Manage holds in eDiscovery (Premium)

You can use a Microsoft Purview eDiscovery (Premium) case to create holds to preserve content that might be relevant to your case. Using the eDiscovery (Premium) hold capabilities, you can place holds on custodians and their data sources. Additionally, you can place a noncustodial hold on mailboxes and OneDrive for Business sites. You can also place a hold on the group mailbox, SharePoint site, and OneDrive for Business site for a Microsoft 365 group. Similarly, you can place a hold on the mailbox and site that are associated with Microsoft Teams. When you place content locations on hold, content is held until you release the custodian, remove a specific data location, or delete the hold policy entirely. After you create an eDiscovery hold, it may take up to 24 hours for the hold to be applied.

View custodian-based holds

In some cases, you may have a set of custodians that you've identified and decided to preserve their data during the case. In eDiscovery (Premium), when these custodians are placed on hold, the user and their selected data sources are automatically added to a custodian hold policy.

Points to remember about hold policies:

• The best policy status is fetched when a location is viewed in a data source
• If the existing applied policy is deleted or released, the system replaces the hold policy status and name with next best applied or active policy.
• Only 1 policy per location is reported. However, there can be more than 1 policy impacting the location within the case. View the hold report to determine all applicable policies.
• The status for a location is fetched only from the policies applicable to the case. A policy from another case won't be referred to highlight the Hold status of the location.
• The hold status of a location is displayed in the Hold status column in the hold report.

To view the custodian hold policy:

1. In the Microsoft Purview compliance portal, select eDiscovery > Premium to display the list of cases in your organization.
2. Go to the Sources tab to add custodians within your case. To learn how you can add and place custodians on hold within an eDiscovery (Premium) case, see Add Custodians to a case. If you have already added custodians and placed them on hold, go to step 3.
3. Go to the Holds tab and select CustodianHold(HoldId) and ensure the hold is placed successfully.

The hold status shown for a custodian in the data source tab is the most restrictive status for all holds in the underlying locations within the custodian or noncustodial data source. For example, if a custodian is added and includes their mailbox, OneDrive, and several Teams channels, all these data sources are placed on hold. However, if the hold for OneDrive returns an error but hold on all other data sources is successful, the hold status for the custodian is Not on Hold because the most restrictive status also applies to all of the underlying holds.

For an individual location within a data source, the hold status of that location is determined using all the hold policies applied on that location and the distribution status. The hold status of any successfully applied hold is applied. For example, a location is part of three hold policies and two policies have a Failed/error hold status. If the third policy has a hold successfully applied, then the hold status of the location would be On Hold based on the success of the hold on the third policy.

View noncustodial holds

In some cases, you may have a set of data that isn't tied to a specific custodian, but you need to identify the data as relevant to the case and preserve it. When these noncustodial sources are placed on hold in eDiscovery (Premium), the selected data sources are automatically added to a noncustodial hold policy.

To view a noncustodial hold for an eDiscovery (Premium) case:

1. In the compliance portal, select eDiscovery > Premium to display the list of cases in your organization.
2. Select the Sources tab to add noncustodial locations within your case. To learn how you can add and place noncustodial data on hold within an eDiscovery (Premium) case, see Add noncustodial data sources to an eDiscovery (Premium) case. If you've already added noncustodial location and placed them on hold, go to step 3.
3. Select the Holds tab and select NCDSHold(HoldId) and ensure hold is placed successfully.

The source policy for the noncustodial location is shown below the hold status. The hold status of that location is determined using all the hold policies applied to the location and the distribution status. The least restrictive hold status of all the statuses is applied.

Placing custodial and noncustodial locations on hold

Placing custodial and noncustodial locations on hold preserves all the content in the locations. For steps to place query-based hold in eDiscovery (Premium), see Create eDiscovery holds in an eDiscovery case.

Place a hold on Microsoft Teams and Microsoft 365 groups

Microsoft Teams is built on Microsoft 365 groups. Therefore, placing them on hold in eDiscovery (Premium) is similar. Keep the following things in mind when placing Microsoft 365 groups and Microsoft Teams on hold:

• To place content located in Microsoft 365 groups and Microsoft Teams on hold, you have to specify the mailbox and SharePoint site that associated with a group or team.

• Run the Get-UnifiedGroup cmdlet in Exchange Online to view properties for a Microsoft 365 group or Microsoft Team. This method is a good way to get the URL for the site that's associated with a Microsoft 365 group or a Microsoft Team. For example, the following command displays selected properties for a Microsoft 365 group named Senior Leadership Team:

  Get-UnifiedGroup "Senior Leadership Team" | FL DisplayName,Alias,PrimarySmtpAddress,SharePointSiteUrl
  DisplayName            : Senior Leadership Team
  Alias                  : seniorleadershipteam
  PrimarySmtpAddress     : [email protected]
  SharePointSiteUrl      : https://contoso.sharepoint.com/sites/seniorleadershipteam
  

  Note

  To run the Get-UnifiedGroup cmdlet, you have to be assigned the View-Only Recipients role in Exchange Online or be a member of a role group that's assigned the View-Only Recipients role.

• When a user's mailbox is searched, any Microsoft 365 group or Microsoft Team that the user is a member of isn't searched. Similarly, when you place a Microsoft 365 group or Microsoft Team hold, only the group mailbox and group site are placed on hold; the mailboxes and OneDrive sites of group members aren't placed on hold unless you explicitly add them as custodians or place their data sources hold. Therefore, if you need to place a Microsoft 365 group or Microsoft Team on hold for a specific custodian, consider mapping the group site and group mailbox to the custodian (See Managing Custodians in eDiscovery (Premium)). If the Microsoft 365 group or Microsoft Team isn't attributable to a single custodian, consider adding the source to a noncustodial hold.

• To get a list of the members of a Microsoft 365 group or Microsoft Team, you can view the properties on the Home > Groups page in the Microsoft 365 admin center. Alternatively, you can run the following command in Exchange Online PowerShell:

  Get-UnifiedGroupLinks <group or team name> -LinkType Members | FL DisplayName,PrimarySmtpAddress
  

  Note

  To run the Get-UnifiedGroupLinks cmdlet, you have to be assigned the View-Only Recipients role in Exchange Online or be a member of a role group that's assigned the View-Only Recipients role.

• Channel conversations that are part of a Microsoft Teams channel are stored in the mailbox that's associated with the Team. Similarly, files that team members share in a channel are stored on the team's SharePoint site. Therefore, you have to place the Microsoft Team mailbox and SharePoint site on hold to retain conversations and files in a channel.

• Alternatively, conversations that are part of the Chat list in Microsoft Teams are stored in the mailbox of the user's who participate in the chat. Files that a user shares in Chat conversations are stored in the OneDrive site of the user who shares the file. Therefore, you have to place the individual user mailboxes and OneDrive sites on hold to retain conversations and files in the Chat list.

• Every Microsoft Team or team channel contains a Wiki for note-taking and collaboration. The Wiki content is automatically saved as a .mht file. This file is stored in the Teams Wiki Data document library on the team's SharePoint site. You can place the content in the Wiki on hold by placing the team's SharePoint site on hold.

  Note

  The capability to retain Wiki content for a Microsoft Team or team channel (when you place the team's SharePoint site on hold) was released on June 22, 2017. If a team site is on hold, the Wiki content will be retained starting on that date. However, if a team site is on hold and the Wiki content was deleted before June 22, 2017, the Wiki content was not retained.

Hold status

The following table lists the status of holds for items:

Manage hold status errors

You may encounter errors while placing a hold on custodial or noncustodial data sources. The following table lists the errors that you may encounter and the recommended resolution.

Additional resources

• eDiscovery hold limits