Microsoft Litigation Hold

Microsoft Litigation Hold allows investigators to preserve Exchange Online mailbox evidence associated with a subject or other relevant custodian. When applied to a mailbox, Litigation Hold preserves mailbox content, including deleted items and original versions of modified items, so that evidence remains available for later search, review, and export through Microsoft Purview or Exchange eDiscovery workflows.

This detection is relevant where a subject may attempt anti-forensic activity involving email deletion, mailbox cleanup, calendar manipulation, or modification of Microsoft 365 communication artifacts stored in Exchange. It may also assist Teams investigations where relevant chat messages are stored in participant mailboxes, although it should not be treated as a complete Teams preservation strategy without confirming the associated Teams, SharePoint, OneDrive, and group locations.

Investigators should document when Litigation Hold was requested, when it was applied, which mailboxes were included, whether the hold was indefinite or time-limited, and any known preservation gaps. Where the investigation involves multiple custodians, suspected recipients, or co-conspirators, each relevant mailbox should be assessed for inclusion.

Litigation Hold preserves mailbox evidence but does not restrict the subject’s access or prevent continued activity. It should therefore be treated as an evidence preservation mechanism, not a containment control.