Avatar of Sleezed
 asked on

Office 365 Mailbox hold and admin recovering/searching for a user's deleted items

I am using an Office 365 Enterprise E3 subscription.

I have 2 simple, related questions:

How can I, as an administrator, ensure that emails deleted/soft-deleted/hard-deleted by a user can always remain recoverable, preferably by administrators only? The goal is for protecting emails against malicious deletions by users who wish to cover up their tracks.

Further to that question, how can I, as an administrator, search for and recover emails which were deleted by a specific user?

I found a lot of information on the above, but every time I try to do it in practice I get stuck. Litigation hold seems to be deprecated in favor of In-Place Hold, but on the other hand In-Place Hold is not straightforward to enable and manage. Also I cannot actually search for deleted and/or purged emails, there are several different KBs on the matter that either reference settings and buttons which are no longer in the O365 portal, or simply redirect me to Exchange on-prem articles...

The questions I stated above should be quite straightforward to understand, can someone guide me on what to do exactly to basically hold/protect mailboxes against email purges/hard-deleted, and how to actually search for and recover deleted items.
Microsoft 365ExchangeEmail Servers

Avatar of undefined
Last Comment

8/22/2022 - Mon
Vasil Michev (MVP)

Litigation hold is NOT deprecated, and if you are enforcing hold on all mailboxes it is the preferred method. As for the search, you cannot (yet) search for messages in a specific folder only (for example "Deleted items" or "Purges"). So you have to do a generic eDiscovery search, copy the results to the discovery mailbox and then browse the content of the soft/hard-delete containers.

I just read a technet blog where Microsoft specify that they had in fact mentioned that Litigation Hold was going to be deprecated in the original documentation for EX 2013 and EX Online, but they have since retracted that statement and tried to clean up the documentation.

Re copying the results to the discovery mailbox, again, I'm following official Microsoft technet guidelines and articles and the settings, buttons and menus mentioned are simply missing from my portal, even though I have the correct subscription.


I know there is now the new compliance search in the Compliance Center, but still, not getting anywhere.

Vasil Michev (MVP)

You dont need the compliance center. You do however need to have permissions assigned so you can do an eDiscovery search, even if you are a Global admin. Here's an example article: https://technet.microsoft.com/en-us/library/dd298059(v=exchg.150).aspx
I started with Experts Exchange in 2004 and it's been a mainstay of my professional computing life since. It helped me launch a career as a programmer / Oracle data analyst
William Peck

Done...but still the buttons, menus and settings are missing. Considering taking it up with Microsoft directly...even their O365 community was silent on this issue.
Vasil Michev (MVP)

You have to logoff after adding yourself to the Discovery management group.

First thing I tried (logging out/in), but still didn't work. Don't worry, I'll read a bit more about it on Monday as I found a good guided tutorial. I will revert back once I find what the issue was.
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.

View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.