Office365 Retention Policy vs Litigation Hold

Question

I have read the documentation for Retention Policies and Litigation Hold repeatedly. I thought I understood what was up but talking with Microsoft support today they said the complete opposite of what I thought I should be doing with Retention and Litigation.

I have read the docs repeatedly. Over and over and I'm more confused than ever. I've searched the internet and still get conflicting views and details about the two. People say they're different but then fail to truly explain what up.

So now I ask the MS QA Community for help because I've studied too much and now I don't believe Microsoft support.

If I want to retain data for an extended period of time and be able to recover it which should I be using? Retention Policies or Litigation Hold?

Support said I should be using Litigation hold to retain info for an extended period of time.

I thought that retention polices is supposed to do that.

Answer 1

Hi @ComputerHabit

These truly are two different functions.

1) Retention policies are meant for setting how long data in an Office 365 tenant should be held for, and what should happen after this period is up (delete, archive, etc).

2) Litigation hold trumps retention policies as it is meant for investigatory/hold reasons. A litigation hold can manually be placed on a user's mailbox so that nothing is deleted by anyone or any automated process (such as a retention policy).

A good explanation between the two can be found at https://www.nucleustechnologies.com/blog/microsoft-365-litigation-hold-vs-retention-policy/#:~:text=Litigation%20Hold%20can%20be%20applied,take%20priority%20over%20data%20again.

---

Microsoft support was not wrong by saying to use a litigation hold to retain info for an extended period of time (of course this is true if you have retention policies in place that may delete data after a certain period of time).

Documentation for Create and configure retention policies

https://learn.microsoft.com/en-us/microsoft-365/compliance/create-retention-policies?view=o365-worldwide

Documentation for Create a Litigation hold

https://learn.microsoft.com/en-us/microsoft-365/compliance/create-a-litigation-hold?view=o365-worldwide

When you place a user mailbox on Litigation hold, content in the user's archive mailbox (if it's enabled) is also retained. When you create a hold, you can specify a hold duration (also called a time-based hold) so that deleted and modified items are retained for a specified period and then permanently deleted from the mailbox. Or you can just retain content indefinitely (called an infinite hold) or until the Litigation hold is removed.

Hope this helps you understand better.

---

If this is helpful please mark as correct answer.

Answer 2

The confusion usually stems from the fact that there are two similarly named functionalities within M365. The retention policies, as found in the Purview compliance portal, are in fact comparable to a litigation hold, in the sense that they can retain data for extended periods, ensure said data is immutably preserved and available for eDiscovery, and in general aim to fulfill compliance requirements. The underlying technology that ensures data preservation is shared between the two, for example in the case of Exchange mailbox data, both retention policies and Litigation holds takes advantage of the recoverable items subtree to store items. You can think of retention labels/policies as an upgrade to the litigation hold functionality, as they are more granular and cover more scenarios.

The other set of retention policies (and retention tags) can be found as part of Exchange Online. Despite their name, they serve a different purpose - they help you get rid of data, either by deleting it or moving it to the Online archive. They are specific to Exchange Online only, and so they can only be managed as part of the EAC (or PowerShell). They do not help preserve data, but can be used as part of the disposition process (i.e. when you have compliance requirements to get rid of data after X years).

Answer 3

I think this sums up what I was thinking. Retention polices should be used. Not litigation hold.

https://learn.microsoft.com/en-us/microsoft-365/compliance/retention?view=o365-worldwide#use-retention-policies-and-retention-labels-instead-of-older-features

https://learn.microsoft.com/en-us/microsoft-365/compliance/retention?view=o365-worldwide#when-to-use-retention-policies-and-retention-labels-or-ediscovery-holds

Answer 4

My confusion early on came from the way Microsoft named these two functions. But if all you care about is what they are and when to use them, this is what I'd say:

• Retention policies are used to DELETE messages within mailboxes. They automatically purge/archive items based on rules (retention tags) which you can customize. Their purpose is to prevent mailboxes from growing too large. Most importantly they do not prevent end-users from deleting mailbox contents. They generally run in the background at all times as part of an organization's mail management strategy.
• Litigation hold is used to PRESERVE messages within mailboxes. When turned on for a given mailbox it will trump retention policies and user actions (including a user deleting a message). They are turned on as-needed under special circumstances (such as your legal department requesting the preservation of one or more mailboxes). When their legal requirements are done they are turned off/deleted, allowing the retention policies and manual deletions by the user to resume message handling.

Hopefully this helps.

-Bob

Answer 5

So I read both DillonJS and michev. Then I'm still confused.

Dillon says yes, use Litigation hold instead of Retention policy.

Then michev says use Retention Policy.