Link to home
Start Free TrialLog in
Avatar of Sleezed
Sleezed

asked on

Office 365 Mailbox hold and admin recovering/searching for a user's deleted items

I am using an Office 365 Enterprise E3 subscription.

I have 2 simple, related questions:

How can I, as an administrator, ensure that emails deleted/soft-deleted/hard-deleted by a user can always remain recoverable, preferably by administrators only? The goal is for protecting emails against malicious deletions by users who wish to cover up their tracks.

Further to that question, how can I, as an administrator, search for and recover emails which were deleted by a specific user?

I found a lot of information on the above, but every time I try to do it in practice I get stuck. Litigation hold seems to be deprecated in favor of In-Place Hold, but on the other hand In-Place Hold is not straightforward to enable and manage. Also I cannot actually search for deleted and/or purged emails, there are several different KBs on the matter that either reference settings and buttons which are no longer in the O365 portal, or simply redirect me to Exchange on-prem articles...

The questions I stated above should be quite straightforward to understand, can someone guide me on what to do exactly to basically hold/protect mailboxes against email purges/hard-deleted, and how to actually search for and recover deleted items.
Avatar of Vasil Michev (MVP)
Vasil Michev (MVP)
Flag of Bulgaria image

Litigation hold is NOT deprecated, and if you are enforcing hold on all mailboxes it is the preferred method. As for the search, you cannot (yet) search for messages in a specific folder only (for example "Deleted items" or "Purges"). So you have to do a generic eDiscovery search, copy the results to the discovery mailbox and then browse the content of the soft/hard-delete containers.
Avatar of Sleezed
Sleezed

ASKER

I just read a technet blog where Microsoft specify that they had in fact mentioned that Litigation Hold was going to be deprecated in the original documentation for EX 2013 and EX Online, but they have since retracted that statement and tried to clean up the documentation.

Re copying the results to the discovery mailbox, again, I'm following official Microsoft technet guidelines and articles and the settings, buttons and menus mentioned are simply missing from my portal, even though I have the correct subscription.

https://technet.microsoft.com/en-us/library/dn624163(v=exchg.150).aspx

I know there is now the new compliance search in the Compliance Center, but still, not getting anywhere.

https://technet.microsoft.com/en-us/library/ms.o365.cc.compliancesearch.aspx#create
You dont need the compliance center. You do however need to have permissions assigned so you can do an eDiscovery search, even if you are a Global admin. Here's an example article: https://technet.microsoft.com/en-us/library/dd298059(v=exchg.150).aspx
Avatar of Sleezed

ASKER

Done...but still the buttons, menus and settings are missing. Considering taking it up with Microsoft directly...even their O365 community was silent on this issue.
You have to logoff after adding yourself to the Discovery management group.
Avatar of Sleezed

ASKER

First thing I tried (logging out/in), but still didn't work. Don't worry, I'll read a bit more about it on Monday as I found a good guided tutorial. I will revert back once I find what the issue was.
ASKER CERTIFIED SOLUTION
Avatar of Sleezed
Sleezed

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial