hours.

Q.2 Does Litigation Hold use up my regular Office 365 storage space?
Fortunately, No! A Litigation Hold doesn’t consume your regular Office 365 storage space. When a hold is active, Microsoft 365 automatically provides a separate 110 GB storage quota for the hidden “Recoverable Items” folder to save deleted or modified items.

Q.3 Does Office 365 E3 include Litigation Hold?
Yes, Office 365 E3 includes Litigation Hold Functionality. As an administrator, you can access core eDiscovery features to preserve Exchange mailbox content for legal review.

Q.4 Office 365 legal hold license requirement?
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>To place a mailbox on legal/litigation hold, an Exchange Online Plan 2 license or broader suite such as Microsoft 365 E3/E5 or Office 365 E3/E5 is required. Mailboxes with Exchange Online Plan 1 need a separate Exchange Online Archiving add-on license.

Q.5 Does the hold cover Microsoft Teams and OneDrive?
Yes, the hold covers Microsoft Teams and OneDrive.