What is a legal hold?¶
A legal hold is a control that preserves defined data against ordinary deletion or retention expiry. It maintains availability; it is not itself collection, disclosure or proof of the preserved material.
Scope determines what is protected¶
A hold may cover selected accounts, custodians, folders, messages, file versions or date ranges. Content, metadata, deleted items, audit logs, application data and backups may sit in different systems and need separate coverage.
Record who applied the hold, authority and start time, systems and data types included, relevant period, exceptions and later changes. A hold cannot recover material that had already expired before it took effect.
Preservation can be invisible to the user¶
Compliance systems may retain a copy beyond the user's ordinary deletion rights without displaying it in the live account. That copy may have a separate export and audit process.
The provider, customer organisation and connected applications can each hold different records. One organisational hold should not be assumed to bind every external service.
Collection remains a separate step¶
Preserved data still needs to be obtained through the appropriate lawful process and documented source. Confirm the hold's actual result rather than treating configuration alone as proof that every intended item survived.
At 10:05, authorised administrator Priya applies Purview eDiscovery hold HOLD-88 to Dave's OneDrive location SITE-21 for 1-31 August. Status record HS-19 reports success at 10:18. Dave deletes object OBJ-4407 later that day, and an eDiscovery export returns retained version V-19 with hash H-A6. The records establish that the defined location accepted the hold and the identified content survived. They do not establish that Teams chats, external services or already-expired records were included.
The next useful comparison is HOLD-88 and HS-19 against the case authority, location list, error report, policy changes, export manifest and separate preservation routes for every other relevant holder.
Current Microsoft eDiscovery-hold example - checked 3 September 2026
Microsoft describes eDiscovery holds as case-specific controls that preserve selected content locations until released. Retention policies, labels and other hold sources can independently preserve material, so the actual location status and hold source must be identified.
The point to remember
A legal hold suspends ordinary loss for defined data. Verify its timing, systems and record coverage, then treat acquisition and evidential interpretation as separate stages.
