Powershell confirm user has a eDiscovery hold

Question

I have created a eDiscovery case and selected the users \ sources and created a hold which is showing as active. In PowerShell the Lithold for the usermailbox is showing a false is this correct? I know Lithold is Exchange only and eDiscovery covers all 365.

Answer 1

@rr-4098

Great question and you're absolutely right to be curious about the difference here.

You're correct that LitigationHoldEnabled showing as False does not necessarily mean the user isn't on hold. Here's why:

Litigation Hold vs. eDiscovery Hold

LitigationHoldEnabled only reflects whether a Litigation Hold has been applied directly on the Exchange mailbox.

An eDiscovery hold (set through a Microsoft Purview eDiscovery case) is a different type of hold and does not update the LitigationHoldEnabled property — this is expected behavior.

How to Confirm eDiscovery Hold

To confirm if the user is under an eDiscovery (In-Place) hold, you can run:

Get-Mailbox <user> | FL LitigationHoldEnabled, InPlaceHolds

If a case-based hold is applied, you’ll typically see a GUID starting with UniH under InPlaceHolds, indicating an eDiscovery hold.

If InPlaceHolds is empty, ensure:

• The hold was applied correctly in the case.
• The mailbox is included as a source in the hold policy.

For additional information, please refer: Get-Mailbox

Optional - Check Mailbox Diagnostics

For deeper insight, you can also review hold tracking logs:

$ht = Export-MailboxDiagnosticLogs <user> -ComponentName HoldTracking
$ht.MailboxLog | ConvertFrom-Json

This can help confirm what holds are currently active on the mailbox.

For more details, please refer: How to identify the type of hold placed on an Exchange Online mailbox

I hope this information helps. Please do let us know if you have any further queries.

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.

Thank you.