Retention Policies vs. Legal Hold: What Each One Actually Preserves

Microsoft 365 gives businesses several ways to preserve email, documents and collaboration data. Two of the most commonly confused are retention policies and legal holds.

Both can stop content from being permanently deleted, but they are designed for different jobs.

A retention policy is generally part of your everyday information-governance programme. It determines how long categories of business content should be kept and whether they should be deleted afterwards.

A legal hold is normally created in response to a specific legal dispute, investigation or regulatory request. It preserves potentially relevant material while that matter remains active.

Using the wrong tool can leave a business retaining too much information, deleting evidence too early or assuming that content is protected when it is not.

Retention Policies and Legal Holds in Plain English

The simplest distinction is:

Retention policies manage the normal lifecycle of business information. Legal holds preserve evidence for a particular matter.

Microsoft Purview retention policies can be configured to retain content, delete it after a defined period, or retain it and then delete it. They can apply across several Microsoft 365 workloads rather than being limited to one mailbox or one investigation. 

A legal hold in Microsoft Purview eDiscovery is associated with a case. It is used to preserve content that may be relevant to that case, such as the mailboxes and OneDrive accounts of employees involved in a dispute or investigation. 

Microsoft also continues to support Litigation Hold for Exchange Online mailboxes. Litigation Hold preserves mailbox content, including deleted items and the original versions of modified items, either indefinitely or for a specified duration. 

What Does a Retention Policy Preserve?

A retention policy can protect content across supported Microsoft 365 locations, including:

• Exchange Online mailboxes
• SharePoint sites
• OneDrive accounts
• Microsoft 365 group mailboxes
• Teams chats and channel messages

SharePoint and OneDrive retention can preserve files stored in active and supported archived sites. Teams retention can preserve chat and channel-message data through the hidden Exchange storage used by Microsoft Teams. 

A policy may say, for example:

• Retain all company email for seven years.
• Retain SharePoint and OneDrive documents for five years.
• Delete Teams messages after three years.
• Retain selected information permanently.
• Keep content for a defined period and then delete it.

When a user deletes or changes retained information, Microsoft preserves the required copy behind the scenes. Exchange uses the Recoverable Items structure, while SharePoint and OneDrive use the Preservation Hold Library. 

The employee may no longer see the deleted item in their ordinary mailbox or document library, but the retained version remains available to authorised compliance or eDiscovery processes until the retention obligation ends.

When Should You Use a Retention Policy?

Retention policies are appropriate when the requirement is broad, predictable and applies as part of normal business operations.

Typical examples include:

• Keeping financial records for a defined regulatory period
• Preserving employee records according to company policy
• Retaining customer correspondence
• Deleting outdated Teams conversations
• Applying consistent rules across all users or selected departments
• Reducing risk by deleting information that the business no longer needs

They are designed to answer questions such as:

How long should this type of information normally exist?

Which locations should the rule cover?

Should the information be deleted automatically when the period ends?

A retention policy is therefore part of data lifecycle management rather than a reaction to one particular legal event. 

What Does a Legal Hold Preserve?

A legal hold preserves information that may be relevant to a specific matter.

That matter might involve:

• Employment proceedings
• Contract disputes
• Regulatory investigations
• Internal fraud investigations
• Intellectual-property claims
• Customer complaints
• Anticipated litigation

In Microsoft Purview eDiscovery, a case hold can target relevant data sources such as Exchange mailboxes, OneDrive accounts, SharePoint sites and other supported locations. The scope should reflect the people, locations and date ranges connected to the case. 

Unlike a broad organisation-wide retention rule, a legal hold is usually tied to:

• A named case
• Identified custodians
• Particular data sources
• A legal or investigative reason
• A release decision when the matter ends

The purpose is not to manage ordinary deletion schedules. It is to ensure potentially relevant evidence remains preserved while lawyers, investigators or regulators determine what is needed.

What About Exchange Litigation Hold?

Litigation Hold is an Exchange-specific mailbox hold rather than a tenant-wide Microsoft 365 data-lifecycle policy.

When enabled on a mailbox, it preserves:

• Existing mailbox items
• Deleted messages
• Original versions of edited mailbox items
• Content in the user’s archive mailbox, when one exists

The hold can remain in place indefinitely or use a defined duration calculated from the date an item was received or created. 

Litigation Hold can be useful when an entire mailbox must be preserved. However, it does not by itself preserve everything the employee may have stored in SharePoint, OneDrive or Teams.

For matters involving several Microsoft 365 workloads, an eDiscovery case hold is generally more suitable because it can be scoped across relevant locations.

Key Differences at a Glance

Litigation Hold is narrower still because it applies specifically to Exchange mailbox content.

What Happens When Several Policies or Holds Apply?

Microsoft 365 content can be affected by several preservation mechanisms at the same time.

A mailbox might be covered by:

• A Microsoft Purview retention policy
• A retention label
• An eDiscovery case hold
• Exchange Litigation Hold
• A delay hold
• Single Item Recovery

Microsoft advises administrators to identify every applicable preservation source before trying to delete content or remove a hold. Any one of these mechanisms may be enough to keep mailbox items in Recoverable Items or files in the Preservation Hold Library. 

In practice, content is not permanently deleted while an active rule still requires its preservation.

Removing one hold does not necessarily release the information if another retention policy or hold remains.

A Legal Hold Should Not Replace Your Retention Programme

Some organisations use Litigation Hold on every mailbox because it appears to be a simple way of keeping everything.

That approach can create problems:

• Data is retained without a clear lifecycle.
• Storage continues to grow.
• Unnecessary information remains discoverable.
• Legal review becomes more expensive.
• The business cannot demonstrate intentional deletion.
• SharePoint, OneDrive and Teams may remain outside the mailbox hold.

A proper retention programme defines what the organisation must keep and what it should delete. A legal hold temporarily overrides normal disposal for information connected to a specific matter.

The two controls should work together rather than replace one another.

A Retention Policy Should Not Replace a Case Hold

The opposite mistake is assuming that a general seven-year retention policy is automatically sufficient for litigation.

A broad policy might preserve much of the relevant content, but it may not accurately capture:

• The correct custodians
• All relevant Microsoft 365 locations
• Material older than the ordinary retention period
• Newly identified participants
• Content scheduled for deletion during the case
• The legal reasoning behind preservation

A formal case hold creates a clearer record showing which data sources were preserved for the matter and when the hold was introduced.

That audit trail can be important when demonstrating that the business took reasonable steps to protect evidence.

Retention and Holds Are Not Backups

Neither a retention policy nor a legal hold should be treated as a conventional backup.

They are designed to preserve information for governance, compliance and discovery—not necessarily to restore an entire mailbox, SharePoint site or OneDrive account to a previous operational state.

A backup strategy answers:

How quickly can we restore the business after deletion, corruption or ransomware?

Retention and legal hold answer:

Which information must not be permanently destroyed?

Businesses may need all three:

• Retention for normal information lifecycle
• Legal holds for disputes and investigations
• Backup for operational recovery

A Practical Decision Process

Use a retention policy when the requirement can be expressed as a continuing business rule:

Keep all finance records for seven years and then delete them.

Use a retention label when particular items require a more specific rule:

Keep signed contracts for ten years after expiry.

Use an eDiscovery legal hold when a particular case requires evidence to be preserved:

Preserve the mailboxes and OneDrive accounts of the employees involved in this dispute.

Use Exchange Litigation Hold when an entire mailbox and its archive must be preserved:

Preserve all content belonging to this mailbox until the hold is released.

Before implementing any of these controls, confirm the required Microsoft 365 licensing, administrative roles, storage implications and legal approval process.

Common Mistakes

Keeping Everything Forever

More retained information can mean higher investigation costs, increased privacy exposure and greater difficulty finding what matters.

Releasing a Hold Too Early

A case hold should be removed only after the legal or investigation owner confirms that preservation is no longer required.

Assuming One Workload Covers Another

A mailbox hold does not automatically protect the employee’s OneDrive files or every document stored in Teams.

Deleting the User Before Checking Preservation

Employee offboarding should include confirmation of retention, legal holds, OneDrive ownership and mailbox requirements before the account is removed.

Failing to Document the Reason

Every legal hold should have a case, owner, purpose, scope and release authority.

Never Reviewing Old Holds

Completed matters can leave obsolete holds in place for years, creating unnecessary storage and governance problems.

Retention and Legal Hold Checklist

Before creating a retention policy:

• Define the regulatory or business requirement.
• Identify the Microsoft 365 locations involved.
• Decide whether content should eventually be deleted.
• Confirm the retention trigger and duration.
• Test the policy with a limited scope.
• Assign an owner and review date.

Before placing content on legal hold:

• Open or identify the relevant case.
• Confirm the legal reason.
• Identify custodians and data sources.
• Include Exchange, OneDrive, SharePoint and Teams where relevant.
• Record when the hold started.
• Review the scope as the matter develops.
• Require authorised approval before release.

Final Thoughts

Retention policies and legal holds both preserve Microsoft 365 information, but they solve different problems.

Retention policies manage the normal life of business data. They help the organisation retain what it needs, delete what it no longer requires and apply consistent rules across Microsoft 365.

Legal holds preserve potentially relevant evidence for a specific dispute, investigation or regulatory matter. They should be targeted, documented and managed alongside the case that created the requirement.

Exchange Litigation Hold can preserve an entire mailbox, but it should not be mistaken for a complete Microsoft 365 governance programme.

The most effective approach is to use each control for its intended purpose:

Retention governs the lifecycle. Legal hold protects the evidence. Backup restores the operation.

Need Help With Microsoft Purview Retention and Legal Holds?

Hamilton Group can help your organisation design and manage Microsoft 365 data-preservation controls.

Our experts can help you:

• Review existing retention policies
• Design practical retention periods
• Configure Microsoft Purview retention labels
• Create and manage eDiscovery holds
• Review Exchange Litigation Hold
• Preserve former employees’ data correctly
• Identify overlapping holds
• Document hold-release procedures
• Align retention with Microsoft 365 Backup
• Build an auditable data-governance process

Visit hgmssp.com, call Hamilton Group on 0330 043 0069, or book a meeting with one of our experts to make sure important Microsoft 365 information is preserved for the right reasons—and for the right amount of time.