How to Place Microsoft Teams Data on Legal Hold

1. Introduction to Teams legal hold

2. Licensing requirements to create legal holds in Microsoft 365

• Organization subscription: To access Core eDiscovery in the Microsoft 365 compliance center or the Office 365 Security & Compliance Center, your organization must have a Microsoft 365 E3 or Office 365 E3 subscription or higher.

• Per-user licensing: To place an eDiscovery hold on mailboxes and sites, a user must be assigned one of the following licenses, depending on your organization subscription: 

  1) A Microsoft 365 E3 or Office 365 E3 license or higher 

  2) Office 365 E1 license with an Exchange Online Plan 2 or Exchange Online Archiving add-on license  AND  Office 365 E1 license with a SharePoint Online Plan 2 or OneDrive for Business Plan 2 add-on license 

3. Content locations to place on hold to preserve Teams content

4. How to place a user or team on legal hold

• Step 1: Go to the Microsoft 365 Compliance center. Navigate to eDiscovery -> Core

• Step 2: Click Create a case -> Enter the case name and description -> Save. 

• Step 3: After the case is created, open it. Go to the Hold tab on the top menu and click Create to create a hold. Enter the hold name and description and click Next.

• Step 4: Enter the hold name and description and click on Next. This will take you to the Choose locations option. Choose the locations you want to apply the hold to, and click Next. (See Content Locations to Place on Hold to Preserve Teams Content)

• Step 5: You will be taken to the Query page where you can customize the hold if you want more granularity in the hold policy. For example, you can specify the keywords to look for, or any other conditions that need to be fulfilled for the hold to take effect.

• Step 6: Review your hold settings and click on the Submit button to create the hold.

5. Limitations of using legal holds as a backup solution

• If the Microsoft 365 account falls victim to a ransomware attack and becomes encrypted, so will all the data on legal hold. 

• Each user has a limited storage available. If you delete data to stay within the storage limit, the deleted data cannot be recovered. Also, litigation holds cannot be used to delete unimportant data (unlike retention policies), so your storage capacity needs (and cost) increase exponentially over time.

• Since private channel messages are stored in the user mailboxes of all the channel members, it’s enough to put the mailbox of a single member on hold to preserve the channel conversations. If the chosen member leaves the organization and their mailbox is deleted, the hold will also get deleted.

• Older versions of files cannot be retained. Only the most recent version of a document is preserved.

• Legal hold doesn’t retain data belonging to deleted user accounts, so if you need to retain data of employees who left the company, you must continue paying Microsoft for the user licenses.

• eDiscovery feature is available only for organizations with Microsoft 365 Enterprise E3 or E5 plans, which are more expensive than Microsoft (Office) 365 Business plans.

• Data cannot be restored from one user account to another. If you have a user leaving the company, you need to manually export the user’s data and import it to another account, which will take a significant amount of manual effort and time.  

Conclusion