In Exchange Online, there is a feature known as Litigation Hold that helps retain the data for a certain amount of time. When the Litigation Hold is enabled on a particular mailbox or all the users, all the mailbox content which includes the deleted items and original version of modified items will be preserved. This means that if emails are deleted or moved, they can be recovered by the global admins or the eDiscovery/Compliance administrator in the In-Place eDiscovery when doing a content search.
To search the content, apart from having the right roles and permissions, you need to access the Compliance Center.
From there, you can click on the Content Search, under the Solutions.
It is to be noted that when a mailbox is put on Litigation Hold, the archive mailbox of the user is also put on hold. Deleted and even modified items will be preserved for the specified time or until the administrator removes the Litigation Hold.
Before You Put a Mailbox on Litigation Hold
You will need specific permissions to do a content search. For each option in Exchange Online, you need to have the right permissions. You need the following permissions to enable/disable the Litigation Hold feature.
- Discovery Management
- Organization Management
When the feature is enabled, it will take up to 60 minutes for the setting to take effect. When an item is deleted or modified, the Litigation Hold keeps these items in the Recoverable Items folder, which has a size limit of 30 GB. It’s important to keep an eye on the Recoverable Items folder to make sure it doesn’t exceed the limit. If a period of time is specified for the hold, the time is calculated from the date when the message is received or when the items has been created in the resource.
Another important thing is that you must have an Exchange Online Plan 2 license or you would need to have the addon of Exchange Online Archiving license. If not, you will not be able to set the mailbox on hold.
Methods to Place Mailbox on Litigation Hold
Once the above-mentioned prerequisites are met, you can enable/disable the Retention Hold feature in Exchange Online. For this, you can use the Exchange Admin Center (EAC) or the Exchange Management Shell (EMS) with PowerShell commands. Here’s how:
Enabling Litigation Hold using the EAC
After logging in to the portal, open ActiveUsers in the Users section.
Find the user in question and open it. Click on Mail and click on EditExchangeProperties.
Click on Mailbox Features and then click on Enable under Litigation hold: Disabled.
Once open, you need to fill in the number of days to keep the mailbox items. If you want to keep them for indefinite period, leave this blank.
Use the Note box to notify the user that their mailbox is on hold. This will be visible through their Outlook or Outlook Web Access (OWA).
If your company has a page in the intranet explaining the Litigation Hold or other legal notices, you can enter the address in the URL field which will also appear in the user’s mailbox.
The Note and URL fields work if you’re using Outlook 2010 or later. These will be visible in the File tab.
Once ready, click on the Save button.
Now, to disable the Litigation Hold, simply click on the Disable button.
Note: Enabling or disabling the feature will take up to 60 minutes to take effect.
Enabling Litigation Hold using the EMS
The Exchange Admin Center (EAC) only allows to setup the Litigation Hold one at a time. However, using PowerShell cmdlets in EMS, you can place Litigation Hold for several users at once or even automate the process. Once the authentication is done, use the command Set-Mailbox as given below.
Set-Mailbox email address="" -LitigationHoldEnabled $true /email
This will setup the litigation hold on the specified user for an indefinite period of time.
In the below example, we’ve specified the duration of the hold using the LitigationHoldDuration parameter.
Set-Mailbox email address=""> -LitigationHoldEnabled $true -LitigationHoldDuration number of="" days="" /number /email
You can also create a script to automate or to enable/disable by groups, departments, or even tenant-wise.
Closing Notes
During migration or if the Litigation Hold is setup incorrectly, there are chances of data loss. With a backup of the server, you would be able to recover the data. However, it would take a considerable amount of time and resources to restore the server in a healthy operational environment.
In such cases, the best solution is to use an application such as Stellar Repair for Exchange. With this application, you will be able to open multiple databases from any version of Exchange Server, without having an Exchange Server installed. You can easily restore and recover mailboxes, archives, shared mailboxes, and public folders. You can export recovered database to PST and other file formats. You can also export recovered database directly to an Exchange Online server.
4 min read
