Office 365 Mailbox hold and admin recovering/searching for a user's deleted items

I am using an Office 365 Enterprise E3 subscription.

I have 2 simple, related questions:

How can I, as an administrator, ensure that emails deleted/soft-deleted/hard-deleted by a user can always remain recoverable, preferably by administrators only? The goal is for protecting emails against malicious deletions by users who wish to cover up their tracks.

Further to that question, how can I, as an administrator, search for and recover emails which were deleted by a specific user?

I found a lot of information on the above, but every time I try to do it in practice I get stuck. Litigation hold seems to be deprecated in favor of In-Place Hold, but on the other hand In-Place Hold is not straightforward to enable and manage. Also I cannot actually search for deleted and/or purged emails, there are several different KBs on the matter that either reference settings and buttons which are no longer in the O365 portal, or simply redirect me to Exchange on-prem articles...

The questions I stated above should be quite straightforward to understand, can someone guide me on what to do exactly to basically hold/protect mailboxes against email purges/hard-deleted, and how to actually search for and recover deleted items.
SleezedAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Vasil Michev (MVP)Commented:
Litigation hold is NOT deprecated, and if you are enforcing hold on all mailboxes it is the preferred method. As for the search, you cannot (yet) search for messages in a specific folder only (for example "Deleted items" or "Purges"). So you have to do a generic eDiscovery search, copy the results to the discovery mailbox and then browse the content of the soft/hard-delete containers.
0
SleezedAuthor Commented:
I just read a technet blog where Microsoft specify that they had in fact mentioned that Litigation Hold was going to be deprecated in the original documentation for EX 2013 and EX Online, but they have since retracted that statement and tried to clean up the documentation.

Re copying the results to the discovery mailbox, again, I'm following official Microsoft technet guidelines and articles and the settings, buttons and menus mentioned are simply missing from my portal, even though I have the correct subscription.

https://technet.microsoft.com/en-us/library/dn624163(v=exchg.150).aspx

I know there is now the new compliance search in the Compliance Center, but still, not getting anywhere.

https://technet.microsoft.com/en-us/library/ms.o365.cc.compliancesearch.aspx#create
0
Vasil Michev (MVP)Commented:
You dont need the compliance center. You do however need to have permissions assigned so you can do an eDiscovery search, even if you are a Global admin. Here's an example article: https://technet.microsoft.com/en-us/library/dd298059(v=exchg.150).aspx
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

More Information
SleezedAuthor Commented:
Done...but still the buttons, menus and settings are missing. Considering taking it up with Microsoft directly...even their O365 community was silent on this issue.
0
Vasil Michev (MVP)Commented:
You have to logoff after adding yourself to the Discovery management group.
0
SleezedAuthor Commented:
First thing I tried (logging out/in), but still didn't work. Don't worry, I'll read a bit more about it on Monday as I found a good guided tutorial. I will revert back once I find what the issue was.
0
SleezedAuthor Commented:
Resolved.

The issue was that I was adding the permissions to the DiscoveryManagement group in the Compliance Center, not the Exchange Admin Center. Once I did that, I could see the required settings.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Office 365

From novice to tech pro — start learning today.