Litigation Holds in Office 365: Best Practices and Main Challenges

Today, there is so much data that companies need to track. Organizations witnessed a 42.2% increase in average annual data growth between 2020 and 2022. At Logikcull alone, we’ve seen the number of unique documents uploaded per project increase by more than 380% since 2012.

If your company is in line with most of corporate America, you are probably using O365’s suite—recently rebranded as Microsoft 365—of productivity and communication tools. According to FRCP 37(e)’s obligations regarding preserving ESI, any Teams conversation or Slideshare presentation can be just as relevant as your typical PDF on a litigation-sensitive issue. 

In the wake of Zubulake, companies must show they have a defensible litigation hold process to avoid potential adverse inference issues over spoliated evidence. O365 does come packed with built-in discovery tools that you can use to jumpstart your discovery initiatives. However, despite their utility, these tools ultimately function best when paired with advanced hold and discovery programs.

What is a Litigation Hold in Office 365?

A litigation hold in Office 365 is a retention feature that allows companies to preserve data across the O365 app ecosystem. With the help of this litigation hold capability, O365 administrators can preserve data such as Outlook emails, Teams conversations, OneDrive files, and the like, all while preventing company personnel from deleting these files. 

O365 legal holds are not the same as the custodian preservation notices that lawyers typically think of when they use the term since they are meant just for data preservation. O365’s highest-tier eDiscovery plan, however, does include a version of custodian notification tracking as part of its feature set.

O365’s various litigation hold options can help with the initial stages of data preservation depending on the plan you’re on. Even if your users are on an Exchange 1 plan, your company can still leverage data preservation features as long as you sign up for appropriate add-ons. However, to access more advanced options such as legal hold notifications, your organization will need to have an E5 license or related add-ons.

How to Place a Legal Hold in Office 365

Placing a litigation hold in Office 365 can be straightforward, depending on your plan. 

To put an individual mailbox on hold, you must first ensure that the mailbox you’re targeting has at least an Exchange Plan 2 license or an appropriate add-on license. If so, administrators can go into the organization’s active user list in their admin dashboards, select the user mailbox they want to apply a hold to, and click the “Manage litigation hold” option in that user’s profile. 

After administrators confirm the duration of the hold and the types of custodian alerts they want to send, they can save the hold for it to take effect. 

Organizations with at least an E3 plan or applicable add-on licenses can leverage O365’s Core eDiscovery features, which allow them to conduct a litigation hold in Teams, OneDrive litigation hold, and more. Through O365’s Compliance Center, administrators can run the O365 legal hold wizard to activate searches involving specific Teams and OneDrive accounts. From there, you can have the wizard pull content from specific keywords and queries. More advanced collection tactics involving a Teams litigation hold will require PowerShell coding to execute.

Creating and tracking notices for your customers is also important. Companies with Advanced eDiscovery enabled can access their list of eDiscovery cases in O365’s compliance center and use the Create Communication Wizard to draft and automate initial notices, follow-up notices, re-issuance notifications, and escalations. They can also create portals for custodians to track their compliance with outstanding matters. 

Key Challenges an Office 365 Litigation Hold Plan Can Present

 O365 legal hold tools may make it look easy to find and preserve evidence. However, O365 was designed with the average business user and IT in mind—not lawyers. 

Here is where O365’s legal holds and eDiscovery tools may pose challenges for legal team members:

Preservation and Searching Challenges

As you manage your Office 365 holds, some content may get lost in the shuffle. 

In Teams, organizations running Core eDiscovery aren't able to preserve audio conversations, code snippets, user reactions, and feed notifications. Even searches for private channel files, guest user content, and Teams card content must entail PowerShell scripting or advanced searching due to how O365 stores this ESI. 

Additionally, the amount of data you collect will be limited to your O365 storage quotas. For Exchange mailboxes, for example, this quota is 110 GB. Beyond this, you will need to stay abreast of your license management to ensure critical custodian mailboxes from departing employees do not disappear. 

Unless your administrator places a litigation hold on a mailbox before deletion, mailboxes enter into a “soft-delete” phase, allowing O365 to hold the account in retention for 30 days in your organization’s Azure AD’s mailbox recycle bin. After this period, however, the entire account and its contents are deleted.

The Efficacy of eDiscovery Features Varies By Plan

‍Businesses looking to access O365’s Advanced eDiscovery features must ensure that all their users are on an E5 subscription plan or have applicable add-ons. 

Without an E5 plan or add-on, organizations won’t be able to take advantage of this Office 365 litigation hold plan’s buffet of eDiscovery features, including tagging, analytics, document metadata searching, conversation threading, and custodian management tools. Administrators will also be unable to issue legal hold notifications through O365 directly. This issue can lead to a disjointed custodian notification approach.

Data Exports Can Be Cumbersome

‍Advanced eDiscovery administrators can export their organization’s self-owned and managed Azure SD container and then download the contents from a local computer in your organization or other location. 

In plans using Content Search and Core eDiscovery, your only option is to export search results onto a local computer. Following this playbook may not impress a judge post-Zubulake. Ideally, your information should be stored away in an encrypted, safeguarded environment for preservation to ensure defensible chains of custody.

Alternatives to Using Office 365 Legal Holds

The features surrounding a litigation hold in Office 365 help get your foot in the door with data management for disputes and investigations. Still, they may not be enough to showcase the defensibility of your processes. 

Sure, you can always Excel-lerate your hold process the old-fashioned way. But the endless custom emails, Excel sheets, and intake questionnaires can turn traditional legal hold notices into a time-sucking chore. Automation, therefore, should still lead front and center. 

Pairing O365 with Logikcull allows you to leverage a direct integration and legal hold automation capabilities to uplevel your Office 365 litigation hold plan and address your enterprise-wide collection, preservation and review efforts. All while ensuring your data is in a secure environment where spoliation is nearly impossible. 

In Logikcull, you can leverage the MS365 integration to instantly collect custodians’ Outlook emails into a secure, 256-bit AES encrypted environment. Doing so will allow you to unify your collection efforts without having to worry about whether you have suitable licenses or add-ons for each of your user accounts.

You can also easily drag and drop other types of data from your O365 ecosystem into Logikcull for preservation and review. These features can help keep data unaltered over the duration of your holds, which is especially useful if your O365 plan doesn't allow for proper preservation.

Automated legal hold notice tools can help save time and allow you to combine your O365 preservation efforts with your non-Microsoft-related data preservation tasks. Logikcull Hold, the basic version of which is totally free, enables you to easily issue hold notices for every type of O365 litigation hold. In the process, you can automatically track custodian acknowledgments and manage reminders and releases in a matter of clicks. This will allow you to follow defensible custodian notice practices when implementing, for example, a routine Teams litigation hold or OneDrive litigation hold.

Once your litigation hold in Office 365 transforms into a full-blown matter, you can start conducting eDiscovery in all your O365 data instantly, together with data from any other ESI source. It all happens in a single centralized and ultra-secure platform. 

A litigation hold in Office 365 constitutes a critical part of an organization’s reasonable preservation efforts. While O365 offers helpful tools to jumpstart this process, in-house teams must still pair their Office 365 litigation hold plan with more robust, legally-minded tools to demonstrate the defensibility of their litigation hold processes. 

Combining O365 legal holds with a discovery and legal hold platform like Logikcull can ease your processes through automation and make O365 eDiscovery much more seamless and cost-effective.