Microsoft Purview eDiscovery Legal Hold

Quick Answer

Microsoft Purview eDiscovery hold is the correct capability for preserving mailboxes and SharePoint content during a legal case, because it prevents the underlying data from being altered or permanently deleted for as long as the hold remains in place, regardless of a user's normal retention or deletion actions. A hold placed on a custodian's mailbox or a SharePoint site captures content as it existed at the time of the hold and continues capturing changes going forward, which is what satisfies the legal requirement to preserve evidence in its original or evolving state rather than a single snapshot. This is distinct from a retention policy, which is typically organisation-wide and time-based rather than tied to a specific legal matter and named custodians. eDiscovery holds are scoped precisely to the people and locations relevant to a case, which is why they are the standard mechanism whenever a scenario specifically mentions preserving content for litigation or investigation purposes rather than general compliance retention.