Forum Discussion
Retention policy and legal hold
Hi all,
If I want to preserve all emails from all users (including exited users) for 7 years, even if the users deleted or modified them, is it right to set this using "retention policy" in Office 365 Security and Compliance center?
I noticed that there is another function called Legal hold. What is the difference between using legal hold to hold all emails and using retention policy to preserve all emails?
4 Replies
Yes, you can use the Retention policies found in the SCC. The naming is confusing, as we've had different type of "retention" in Exchange for a while now. You can learn more about them here: https://support.office.com/en-us/article/Overview-of-retention-policies-5e377752-700d-4870-9b6d-12bfc12d2423?ui=en-US&rs=en-US&ad=US
As explained in the article, behind the scenes Retention policies place the mailbox on hold, so that content is preserved immutably, in-place. This will also apply to "leavers", which will turn into "Inactive" mailboxes once the user account is deleted.
Hi Vasil,
Thanks for your reply. Actually I also read the article you mentioned. From this article, if I haven't misunderstood, retention policy can do the same thing in-place hold or legal hold did. (As under the header "Use a retention policy instead of these features"). But still, I heard many other people say that "retention policy is different from legal hold". So I really wish to clarify if the "retention policy" in SCC can already archive the same function as legal hold, and is there still any need for us to set legal hold if we already set retention policy to preserve all emails for 7 years.
Retention policies/tags in Exchange are indeed different from hold, but as detailed in the article, the same-named policies in the SCC are different and do "retain" content. You can still simply use good old litigation holds to ensure content is preserved, if you are having troubles with the new retention policies.
Check out this article if you haven't seen it already - https://blogs.technet.microsoft.com/uspartner_ts2team/2014/01/09/litigation-hold-versus-in-place-hold-in-exchange-online/. Basically, Litigation Hold was the original way to preserve data but a more flexible method became available subsequently called In-Place Hold. Either can be used in Office 365 depending on the requirements. See the In-Place Hold and Litigation Hold section in the https://technet.microsoft.com/en-us/library/exchange-online-message-policy-recovery-and-compliance.aspx.
There are some https://technet.microsoft.com/en-gb/library/ff637980(v=exchg.150).aspx though:
"We've postponed the July 1, 2017 deadline for creating new In-Place Holds in Exchange Online (in Office 365 and Exchange Online standalone plans). But later this year or early next year, you won't be able to create new In-Place Holds in Exchange Online. As an alternative to using In-Place Holds, you can use https://go.microsoft.com/fwlink/?linkid=780738 or https://go.microsoft.com/fwlink/?linkid=827811 in the Office 365 Security & Compliance Center."
For Retention tags and retention policies in Exchange Online, that's more to do with how long to keep items for compliance reasons. We had a setup of 5 years email were kept for using retention but that wouldn't preserve the emails indefinitely if the user went out of their way to delete items, accidentally or otherwise.
