In this article
Note: Since February 2020, legal hold has been available for private channels. Private channel conversations are stored in the user mailboxes, while standard channel conversations are stored in the group mailbox corresponding to the team. If there is already a legal hold in place for a user mailbox, the hold policy will now automatically apply to private channel messages stored in that mailbox.
To place a user or a team on legal hold, you need access to Core eDiscovery in the Compliance admin center. Licensing for Core eDiscovery requires the appropriate organization subscription and per-user licensing, which Microsoft clearly defines in their documentation as follows:
Organization subscription: To access Core eDiscovery in the Microsoft 365 compliance center or the Office 365 Security & Compliance Center, your organization must have a Microsoft 365 E3 or Office 365 E3 subscription or higher.
Per-user licensing: To place an eDiscovery hold on mailboxes and sites, a user must be assigned one of the following licenses, depending on your organization subscription:
Legal holds are only available in Microsoft 365 E3 and E5 plans, that cost $32/user/month and $57/user/month respectively. To save on licensing costs, you can opt for third-party cloud backup solutions like SysCloud.
The content locations to be placed on hold depend on the type of Teams data you need to preserve and where this data is stored. (Learn more about Teams data storage location) For instance, to retain chat data (1:1 chat and group chats) for a specific user, the hold has to be placed on the user mailbox, whereas to retain standard channel data, the hold has to be placed on the group mailbox corresponding to the team.
|Type of data||Content location|
Teams chats for a user ( 1:1 chats, 1:N group chats, and private channel conversations)
Teams channel chats (excluding private channels)
Group mailbox corresponding to the team
Teams file content (for example, Wiki content and files)
SharePoint site corresponding to the team
Note: You need to be a Compliance admin or Global admin to perform the below steps.
Step 1: Go to the Microsoft 365 Compliance center. Navigate to eDiscovery -> Core
Step 2: Click Create a case -> Enter the case name and description -> Save.
Step 3: After the case is created, open it. Go to the Hold tab on the top menu and click Create to create a hold. Enter the hold name and description and click Next.
Note: When a user or a group is placed on hold, all message copies will be retained. For instance, if a user posts a message in a Teams channel and then modifies the message, both copies of the message will be retained. Without the legal hold in place, only the latest message will be retained.
Step 5: You will be taken to the Query page where you can customize the hold if you want more granularity in the hold policy. For example, you can specify the keywords to look for, or any other conditions that need to be fulfilled for the hold to take effect.
Step 6: Review your hold settings and click on the Submit button to create the hold.
After the legal hold has been created, you can search for the content retained by the hold using an eDiscovery search. Click here to know how.
The native legal hold capability provided by Microsoft greatly eases the eDiscovery process for litigation purposes. Nevertheless, they are not designed for the purpose of backup and restore, and therefore, have serious limitations as a backup solution. Third-party cloud backup applications like SysCloud are better options to back up your Microsoft 365 data.
SysCloud Backup for Microsoft 365 provides automated, secure cloud backup for all your Microsoft 365 apps, including Teams. With SysCloud, administrators can easily recover from accidental deletions or ransomware attacks and identify compliance gaps in the backup archives.
Learn the different ways in which IT administrators and end-users can recover deleted Teams data using native as well as third-party cloud backup tools.Read now
Learn how to retain Teams data by using retention policies and legal holds, restricting accidental deletions, and utilizing third-party cloud backup tools.Read now
Learn where Microsoft 365 Teams chats, channels, files, calls, and calendar data are stored to proactively protect data.Read now
In this article