Forum Discussion
eDiscovery Content Search for Items in Purge Folder
We have to following configuration in place
- User on litigation hold
- Purview Exchange Online delete policy
The delete policy will have deleted email from the Exchange Online Archive and I believe it will now be in the purge folder for the user. I have a requirement to run an eDiscovery content search for this user against their purge folder and then restore email back into their Exchange Online Archive. I have created a content search with the data source = Exchange Email and I have used the the syntax 'folderid:purges AND ItemClass=IPM.Note' for the query. Could someone please help to understand if this will work? No syntax errors where shown in the query but I have had this search running for approx 4 hours now.
Thanks in advance
Chris
To get this to work, you need to provide the identifier for the Purges folder, not its name. The process is covered in this article: https://learn.microsoft.com/en-us/purview/ediscovery-use-content-search-for-targeted-collections
Keep in mind that the identifier will be different for each mailbox, so if you have multiple users to cover, you have to repeat the process for each user. Also, the Purges folder within the Online archive mailbox will have a different id from the Purges folder of the main mailbox, so make sure you provide the correct one.
3 Replies
If a mailbox is subject to both a Litigation Hold, which retains content indefinitely (or until a specified end date), and a Purview retention policy, which deletes content, then the content in the mailbox is governed by two sets of retention/hold rules. In this scenario, the principles of retention apply, meaning Retention will always take precedence over Deletion.
In your scenario, when the retention policy is set to automatically delete an email, Microsoft checks whether the email is subject to any other retention policies or holds. Since the content is under a litigation hold, it cannot be permanently deleted. Instead, it is moved to the Recoverable Items folder (a hidden folder), where it will remain until the hold is released. Once the hold is released, the content will be automatically deleted. The Recoverable Items folder remains discoverable by eDiscovery tools by searching the mailbox.
References
Learn about retention policies & labels to retain or delete | Microsoft Learn
To get this to work, you need to provide the identifier for the Purges folder, not its name. The process is covered in this article: https://learn.microsoft.com/en-us/purview/ediscovery-use-content-search-for-targeted-collections
Keep in mind that the identifier will be different for each mailbox, so if you have multiple users to cover, you have to repeat the process for each user. Also, the Purges folder within the Online archive mailbox will have a different id from the Purges folder of the main mailbox, so make sure you provide the correct one.
Thanks very much for this
