Processing a litigation hold end to end

A litigation hold is a legal directive to preserve everything in a set of mailboxes — usually triggered by a subpoena, regulatory inquiry, or internal HR/fraud investigation. Once a hold is in place, nothing the user does (delete, empty Deleted Items, even "permanent" delete) actually removes the data; it's retained in a hidden structure and remains discoverable.

The command to apply one is trivial. What separates a clean hold from a career-defining mistake is the pre-check: establishing what state each target mailbox is actually in before you touch anything. Terminated-employee mailboxes are the trap — they may be inactive, soft-deleted, or already purged, and each demands a different path.

The one principle

Always verify mailbox status before applying — or releasing — a hold. Applying a hold to a mailbox you think exists but has been purged preserves nothing. Releasing a hold on a mailbox that's still on hold for another active matter can destroy evidence permanently. The status check is the whole job.

01Connect to both planes

Holds live in two places: Exchange Online and Purview. You need both.

# Exchange Online — mailbox hold properties
Connect-ExchangeOnline -UserPrincipalName [email protected]

# Security & Compliance (Purview) — eDiscovery cases & hold policies
Connect-IPPSSession -UserPrincipalName [email protected]

The two connections answer different questions. Exchange Online tells you a mailbox's hold flags and the raw hold GUIDs on it; the compliance endpoint tells you which eDiscovery cases and policies those GUIDs belong to. You need to correlate both to know why a mailbox is held.

02The pre-check: what state is each mailbox in?

This determines everything downstream. Four states, four approaches.

Four states, four paths. The single most important pre-check is which of these a terminated employee's mailbox is in. Soft-deleted is the time-critical case — the retention window is ticking, and once it expires the data is gone for good.

Pull the hold and status flags for every mailbox in the request. The properties that matter are the hold flags and whether the object is an inactive mailbox:

Get-Mailbox -Identity [email protected] | Format-List `
  DisplayName, RecipientTypeDetails, LitigationHoldEnabled, `
  InPlaceHolds, AccountDisabled, IsInactiveMailbox

# find inactive (preserved-after-deletion) mailboxes
Get-Mailbox -InactiveMailboxOnly -Identity [email protected]

# find soft-deleted mailboxes still inside the recovery window
Get-Mailbox -SoftDeletedMailbox -Identity [email protected]

The InPlaceHolds property is a list of hold GUIDs. An empty value on a terminated user is a red flag — it may mean the mailbox was never preserved and, if past the window, is already gone. A populated value means it's held; your next job is to find out by which matter before you change anything.

03Apply the hold — two mechanisms

Exchange Litigation Hold vs. Purview eDiscovery hold. Prefer eDiscovery.

# Exchange Litigation Hold — simple, per-mailbox
Set-Mailbox -Identity [email protected] -LitigationHoldEnabled $true `
  -LitigationHoldDuration Unlimited

# Purview eDiscovery hold — case-based, scoped, auditable (preferred)
New-CaseHoldPolicy -Name "Matter-1234" -Case "Matter 1234" `
  -ExchangeLocation [email protected]
New-CaseHoldRule -Name "Matter-1234-Rule" -Policy "Matter-1234"

Aspect	Exchange Litigation Hold	Purview eDiscovery hold
Scope	Whole mailbox, per-mailbox	Case-based, query-scoped if needed
Tied to a matter	No — just a flag	Yes — lives inside a named case
Covers inactive mailboxes	Awkward	Yes, by address / GUID
Auditability	Minimal	Strong — case, policy, membership
Use when	Quick, single-mailbox preservation	Anything tied to a real legal matter

Prefer the eDiscovery hold for anything attached to an actual matter: it's scoped to a named case, covers inactive mailboxes cleanly, and — critically — leaves an audit trail that ties each held mailbox to the reason it's held. That trail is what makes safe release possible later.

04Verify, then document

A hold you didn't verify is a hold you can't defend.

# confirm the hold is present after applying
Get-Mailbox -Identity [email protected] |
  Format-List LitigationHoldEnabled, InPlaceHolds, LitigationHoldDate

Then write the closure note: who requested it, the matter reference, each mailbox and the state it was in, which hold mechanism you used, and the verification output. This record is not bureaucracy — it's the thing that lets someone (maybe you, months later) safely release the hold without guessing, and it's what you produce if the preservation is ever challenged.

Never release blind — one mailbox can be held for many matters

A mailbox's InPlaceHolds can contain several GUIDs from different active cases. Removing "the hold" because one matter closed can strip preservation that another open matter still depends on — permanent, unrecoverable data loss with legal consequences. Releasing a hold is its own procedure, with its own pre-check. (That's a separate post.)

The pattern

A hold is only as good as the pre-check under it. Establish mailbox state first — active, inactive, soft-deleted, purged — pick the mechanism that matches, verify it took, and document why. The command is the easy part; the status check is the job.