Categories

In this article

  • Introduction to Teams legal hold
  • Licensing requirement
  • Content locations to place on hold to preserve Teams content
  • How to place a user or Team on legal hold
  • Limitations of using legal holds as a backup solution

How to Place Microsoft Teams Data on Legal Hold

27 Oct 2021
8 min read

Organizations are required to preserve electronically stored information (ESI) to ensure legal compliance. Microsoft administrators can create legal holds in the Compliance admin center to preserve information that might be relevant in the event of an upcoming litigation. A hold can be placed on different content locations such as user mailboxes in Exchange, OneDrive for Business accounts of users, SharePoint sites associated with Microsoft Teams, and more. When you place content locations on hold, content is preserved until you remove the content location from the hold or until you delete the hold.  
In this article, we will look at how Microsoft Teams data can be placed on legal hold.  

1. Introduction to Teams legal hold

There might be situations where organizations need to preserve Teams messages related to a specific topic or for certain individuals. Teams legal hold allows you to preserve all data associated with a user or team so that you can use this as evidence in a legal case. Admins can select specific users or even put an entire team on hold. When an entire team is put on hold, all the messages that were exchanged on that team, including private channels, can be discovered by the organization’s compliance managers or Teams admins.  

Note: Since February 2020, legal hold has been available for private channels. Private channel conversations are stored in the user mailboxes, while standard channel conversations are stored in the group mailbox corresponding to the team. If there is already a legal hold in place for a user mailbox, the hold policy will now automatically apply to private channel messages stored in that mailbox.  

2. Licensing requirement

To place a user or a team on legal hold, you need access to Core eDiscovery in the Compliance admin center. Licensing for Core eDiscovery requires the appropriate organization subscription and per-user licensing, which Microsoft clearly defines in their documentation as follows:

  • Organization subscription: To access Core eDiscovery in the Microsoft 365 compliance center or the Office 365 Security & Compliance Center, your organization must have a Microsoft 365 E3 or Office 365 E3 subscription or higher.

  • Per-user licensing: To place an eDiscovery hold on mailboxes and sites, a user must be assigned one of the following licenses, depending on your organization subscription: 

    1) A Microsoft 365 E3 or Office 365 E3 license or higher 
    2) Office 365 E1 license with an Exchange Online Plan 2 or Exchange Online Archiving add-on license  AND  Office 365 E1 license with a SharePoint Online Plan 2 or OneDrive for Business Plan 2 add-on license 

protipPro tip

Legal holds are only available in Microsoft E3 and E5 plans, that cost $32/user/month and $57/user/month respectively. To save on licensing costs, you can opt for third-party backup solutions like SysCloud.

3. Content locations to place on hold to preserve Teams content

The content locations to be placed on hold depend on the type of Teams data you need to preserve and where this data is stored. (Learn more about Teams data storage location) For instance, to retain chat data (1:1 chat and group chats) for a specific user, the hold has to be placed on the user mailbox, whereas to retain standard channel data, the hold has to be placed on the group mailbox corresponding to the team. 

The following table gives the content locations to be placed on hold to retain different types of Teams data. 

Type of dataContent location
Teams chats for a user ( 1:1 chats, 1:N group chats, and private channel conversations)
User mailbox
Teams channel chats (excluding private channels)
Group mailbox corresponding to the team
Teams file content (for example, Wiki content and files)
SharePoint site corresponding to the team

Show More

 

Note: You need to be a Compliance admin or Global admin to perform the below steps. 

  • Step 1: Go to the Microsoft 365 Compliance center. Navigate to eDiscovery -> Core

  • Step 2: Click Create a case -> Enter the case name and description -> Save

create a case in Core eDiscovery
  • Step 3: After the case is created, open it. Go to the Hold tab on the top menu and click Create to create a hold. Enter the hold name and description and click Next.

Create a hold in eDiscovery
  • Step 4: Enter the hold name and description and click on Next. This will take you to the Choose locations option. Choose the locations you want to apply the hold to, and click Next. (See Content Locations to Place on Hold to Preserve Teams Content)

choose content locations to place on hold

Note: When a user or a group is placed on hold, all message copies will be retained. For instance, if a user posts a message in a Teams channel and then modifies the message, both copies of the message will be retained. Without the legal hold in place, only the latest message will be retained. 

  • Step 5: You will be taken to the Query page where you can customize the hold if you want more granularity in the hold policy. For example, you can specify  the keywords to look for, or any other conditions that need to be fulfilled for the hold to take effect.

hold conditions
  • Step 6: Review your hold settings and click on the Submit  button to create the hold.

After the legal hold has been created, you can search for the content retained by the hold using an eDiscovery search. Click here to know how. 

Note: You can also place a user on a hold that's associated with an Advanced eDiscovery case. To know more about eDiscovery in Microsoft 365, read this article.

Quiz time! Did you know that majority of your Teams data reside outside the app?

5. Limitations of using legal holds as a backup solution

Though legal holds keep a copy of Microsoft Teams data, it is not an alternative to a third-party backup solution. Many organizations believe that they can leverage Microsoft legal holds to back up critical data. This is a dangerous misconception that can place a company’s data at risk. Here are the limitations of using legal holds as a backup solution:

  • If the Microsoft 365 account falls victim to a ransomware attack and becomes encrypted, so will all the data on legal hold. 

  • Each user has a limited storage available. If you delete data to stay within the storage limit, the deleted data cannot be recovered. Also, litigation holds cannot be used to delete unimportant data (unlike retention policies), so your storage capacity needs (and cost) increase exponentially over time.

  • Since private channel messages are stored in the user mailboxes of all the channel members, it’s enough to put the mailbox of a single member on hold to preserve the channel conversations. If the chosen member leaves the organization and their mailbox is deleted, the hold will also get deleted.

  • Older versions of files cannot be retained. Only the most recent version of a document is preserved.

  • Legal hold doesn’t retain data belonging to deleted user accounts, so if you need to retain data of employees who left the company, you must continue paying Microsoft for the user licenses.

  • Data cannot be restored from one user account to another. If you have a user leaving the company, you need to manually export the user’s data and import it to another account, which will take a significant amount of manual effort and time.  

  • eDiscovery feature is available only for organizations with Microsoft 365 Enterprise E3 or E5 plans, which are more expensive than Microsoft (Office) 365 Business plans.

Conclusion

The native legal hold capability provided by Microsoft greatly eases the eDiscovery process for litigation purposes. Nevertheless, they are not designed for the purpose of backup and restore, and therefore, have serious limitations as a backup solution.  Third-party cloud backup applications like SysCloud are better options to back up your Microsoft 365 data.  

SysCloud Backup for Microsoft 365 provides automated, secure cloud backup for all your Microsoft 365 apps, including Teams. With SysCloud, administrators can easily recover from accidental deletions or ransomware attacks and identify compliance gaps in the backup archives. 


In this article

  • Introduction to Teams legal hold
  • Licensing requirement
  • Content locations to place on hold to preserve Teams content
  • How to place a user or Team on legal hold
  • Limitations of using legal holds as a backup solution
svg

Start enjoying faster and easier backups, today

Avoid costly data retention gaps and minimize time to recovery with SysCloud's cloud backup.Start 30-Day Free Trial
Certifications
Certifications