E3 Legal Hold: Preserve Email and Data for Legal Discovery

Legal challenges and investigations are inevitable in today’s business environment. Whether it’s a regulatory audit, civil lawsuit, or internal investigation, your organization must be ready to preserve electronic evidence quickly and defensibly.

Microsoft 365 E3 includes powerful compliance features such as litigation hold and eDiscovery, allowing organizations to place content on hold, search data across workloads, and support legal teams all without third-party tools.

This guide breaks down how to use E3’s capabilities to meet legal requirements, protect data, and streamline your eDiscovery process.

Table of Contents

What Is a Litigation Hold?

A litigation hold is a legal obligation to preserve all relevant data once an organization becomes aware of a potential lawsuit or regulatory inquiry. Under Microsoft 365 E3, this includes:

  • Emails
  • Teams messages
  • SharePoint and OneDrive files
  • Calendars and attachments
  • Archived mailboxes


Once placed on hold, this content is immune to deletion, even if users try to erase it. This protects the organization from spoliation (the legal term for destroying evidence) and ensures full compliance with discovery rules.

Litigation Hold in Microsoft 365 E3

With Microsoft 365 E3, you can apply two types of legal hold:

Litigation Hold (Mailbox-Level)

Applied directly to an Exchange mailbox. It preserves:

  • All sent and received emails
  • Drafts, deleted items, and calendar entries
  • Mailbox metadata
  • Emails moved or removed by users

Microsoft Purview eDiscovery Hold

A more advanced option using Core eDiscovery. This type of hold can target content in:

  • Exchange
  • SharePoint
  • OneDrive
  • Microsoft Teams
  • Yammer and Viva Engage (if used)


You can scope these holds by user, keyword, date range, or specific content types.

eDiscovery Basics for Microsoft 365 E3

eDiscovery refers to the process of identifying, preserving, searching, and exporting digital content for legal proceedings. Microsoft 365 E3 includes Core eDiscovery, which allows you to:

  • Search content across Microsoft 365 workloads
  • Place content on hold (non-destructive preservation)
  • Review items with filtering and keyword queries
  • Export data for use in legal review platforms


This makes Core eDiscovery ideal for HR investigations, contract disputes, compliance audits, and early case assessment.

How to Place a Mailbox on Litigation Hold

Follow these steps in the Microsoft 365 admin center or Exchange Online PowerShell:

Admin Center Method

  1. Navigate to Microsoft 365 admin center
  2. Go to Users > Active users
  3. Choose the user’s mailbox
  4. Under Mail settings, click Mailbox litigation hold
  5. Enable the hold, and optionally include a hold duration and a user notice

PowerShell Method

				
					Set-Mailbox -Identity "user@domain.com" -LitigationHoldEnabled $true
				
			

This preserves mailbox content indefinitely (or for the duration you specify) and is invisible to end users.

Applying Holds with Core eDiscovery

To create a case and apply a targeted eDiscovery hold:

  1. Go to the Microsoft Purview compliance portal
  2. Click eDiscovery > Core
  3. Create a new case
  4. Under Holds, select + Create a hold
  5. Define users, content locations, and filter criteria
  6. Save and monitor the hold from within the case dashboard


This enables granular legal preservation without impacting unrelated data.

Teams and OneDrive Data: What Gets Preserved?

With a properly scoped Core eDiscovery hold, Microsoft 365 preserves:

  • Teams chats and channel messages
  • OneDrive files, including deleted documents
  • SharePoint site content
  • Version histories for collaboration documents


All this content is indexed and searchable through Core eDiscovery’s review tools, enabling a complete legal review from a single interface.

Differences Between Core and Advanced eDiscovery

FeatureCore eDiscovery (E3)Advanced eDiscovery (E5)
Search across M365 data
Create holds
Export data
Custodian management
Machine learning (themes, relevance)
Legal review taggingBasicAdvanced
Audit and activity analyticsLimitedExtensive

For most small to midsize businesses, Core eDiscovery in E3 is enough. If your legal team needs advanced automation, E5 may be a better fit.

When Should You Use Litigation Hold?

Use litigation hold as soon as:

  • A legal complaint is filed or expected
  • You receive a subpoena or discovery request
  • There is internal knowledge of a regulatory investigation
  • An HR issue may escalate into formal proceedings
  • An employee exits under suspicious circumstances


Once triggered, a litigation hold must be applied immediately to avoid evidence loss and legal penalties.

Best Practices for Managing Legal Holds

  • Coordinate with legal counsel: Only apply holds after confirming scope and custodians
  • Don’t over-hold: Narrow the scope to relevant content only
  • Track duration: Set reminders to review and release expired holds
  • Train compliance teams: Ensure your staff understands how to apply, monitor, and audit holds
  • Keep detailed logs: Document all hold activity for defensibility


All activity around holds and eDiscovery cases is logged in Microsoft Purview’s audit trails.

Final Thoughts

With Microsoft 365 E3, organizations can confidently respond to legal and regulatory demands without external software or complex infrastructure. Whether you’re a law firm, healthcare provider, financial institution, or enterprise, litigation hold and Core eDiscovery give you the ability to preserve and manage sensitive content with speed and precision.

These tools are not just for IT, they empower legal, compliance, and HR teams to take control of information governance and reduce risk.

Ready to Preserve Evidence and Prepare for Legal Discovery?

Use Microsoft 365 E3 to apply litigation holds, manage eDiscovery, and protect your business in legal scenarios. Built-in compliance, ready when you need it.

Stay tuned to our blog for more insights and tips.

Recent posts

Comments

Leave a Reply

Your email address will not be published. Required fields are marked *