This chapter covers Legal Hold and Litigation Hold in Microsoft 365, mechanisms that preserve content for legal or regulatory purposes. For the MS-102 exam, these topics appear in Domain 3 (Security Threats) under Objective 3.4, typically accounting for 5-8% of questions. You must understand the differences between Litigation Hold, eDiscovery holds, and retention policies, how they interact with deletion behaviors, and how to configure them using the Microsoft 365 compliance center or PowerShell. This chapter provides the deep technical detail needed to answer scenario-based questions accurately.
Jump to a section
Imagine a warehouse (Microsoft 365) where thousands of workers (users) constantly create, modify, and discard documents (mailboxes, files, Teams messages). Normally, a janitorial crew (retention policies, deletion processes) regularly empties trash bins and shreds outdated files. Now, a court order arrives: 'Preserve all documents related to Project X from January to March.' The facility manager (compliance admin) places a 'Legal Hold' sign on every bin and shredder in the warehouse. From that moment, even if a worker tries to throw away a document, the janitorial crew cannot remove it—the document is moved to a special locked storage area (Preservation Hold library). The key is that the worker doesn't know their trash is being preserved; they continue working normally. The hold is not a snapshot—it's an ongoing freeze that captures any new or modified documents falling under the hold criteria. If the worker later edits a preserved document, both the original and the new version are kept. The hold remains until the facility manager receives a court release and removes the signs. This analogy mirrors how Litigation Hold in Exchange Online and eDiscovery holds in SharePoint/OneDrive work: they prevent permanent deletion, preserve all versions, and operate transparently to users.
What is Legal Hold and Why It Exists
Legal Hold (also called Litigation Hold in Exchange Online) is a feature that preserves all mailbox content, including deleted items and previous versions, for as long as the hold is in place. It overrides any deletion or purge mechanisms, ensuring data is not permanently removed until the hold is released. The primary purpose is to meet legal discovery obligations—organizations must preserve relevant electronically stored information (ESI) when litigation is reasonably anticipated.
In Microsoft 365, there are three main types of holds: - Litigation Hold: Applies to Exchange Online mailboxes (including inactive mailboxes). Preserves all content in the mailbox, including deleted items and all versions of items. - eDiscovery Hold: Applies to mailboxes, SharePoint sites, OneDrive accounts, and Teams/Group mailboxes. Allows granular preservation based on query filters (e.g., date range, keywords). - Retention Hold: Temporarily suspends retention policies for a mailbox (e.g., during litigation). Not a legal hold per se but used in conjunction.
How It Works Internally
When a Litigation Hold is placed on a mailbox, Exchange Online modifies the mailbox's properties to set the LitigationHoldEnabled flag to $true. This flag triggers a change in the mailbox's retention behavior:
The Managed Folder Assistant (MFA) processes the mailbox differently. Normally, MFA applies retention policies and purges expired items. With Litigation Hold enabled, MFA moves items that would be deleted to the Recoverable Items folder (specifically the Purges subfolder) instead of permanently deleting them.
The Recoverable Items folder has a quota of 30 GB by default (configurable up to 100 GB). If the hold causes the folder to exceed its quota, the mailbox becomes temporarily unable to send or receive email until the quota is increased or the hold is removed.
Items are preserved in their original state. If a user modifies an item, the previous version is also preserved in the Recoverable Items folder.
The hold applies to all items in the mailbox, including those in the Deleted Items folder and the Recoverable Items folder itself.
For eDiscovery holds, the mechanism involves a Preservation Hold library in SharePoint/OneDrive and a Discovery Hold mailbox in Exchange. When a custodian is placed on hold, a copy of the preserved content is stored in a special location. For mailboxes, the hold is implemented using In-Place Hold or Litigation Hold (depending on the hold type). For SharePoint and OneDrive, the hold places a Preservation Hold library that retains all versions of files, even if the original is deleted.
Key Components, Values, and Defaults
Litigation Hold Duration: When enabling Litigation Hold, you can specify a hold duration in days. If not specified, the hold is indefinite (no expiry). The duration is calculated from the date the item was received or created.
Recoverable Items Quota: Default 30 GB for mailboxes on hold. Can be increased to 100 GB via PowerShell (Set-Mailbox -RecoverableItemsQuota).
Recoverable Items Warning Quota: Default 20 GB. When this threshold is reached, the admin receives a warning event.
Inactive Mailbox: A mailbox placed on Litigation Hold or eDiscovery hold before the user's account is deleted becomes an inactive mailbox. Inactive mailboxes are preserved indefinitely (or until the hold is removed) and can be searched using eDiscovery.
eDiscovery Hold vs. Litigation Hold: eDiscovery hold allows query-based preservation (e.g., only items containing certain keywords), while Litigation Hold preserves everything in the mailbox.
Configuration and Verification Commands
Enable Litigation Hold via PowerShell:
Set-Mailbox -Identity user@domain.com -LitigationHoldEnabled $true -LitigationHoldDuration 365Verify Litigation Hold status:
Get-Mailbox -Identity user@domain.com | FL LitigationHoldEnabled, LitigationHoldDurationPlace an eDiscovery hold via Security & Compliance Center PowerShell:
New-CaseHoldPolicy -Name "CaseHoldPolicy" -Case "Case123" -ExchangeLocation user@domain.com
New-CaseHoldRule -Name "CaseHoldRule" -Policy "CaseHoldPolicy" -ContentDateFrom "01/01/2023" -ContentDateTo "12/31/2023"Check hold status on a mailbox:
Get-Mailbox -Identity user@domain.com | FL *Hold*Interaction with Related Technologies
Retention Policies: Retention policies can delete or retain content based on age. If a Litigation Hold is active, retention policies cannot permanently delete content—they will move it to the Recoverable Items folder instead. However, retention policies that label items for deletion will still mark items as expired, but the hold prevents actual deletion.
In-Place Archive: Archived mailboxes are also subject to holds. If a mailbox is placed on hold, the archive is also preserved.
Teams and Groups: Teams channel messages are stored in a group mailbox. Placing a hold on the group mailbox preserves all channel messages. For private channels, each channel has its own mailbox. For Teams chats, the hold applies to the user's mailbox.
SharePoint and OneDrive: eDiscovery holds preserve files in the Preservation Hold library. When a file is deleted by a user, it is moved to the Preservation Hold library (not the recycle bin) and retained for the duration of the hold.
Compliance Center: The Microsoft Purview compliance portal provides a unified interface for managing holds across Exchange, SharePoint, OneDrive, and Teams. You can create eDiscovery cases and add holds to custodians or locations.
Trap Patterns on the Exam
Confusing Litigation Hold with Retention Policy: Retention policies are for managing data lifecycle, not for legal preservation. A retention policy can delete data even if a hold is not present, but a hold overrides deletion.
Assuming Litigation Hold is a snapshot: It is not—it preserves all current and future items until the hold is removed.
Thinking Litigation Hold applies to SharePoint: It does not; Litigation Hold is Exchange-only. For SharePoint, use eDiscovery hold.
Ignoring the Recoverable Items quota: If the quota is exceeded, the mailbox will stop receiving email. This is a common exam scenario.
Believing a user can delete items while on hold: Users can delete items, but those items are preserved in the Recoverable Items folder. The user's perception is that the item is gone.
Step-by-Step: Configuring Litigation Hold
Verify prerequisites: Ensure you have the necessary permissions (eDiscovery Manager or Organization Management role group).
Connect to Exchange Online PowerShell: Use Connect-ExchangeOnline -UserPrincipalName admin@domain.com.
Enable Litigation Hold: Run Set-Mailbox -Identity user@domain.com -LitigationHoldEnabled $true -LitigationHoldDuration 3650 (10 years).
Verify the hold: Run Get-Mailbox -Identity user@domain.com | FL LitigationHoldEnabled, LitigationHoldDuration.
Monitor Recoverable Items folder: Use Get-MailboxFolderStatistics -Identity user@domain.com -FolderScope RecoverableItems to check size.
If quota is exceeded: Increase quota using Set-Mailbox -Identity user@domain.com -RecoverableItemsQuota 100GB -RecoverableItemsWarningQuota 90GB.
Remove hold when litigation ends: Run Set-Mailbox -Identity user@domain.com -LitigationHoldEnabled $false.
Identify Users and Locations
Determine which mailboxes, SharePoint sites, OneDrive accounts, or Teams/Group mailboxes need to be preserved. For litigation, this usually involves custodians (users) and relevant sites. Use the Microsoft Purview compliance portal to create an eDiscovery case and add custodians. Each custodian's mailbox, OneDrive, and any associated Teams or SharePoint sites will be targeted. This step is crucial because placing a hold on the wrong location can lead to excessive storage costs or missing evidence.
Choose Hold Type
Decide between Litigation Hold (Exchange-only, preserves everything) or eDiscovery Hold (multi-workload, query-based). For simple, broad preservation, Litigation Hold is easier. For granular preservation (e.g., only emails from a specific date range), use eDiscovery hold. Note that Litigation Hold does not support queries; it preserves all mailbox content. The exam often tests this distinction: Litigation Hold is 'all or nothing' while eDiscovery hold can be filtered.
Configure Hold Settings
For Litigation Hold, use PowerShell or the Exchange admin center to enable the hold and optionally set a duration. For eDiscovery hold, create a hold policy in the compliance portal, specifying the locations (Exchange, SharePoint, OneDrive) and query conditions (e.g., date range, keywords). The hold policy is applied immediately but may take up to 24 hours to fully enforce. During this time, some deletions might not be preserved, so it's best to apply holds before any data deletion is expected.
Verify Hold Application
After applying the hold, verify that the holds are active. For Litigation Hold, use `Get-Mailbox` to check the `LitigationHoldEnabled` flag. For eDiscovery holds, use `Get-CaseHoldPolicy` and `Get-CaseHoldRule`. Also, check that the Recoverable Items folder is growing as expected. A common mistake is assuming the hold is active without verification—the exam may present a scenario where the hold was not applied due to permissions or script errors.
Monitor and Manage Storage
Holds can cause storage to increase rapidly, especially for large mailboxes. Monitor the Recoverable Items folder quota. If the mailbox hits the quota, it will stop sending/receiving email. Increase the quota as needed. For SharePoint, the Preservation Hold library has its own storage limits. In production, set up alerts for when the Recoverable Items folder exceeds 80% of the warning quota. This step is often neglected, leading to service disruption.
Remove Hold When Litigation Ends
Once the legal matter is resolved, remove the hold. For Litigation Hold, set `-LitigationHoldEnabled $false`. For eDiscovery holds, delete the hold policy or remove locations from the policy. After removal, the preserved items are subject to normal retention policies and may be permanently deleted. It is critical to document the hold release and ensure no other holds are still active. The exam may test that removing a hold does not automatically restore deleted items—they remain in the Recoverable Items folder until they expire according to retention policies.
In enterprise deployments, Legal Hold and Litigation Hold are critical for compliance with regulations like SEC Rule 17a-4, FINRA, and GDPR. Here are three common scenarios:
Scenario 1: Corporate Litigation A multinational company is sued for patent infringement. The legal team identifies 20 custodians whose emails and documents are relevant. The compliance admin creates an eDiscovery case in the Microsoft Purview compliance portal, adds the custodians, and places a hold on their mailboxes, OneDrive accounts, and the SharePoint site containing project files. The hold uses a date range filter to preserve only emails from the past two years. Over the next six months, the Recoverable Items folders grow to 40 GB each. The admin increases the quota to 100 GB for those mailboxes. After the case settles, the hold is removed, and the preserved items are eventually cleaned up by retention policies. A common issue is that the legal team forgets to remove the hold, causing indefinite storage costs and potential data retention violations.
Scenario 2: Regulatory Investigation A financial institution is under investigation by a regulator. They must preserve all communications for a specific department. The admin enables Litigation Hold on all mailboxes in that department (50 users). Because Litigation Hold does not support date filtering, every email is preserved, including spam and newsletters. The Recoverable Items folders quickly fill up. The admin must monitor quotas and increase them for several mailboxes. After the investigation, the hold is removed, but the organization decides to keep the data for seven years due to retention policies. The key lesson is that Litigation Hold is a blunt instrument; for targeted preservation, eDiscovery hold with queries is better.
Scenario 3: Inactive Mailbox Preservation An employee leaves the company while under litigation hold. The admin must convert the mailbox to an inactive mailbox by first placing a Litigation Hold (or eDiscovery hold) and then deleting the user account. The inactive mailbox is preserved indefinitely. The admin can search it using eDiscovery. A common mistake is deleting the user account before placing the hold, which results in the mailbox being permanently deleted. The exam may test that an inactive mailbox can only be created if a hold is applied before deletion.
Performance considerations: For large-scale holds (thousands of mailboxes), PowerShell scripting is used to apply holds in batches. The Recoverable Items folder quota must be increased proactively. The Preservation Hold library in SharePoint can consume significant storage; admins should monitor site collection storage limits.
The MS-102 exam (Objective 3.4) tests your ability to configure and manage legal holds in Microsoft 365. Here's exactly what you need to know:
Specific objective codes: - 3.4 Implement and manage compliance solutions for security threats. This includes Litigation Hold, eDiscovery holds, and retention policies. - The exam focuses on the differences between Litigation Hold and eDiscovery hold, how they interact with deletion, and how to configure them.
Common wrong answers and why candidates choose them: 1. 'Litigation Hold can be applied to SharePoint and OneDrive' – Wrong. Litigation Hold is Exchange-only. For SharePoint/OneDrive, use eDiscovery hold. Candidates confuse the term 'Litigation Hold' with 'legal hold' in general. 2. 'Enabling Litigation Hold immediately preserves all future versions of documents' – Wrong. Litigation Hold preserves versions in Exchange, but for SharePoint/OneDrive, you need eDiscovery hold. Candidates assume Litigation Hold works across all workloads. 3. 'A user on Litigation Hold cannot delete emails' – Wrong. Users can delete emails; the deletions are preserved in the Recoverable Items folder. Candidates think the hold prevents deletion at the user level. 4. 'Removing a Litigation Hold restores all deleted items' – Wrong. Removing the hold only stops future preservation; deleted items remain in the Recoverable Items folder until purged by retention policies. Candidates think the hold is like a 'undo' button.
Specific numbers and values that appear verbatim:
Default Recoverable Items quota: 30 GB (can be increased to 100 GB)
Warning quota: 20 GB
Litigation Hold duration: specified in days; if not set, indefinite
Inactive mailbox: created when a mailbox on hold is deleted
eDiscovery hold can be query-based (date range, keywords)
Edge cases and exceptions:
If a mailbox on Litigation Hold exceeds the Recoverable Items quota, the mailbox stops sending/receiving email. The exam may ask what happens when the quota is exceeded.
Litigation Hold cannot be applied to a mailbox that already has an in-place hold (eDiscovery hold) of a different type. The exam may test that you can have both, but they must be compatible.
For Teams, private channel messages are stored in separate mailboxes; each must be placed on hold individually.
How to eliminate wrong answers:
If the question mentions 'preserve all content without filtering', choose Litigation Hold.
If the question mentions 'preserve only specific content based on query', choose eDiscovery hold.
If the question involves SharePoint or OneDrive, eliminate Litigation Hold as an option.
If the question asks about storage limits, recall the 30 GB default.
If the question involves a deleted user, think about inactive mailboxes.
Litigation Hold is Exchange-only; eDiscovery hold covers multiple workloads.
Default Recoverable Items quota is 30 GB; can be increased to 100 GB via PowerShell.
Litigation Hold preserves all mailbox content, including deleted items and versions.
An inactive mailbox is created when a mailbox on hold is deleted.
Removing a hold does not delete preserved items; they remain until purged by retention policies.
eDiscovery hold allows query filters; Litigation Hold does not.
If Recoverable Items quota is exceeded, the mailbox stops sending/receiving email.
These come up on the exam all the time. Here's how to tell them apart.
Litigation Hold
Exchange Online only
Preserves all mailbox content without filtering
Configured via PowerShell or Exchange admin center
Duration can be set in days or indefinite
No query support; holds everything
eDiscovery Hold
Applies to Exchange, SharePoint, OneDrive, Teams, Groups
Supports query-based preservation (date range, keywords, etc.)
Managed through Microsoft Purview compliance portal (eDiscovery cases)
Duration is typically indefinite until released
Can be targeted to specific content within locations
Mistake
Litigation Hold applies to all Microsoft 365 workloads including SharePoint and OneDrive.
Correct
Litigation Hold is an Exchange Online feature only. For SharePoint, OneDrive, and Teams, you must use eDiscovery hold (part of Microsoft Purview) to preserve content.
Mistake
When a user is on Litigation Hold, they cannot delete emails.
Correct
Users can delete emails normally. The deleted items are preserved in the Recoverable Items folder (Purges subfolder) and are invisible to the user. The user perceives the deletion as successful.
Mistake
Removing a Litigation Hold immediately deletes all preserved items.
Correct
Removing the hold stops future preservation but does not delete items already preserved. Those items remain in the Recoverable Items folder and are subject to normal retention policies (e.g., they may be deleted after a set number of days).
Mistake
Litigation Hold and eDiscovery hold are the same thing.
Correct
They are different. Litigation Hold is a simple on/off switch that preserves all mailbox content indefinitely (or for a set duration). eDiscovery hold is more flexible: it can be applied to multiple workloads, supports query filters, and is managed through eDiscovery cases in the compliance portal.
Mistake
An inactive mailbox can be created without any hold.
Correct
An inactive mailbox is created only when a mailbox that has a Litigation Hold or eDiscovery hold is deleted. Without a hold, deleting the user account permanently deletes the mailbox.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Litigation Hold is an Exchange Online feature that preserves all mailbox content without filtering. It is a simple on/off toggle. eDiscovery hold is part of Microsoft Purview and can be applied to Exchange, SharePoint, OneDrive, and Teams. It supports query-based preservation (e.g., by date range or keywords) and is managed through eDiscovery cases. For the exam, remember: Litigation Hold = Exchange only, no filters; eDiscovery hold = multi-workload, filterable.
Yes, Litigation Hold can be applied to shared mailboxes. The same rules apply: all content is preserved, and the Recoverable Items folder quota is 30 GB by default. However, shared mailboxes typically have smaller storage limits, so monitor quota closely.
The mailbox will stop sending and receiving new emails. To resolve, increase the quota using PowerShell (Set-Mailbox -RecoverableItemsQuota) or remove the hold to allow cleanup. The exam may test that this is a critical issue that must be addressed proactively.
First, place a Litigation Hold or eDiscovery hold on the mailbox. Then delete the user account. The mailbox becomes inactive and is preserved indefinitely. You can search it using eDiscovery. To recover or delete the inactive mailbox, you must remove the hold first.
Yes, but indirectly. Teams chat messages are stored in the user's mailbox. If the mailbox is on Litigation Hold, those messages are preserved. For channel messages, they are stored in the group mailbox; place a hold on that group mailbox. Private channel messages are in separate mailboxes.
Yes, you can have both. However, if both are applied, the mailbox is subject to the most restrictive preservation (i.e., both holds are active). There is no conflict, but it may increase storage usage. The exam may test that you can combine them.
The hold is applied almost immediately after the command completes, but the Managed Folder Assistant must process the mailbox to move items to the Recoverable Items folder. This can take up to 24 hours. For the exam, know that the hold is active immediately for new items, but existing items may take time to be preserved.
You've just covered Legal Hold and Litigation Hold — now see how well it sticks with free MS-102 practice questions. Full explanations included, no account needed.
Done with this chapter?