In-Place Hold, formerly Litigation Hold and Legal Hold, can be useful after you have migrated to Office 365 for legal retention. If your company wants to make sure you keep everything regardless if a user moves or deletes it, you will want to become familiar with In-Place Hold.
How to Configure In-Place Hold
In the Exchange Admin Center in Office 365, under In-Place eDiscovery and Hold, click the ‘New’ icon (+).
Give it a name and description and click next. Here you will be able to select which mailboxes you would like to search or configure. If you are placing mailboxes on an In-Place Hold, then you will need to specify them individually. If you are searching existing mailboxes that are already on hold, you can select the all mailboxes option and specify the search criteria.
For our purposes, we are specifying mailboxes we wish to place on hold and selecting Include all mailbox content. Now we set our In-Place Hold duration and click Finish.
When you click finish, the search will get queued and begin shortly. It will mark the mailboxes as belonging to this In-Place Hold. It can take up to 60 minutes to fully take effect.
This will place every mailbox listed on an In-Place Hold of all mailbox content for 2 years. This includes deleted items. You can also create an In-Place Hold via the Exchange Online PowerShell. Below is an example:
New-MailboxSearch -Name “Legal-ProjectX” -SourceMailboxes DG-Marketing,DG-Executives -TargetMailbox LegalDiscovery@contoso.com -StartDate “01/01/2011” -EndDate “12/31/2011” -Recipients “*@contoso.com” -SearchQuery “project report hasattachments:true” -StatusMailRecipients “DG-DiscoveryTeam”
Searching Mailboxes for Mail
In the Exchange Admin Center in Office 365, under In-Place eDiscovery and Hold, click the ‘New’ icon (+). Give it a name and description and click next.
Here you will be able to select which mailboxes you would like to search or select the all mailboxes option and specify the search criteria. You can search mailboxes that are not configured for In-Place hold using the eDiscovery search but only In-Place hold retains emails even after the user deletes them.
I am going to search all mailboxes for emails that have the keyword of “test”.
After clicking next and finish, the search will queue and start shortly.
Once the search is complete, you will be able to Export the results to a PST by clicking the Export to a PST file icon. You can see the results of the search and the estimated size of the PST.
When you click the Export icon, it will open the eDiscovery PST Export Tool and give some further options.
How to add mailboxes to an existing In-Place Hold
The Portal is the only way you can add individual mailboxes to an existing In Place Hold. The add mailboxes window will only show 500 results at a time so if you have more mailboxes than that, you will need to perform some added work. You can add 500 mailboxes using the portal and then get a list of the remaining mailboxes by running this command:
Get-Mailbox | ft DisplayName,InPlaceHolds > c:\inplacehold.txt
How to remove an In-Place Hold
To remove an existing IN-Place Hold all you have to do is uncheck the box to place content on hold and click save. Then you can remove the In-Place Hold.
After adding new mailboxes to an existing In-Place Hold, it will go from Queued to Estimate in Progress to Estimate Succeeded. If you try to add more mailboxes before it is back to Estimate Succeeded then you might receive an error. Waiting until the status is Estimate Succeeded will correct the issue.
You can see the current status in the right hand window by highlighting the search.
Get-MailboxSearch while connected to Exchange Online PowerShell to see status for all searches.
Create or Remove an In-Place Hold: