Data Protection Centre/Microsoft 365/How to Place Microsoft Teams Data on Legal Hold

Categories

In this article

  • Introduction to Teams legal hold
  • Licensing requirement
  • Content locations to place on hold to preserve Teams content
  • How to place a user or Team on legal hold
  • Limitations of using legal holds as a backup solution

How to Place Microsoft Teams Data on Legal Hold

11 Apr 2025
3 min read
Anju George

Teams legal hold at a glance

  • Placing Microsoft Teams data on legal hold requires understanding where Teams content is stored and using Microsoft Purview’s eDiscovery tools to preserve it.

  • eDiscovery (Standard) allows you to create and manage holds on content across Microsoft 365. For more advanced capabilities like custodian management, legal hold notifications, and analytics, eDiscovery (Premium) is required.

  • Many organizations believe that they can leverage Microsoft's legal holds to back up critical data. This is a dangerous misconception that can place a company’s data at risk.

Read more

Organizations are required to preserve electronically stored information (ESI) to ensure legal and regulatory compliance. Microsoft 365 provides tools to help administrators apply legal holds on user data, ensuring that relevant information is preserved for potential litigation or investigation.
Legal holds are now configured using the Microsoft Purview Compliance Portal, which replaces the older Compliance Admin Center. Through eDiscovery (Standard or Premium) in Microsoft Purview, administrators can place holds on various content locations including:
  • Exchange Online mailboxes
  • OneDrive for Business accounts
  • SharePoint sites (including those associated with Microsoft Teams)
  • Microsoft 365 Groups and Teams
When these content locations are placed on hold, all relevant data is preserved until the hold is removed, regardless of deletion by the end user. This ensures the integrity of data needed for legal proceedings.
In this article, we’ll explore how to place Microsoft Teams data on legal hold using Microsoft Purview. 

1. Introduction to Teams legal hold

There may be instances where organizations must preserve Microsoft Teams messages for specific users or conversations related to litigation, regulatory requirements, or internal investigations. Microsoft Purview’s legal hold capabilities allow administrators to preserve Teams data across various content sources so it remains discoverable—even if users delete or modify that content.

Legal holds can be applied at both the user and team level:

  • Placing a user on hold preserves their 1:1 chats, group chats, private channel messages, and files stored in OneDrive.

  • Placing a team (via the associated Microsoft 365 Group) on hold preserves standard/shared channel messages and files stored in the team’s SharePoint site.

Note: Since early 2020, Microsoft has supported placing legal holds on private channel messages in Microsoft Teams. These messages are not stored in the team’s group mailbox but instead reside in the individual mailboxes of the users who participate in the private channel. In contrast, standard and shared channel conversations are stored in the Microsoft 365 Group mailbox associated with the team.

If a user's mailbox is already on legal hold, then any private channel messages stored in that mailbox are automatically preserved as part of the hold. No additional configuration is required to include those messages, as long as the user's mailbox is covered.  

Quiz time! Did you know that majority of your Teams data reside outside the app?
orage-gradiantblue-gradiant

2. Licensing requirements to create legal holds in Microsoft 365

To place a user or team on legal hold using Microsoft Purview eDiscovery, your organization must have the correct Microsoft 365 licensing. Microsoft offers two tiers of eDiscovery functionality:

  • eDiscovery (Standard): Included with Microsoft 365 E3/E5, Office 365 E3/E5, or equivalent enterprise licenses

  • eDiscovery (Premium): Available with Microsoft 365 E5 or as an add-on to E3

eDiscovery (Standard) supports basic holds and content search across Teams data. For advanced features like custodian management, review sets, and analytics, you need eDiscovery (Premium). 

3. Content locations to place on hold to preserve Teams content

The content locations to be placed on hold depend on the type of Teams data you need to preserve and where this data is stored. (Learn more about Teams data storage location) For instance, to retain chat data (1:1 chat and group chats) for a specific user, the hold has to be placed on the user mailbox, whereas to retain standard channel data, the hold has to be placed on the group mailbox corresponding to the team. 

The following table gives the content locations to be placed on hold to retain different types of Teams data. 
Type of dataContent location
Teams chats for a user ( 1:1 chats, 1:N group chats, and private channel conversations)
User mailbox
Teams channel chats (excluding private channels)
Group mailbox corresponding to the team
Files shared in standard/shared channels
SharePoint site corresponding to the team

Show more

 

Note: You need to be a Compliance admin or Global admin to perform the below steps. 

  • Step 1: Navigate to the Microsoft Purview portal and sign in with your credentials.

  • Step 2: Select the eDiscovery solution card and then select Cases (preview) in the left nav. Choose an existing case or create a new one by selecting Create case, providing a unique name and description, and then selecting Save.

create a case

  • Step 3: Select a case, then select the Hold policies tab. On the Hold policies dashboard, select Create policy. Enter a name and description. Select Create to create the new hold policy

create a hold

  • Step 4: Select Add data sources on the Hold policy tab. In the Manage data sources pane, specify the users, groups, or organizational locations to include in the hold.

Note: When a user or a group is placed on hold, all message copies will be retained. For instance, if a user posts a message in a Teams channel and then modifies the message, both copies of the message will be retained. Without the legal hold in place, only the latest message will be retained. 

  • Step 5: Configure Hold settings:

Decide between:​

  • Infinite hold: Preserves all content in the specified locations.

  • Query-based hold: Preserves only content matching specific criteria.

  • Optionally, set a date range to retain content sent, received, or created within a specific timeframe.

  • Step 6: Review your hold settings and click the Apply hold button to create the hold.

After the legal hold has been created, you can search for the content retained by the hold using an eDiscovery search. Click here to know how. 

5. Limitations of using legal holds as a backup solution

Though legal holds keep a copy of Microsoft Teams data, it is not an alternative to a third-party cloud backup solution. Many organizations believe that they can leverage Microsoft's legal holds to back up critical data. This is a dangerous misconception that can place a company’s data at risk. Here are the limitations of using legal holds as a backup solution:

  • If the Microsoft 365 account falls victim to a ransomware attack and becomes encrypted, so will all the data on legal hold. 

  • eDiscovery feature is available for organizations with Microsoft 365 Enterprise E3 or E5 plans, which are more expensive than Microsoft (Office) 365 Business plans.

  • Data cannot be restored from one user account to another. If you have a user leaving the company, you need to manually export the user’s data and import it to another account, which will take a significant amount of manual effort and time.  

Pro tip

With SysCloud's cross-user restore feature, you can easily restore data to a different user account, thereby saving manual effort and time. This is especially useful when you have a user leaving the company.

Conclusion

The native legal hold capability provided by Microsoft greatly eases the eDiscovery process for litigation purposes. Nevertheless, they are not designed for backup and restore, and therefore, have serious limitations as a backup solution.  Third-party cloud backup applications like SysCloud are better options to back up your Microsoft 365 data.  

SysCloud Backup for Microsoft 365 provides automated, secure cloud backup for all your Microsoft 365 apps, including Teams.

Learn more about SysCloud

Recommended content

8 Critical Reasons to Back up Teams

Discover why backing up Microsoft Teams data is crucial for data security, compliance, and business continuity. Learn best practices for Teams backup in 2024.

Read now 
How to Recover Deleted Teams Data

Learn the different ways in which IT administrators and end-users can recover deleted Teams data using native as well as third-party cloud backup tools.

Read now 
A Complete Guide to Microsoft Teams Data Retention

Learn how to retain Teams data by using retention policies and legal holds, restricting accidental deletions, and utilizing third-party cloud backup tools.

Read now 
A Guide to Microsoft 365 Teams Data Storage Locations

Learn where Microsoft 365 Teams chats, channels, files, calls, and calendar data are stored to proactively protect data.

Read now 
Get actionable SaaS administration insights

We don’t spam. Unsubscribe anytime.

In this article

  • Introduction to Teams legal hold
  • Licensing requirement
  • Content locations to place on hold to preserve Teams content
  • How to place a user or Team on legal hold
  • Limitations of using legal holds as a backup solution

Start enjoying faster and easier backups, today

Avoid costly data retention gaps and minimize time to recovery with SysCloud's cloud backup.Start 30-Day Free Trial
Certifications
Certifications