Retention and eDiscovery for a Litigation Hold
Litmus Legal is served with a litigation hold covering 12 custodians. Their Microsoft 365 tenant has a default retention policy that deletes email after 3 years and Teams messages after 1 year. Two custodians left the company 18 months ago; their mailboxes were converted to inactive mailboxes but their Teams data was deleted when their accounts were removed. The legal team needs to preserve everything relevant, search it, and produce it. The IT admin proposes creating a retention policy with a 7-year retention period and applying it to all mailboxes and Teams. The legal team is worried that the default 3-year deletion will still remove items before the hold is fully in place.
1. Will the proposed 7-year retention policy alone satisfy the litigation hold? Identify the gaps, especially for the departed custodians' Teams data.
Read the worked answer
No - a retention policy alone has gaps:
- Deleted Teams data for departed custodians is likely unrecoverable through retention. If the accounts were removed and Teams data deleted before any preservation was in place, a new retention policy does not resurrect already-deleted content. Retention preserves going forward; it does not restore what was purged. This is the critical gap.
- Inactive mailboxes are preserved, which is good, but only if the mailbox was placed on hold or had a retention policy applied at/around deletion. The scenario says they were converted to inactive mailboxes - verify a hold or retention was in place; otherwise the 3-year default may have already deleted items older than 3 years.
- A retention policy is not a litigation hold. For legal defensibility, use eDiscovery holds (or retention with preservation locking) scoped to the custodians, which prevent deletion and modification regardless of the default policy. Retention labels/policies can preserve, but the legal hold construct is what the legal team needs for defensibility.
- Default 3-year deletion concern is valid - if items are already older than 3 years at the time the new policy applies, they may be gone. Preservation must be applied before the deletion clock runs out.
Recommendation: apply eDiscovery hold to all 12 custodians immediately, confirm inactive mailboxes are on hold, and accept that deleted Teams content for the two departed users may be unrecoverable - document that gap.
2. The legal team must search and produce content across mailboxes and Teams for the 12 custodians. What Microsoft Purview workflow should they use, and what should they verify about the departed users?
Read the worked answer
Use Microsoft Purview eDiscovery (Premium) for the full workflow:
- Create a case, add the 12 custodians as data sources (mailboxes and Teams), and place them on hold to preserve.
- Collect and review using search, then export for production to the legal team.
- Premium supports custodian management, review sets, and production - appropriate for litigation.
Verify for the two departed users:
- Whether their mailboxes are inactive and on hold (inactive mailboxes are searchable in eDiscovery if preserved).
- Whether their Teams data still exists - if accounts were deleted and no retention/hold preserved the Teams content, it will not be searchable. Confirm before telling legal it is covered.
- Whether they need to be re-added as custodians; inactive mailboxes can be added as data sources, but deleted Teams content cannot be recovered by adding them.
The judgment: eDiscovery Premium is the right workflow, but the answer must flag that preservation must precede deletion and that already-purged Teams data is a documented loss, not something the workflow can fix.