Office 365 Mailbox hold and admin recovering/searching for a user's deleted items

Sleezed
Sleezed used Ask the Experts™
on
I am using an Office 365 Enterprise E3 subscription.

I have 2 simple, related questions:

How can I, as an administrator, ensure that emails deleted/soft-deleted/hard-deleted by a user can always remain recoverable, preferably by administrators only? The goal is for protecting emails against malicious deletions by users who wish to cover up their tracks.

Further to that question, how can I, as an administrator, search for and recover emails which were deleted by a specific user?

I found a lot of information on the above, but every time I try to do it in practice I get stuck. Litigation hold seems to be deprecated in favor of In-Place Hold, but on the other hand In-Place Hold is not straightforward to enable and manage. Also I cannot actually search for deleted and/or purged emails, there are several different KBs on the matter that either reference settings and buttons which are no longer in the O365 portal, or simply redirect me to Exchange on-prem articles...

The questions I stated above should be quite straightforward to understand, can someone guide me on what to do exactly to basically hold/protect mailboxes against email purges/hard-deleted, and how to actually search for and recover deleted items.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Most Valuable Expert 2015
Distinguished Expert 2018

Commented:
Litigation hold is NOT deprecated, and if you are enforcing hold on all mailboxes it is the preferred method. As for the search, you cannot (yet) search for messages in a specific folder only (for example "Deleted items" or "Purges"). So you have to do a generic eDiscovery search, copy the results to the discovery mailbox and then browse the content of the soft/hard-delete containers.

Author

Commented:
I just read a technet blog where Microsoft specify that they had in fact mentioned that Litigation Hold was going to be deprecated in the original documentation for EX 2013 and EX Online, but they have since retracted that statement and tried to clean up the documentation.

Re copying the results to the discovery mailbox, again, I'm following official Microsoft technet guidelines and articles and the settings, buttons and menus mentioned are simply missing from my portal, even though I have the correct subscription.

https://technet.microsoft.com/en-us/library/dn624163(v=exchg.150).aspx

I know there is now the new compliance search in the Compliance Center, but still, not getting anywhere.

https://technet.microsoft.com/en-us/library/ms.o365.cc.compliancesearch.aspx#create
Most Valuable Expert 2015
Distinguished Expert 2018

Commented:
You dont need the compliance center. You do however need to have permissions assigned so you can do an eDiscovery search, even if you are a Global admin. Here's an example article: https://technet.microsoft.com/en-us/library/dd298059(v=exchg.150).aspx
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Author

Commented:
Done...but still the buttons, menus and settings are missing. Considering taking it up with Microsoft directly...even their O365 community was silent on this issue.
Most Valuable Expert 2015
Distinguished Expert 2018

Commented:
You have to logoff after adding yourself to the Discovery management group.

Author

Commented:
First thing I tried (logging out/in), but still didn't work. Don't worry, I'll read a bit more about it on Monday as I found a good guided tutorial. I will revert back once I find what the issue was.
Commented:
Resolved.

The issue was that I was adding the permissions to the DiscoveryManagement group in the Compliance Center, not the Exchange Admin Center. Once I did that, I could see the required settings.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial