No, we don’t have law degrees either. However, since we have control over the technology our teammates use, we need to ensure we have it set up in a way that might protect our organizations from legal risk or litigation. Depending on the industry you’re in, you may have preset policies or compliance guidelines you must abide by.
Microsoft Office 365 Exchange Online has several settings that will help you comply with any eDiscovery requests you may get regarding email and/or calendaring: In-Place Hold and Litigation Hold. We’ll go over the difference between these two and what you need to do to use them.
Just because you have a certain retention policy set doesn’t necessarily protect you from employee deletions, so it’s important to also have one or both configured.
In-Place Hold
With In-Place Hold in Exchange Online, you can specify parameters on what to hold. You can use query parameters like keywords, senders, recipients, start and end dates. When you create your In-Place Hold, all existing and future mailbox items (including messages received at a later date) that match the parameters will be preserved.
Note that you have a limit of 500 keywords for an In-Place Hold on any given mailbox. If you exceed this, it’ll hold the entire mailbox.
You can also do an In-Place Hold for an Office 365 Group but know that only the group mailbox is on hold and not the respective mailboxes of the group members. Public folders can also be set to In-Place Hold but cannot have Litigation Holds. Be cognizant of hierarchy synchronization related emails – there might be thousands that would be preserved with this setting and fill up your storage quota. Use a query-based In-Place Hold to keep it minimal.
Litigation Hold
Litigation Hold puts the entire mailbox content on hold. You can specify the time period and if you don’t set a duration, the items are held indefinitely or until you remove the hold. Again, items received or created from the start of the hold and through the end will be kept. For example, if I were to set a Litigation Hold on my mailbox starting in the past, it wouldn’t be able to hold the items that existed prior to me setting the hold.
Enabling In-Place or Litigation Hold in Office 365 Exchange Online
Only authorized users that have been added to the Discovery Management role-based access control group or those assigned the Legal Hold and Mailbox Search management roles can enable these features. (Here are Microsoft’s instructions on assigning eDiscovery permissions in Exchange.)
There is an In-Place eDiscovery & Hold wizard in the Exchange Admin Center. Alternatively, you can also run commands in Exchange Online PowerShell.
It’s also important to know that in order to place an Exchange Online mailbox on In-Place Hold, it must be assigned an Exchange Online (Plan 2) license. If the mailbox in question is on Exchange Online (Plan 1), you must assign it a separate Exchange Online Archiving license. Exchange Online (Plan 1) is included with Office 365 E1 while Exchange Online (Plan 2) is included with Office 365 E3 and E5 licenses.
Here are Microsoft’s step-by-step instructions on configuring an In-Place Hold.
The steps to do a Litigation Hold are very similar, and you can access them on Microsoft’s site here. The licensing requirements for the Litigation hold are the same as for In-Place Hold.
Determining What to Have and to Hold and Until Death Do You Part?
Well, again, we’re not lawyers. This is something you may need to take up with your legal and HR teams to determine. There are a million different permutations on how you could set this up. And remember to make sure it plays nice with your storage limits!