Microsoft Purview eDiscovery Legal Hold
A help desk lead is documenting the correct Microsoft 365 approach to preserve relevant mailboxes and SharePoint content during a legal case. Microsoft security, identity, or compliance capability should it use?
Quick Answer
Microsoft Purview eDiscovery hold is the correct capability for preserving mailboxes and SharePoint content during a legal case, because it prevents the underlying data from being altered or permanently deleted for as long as the hold remains in place, regardless of a user's normal retention or deletion actions. A hold placed on a custodian's mailbox or a SharePoint site captures content as it existed at the time of the hold and continues capturing changes going forward, which is what satisfies the legal requirement to preserve evidence in its original or evolving state rather than a single snapshot. This is distinct from a retention policy, which is typically organisation-wide and time-based rather than tied to a specific legal matter and named custodians. eDiscovery holds are scoped precisely to the people and locations relevant to a case, which is why they are the standard mechanism whenever a scenario specifically mentions preserving content for litigation or investigation purposes rather than general compliance retention.
⚠ Common exam trap
Many candidates confuse general productivity tools like Stream, Forms, or Planner with compliance capabilities, mistakenly thinking they can be used for legal preservation when they lack the necessary retention and hold features.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview eDiscovery hold
Microsoft Purview eDiscovery hold is the correct capability because it allows organizations to place legal holds on mailboxes, SharePoint sites, and other content sources to preserve data relevant to a legal case. This ensures that content cannot be altered or deleted until the hold is released, meeting compliance and eDiscovery requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Stream
Why it's wrong here
Stream hosts and shares video content, with no mailbox or SharePoint preservation and no legal hold mechanism. It is tempting because it is a Microsoft 365 workload, but Microsoft Purview eDiscovery (Premium) is the compliance capability that places custodians' mailboxes and sites on hold for a case.
- ✗
Microsoft Forms
Why it's wrong here
Forms collects survey and quiz responses; it neither stores mailbox or SharePoint content nor applies holds for litigation. It is tempting because it is a familiar Microsoft 365 service, but Microsoft Purview eDiscovery (Premium) is the capability that preserves custodian mailboxes and SharePoint sites during a legal case.
- ✗
Microsoft Planner
Why it's wrong here
Planner manages tasks and plans, holding no mailbox or SharePoint content and offering no preservation or legal hold capability. It is tempting because it is a Microsoft 365 collaboration tool, but eDiscovery (Premium) handles custodian holds, mailbox and site preservation, and case review for litigation.
- ✓
Microsoft Purview eDiscovery hold
Why this is correct
Microsoft Purview eDiscovery hold preserves mailbox and SharePoint content in place, satisfying the legal-case retention constraint without altering user access. Unlike litigation hold applied per mailbox, an eDiscovery hold spans Exchange, SharePoint, and Teams through a single case, keeping custodian data immutable for review.
Go deeper
Related to this question
Learn chapter
M365 Data Portability and Export
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
eDiscovery
eDiscovery is the process of identifying, collecting, and producing electronic information for legal cases or investigations.
About these practice questions
One of 794 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A department head asks which Microsoft 365 option should be used to search, review, and export content for a legal investigation. Microsoft security, identity, or compliance capability should it use?
medium- A.Microsoft Forms
- B.Microsoft Stream
- ✓ C.Microsoft Purview eDiscovery
- D.Microsoft Planner
Why C: Microsoft Purview eDiscovery is the correct choice because it is the dedicated Microsoft 365 compliance solution for searching, reviewing, and exporting content in legal investigations. It provides advanced search capabilities across Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams, and supports legal hold, review sets, and export workflows to meet eDiscovery requirements.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.