# How to Place Microsoft Teams Data on Legal Hold

###### 10 Apr 2025  
###### 3 min read  
###### Anju George

Teams legal hold at a glance  
- Placing Microsoft Teams data on legal hold requires understanding where Teams content is stored and using Microsoft Purview’s eDiscovery tools to preserve it.
- **eDiscovery (Standard)** allows you to create and manage holds on content across Microsoft 365. For more advanced capabilities like custodian management, legal hold notifications, and analytics, **eDiscovery (Premium)** is required.

- Many organizations believe that they can leverage Microsoft's legal holds to back up critical data. This is a dangerous misconception that can place a company’s data at risk.

Organizations are required to preserve electronically stored information (ESI) to ensure legal and regulatory compliance. Microsoft 365 provides tools to help administrators apply legal holds on user data, ensuring that relevant information is preserved for potential litigation or investigation.

Legal holds are now configured using the Microsoft Purview Compliance Portal, which replaces the older Compliance Admin Center. Through eDiscovery (Standard or Premium) in Microsoft Purview, administrators can place holds on various content locations including:
- Exchange Online mailboxes  
- OneDrive for Business accounts  
- SharePoint sites (including those associated with Microsoft Teams)  
- Microsoft 365 Groups and Teams

When these content locations are placed on hold, all relevant data is preserved until the hold is removed, regardless of deletion by the end user. This ensures the integrity of data needed for legal proceedings.

In this article, we’ll explore how to place Microsoft Teams data on legal hold using Microsoft Purview.

## 1. Introduction to Teams legal hold

There may be instances where organizations must preserve Microsoft Teams messages for specific users or conversations related to litigation, regulatory requirements, or internal investigations. Microsoft Purview’s legal hold capabilities allow administrators to preserve Teams data across various content sources so it remains discoverable—even if users delete or modify that content.

Legal holds can be applied at both the **user** and **team** level:
- Placing a **user** on hold preserves their **1:1 chats**, **group chats**, **private channel messages**, and **files stored in OneDrive**.
- Placing a **team** (via the associated Microsoft 365 Group) on hold preserves **standard/shared channel messages** and **files stored in the team’s SharePoint site**.

**Note:** Since early 2020, Microsoft has supported placing legal holds on **private channel messages** in Microsoft Teams. These messages are not stored in the team’s group mailbox but instead reside in the **individual mailboxes** of the users who participate in the private channel. In contrast, **standard and shared channel conversations** are stored in the **Microsoft 365 Group mailbox** associated with the team.

If a **user's mailbox is already on legal hold**, then any **private channel messages** stored in that mailbox are automatically preserved as part of the hold. No additional configuration is required to include those messages, as long as the user's mailbox is covered.

## 2. Licensing requirements to create legal holds in Microsoft 365

To place a user or team on legal hold using Microsoft Purview eDiscovery, your organization must have the correct Microsoft 365 licensing. Microsoft offers two tiers of eDiscovery functionality:
- **eDiscovery (Standard):** Included with Microsoft 365 E3/E5, Office 365 E3/E5, or equivalent enterprise licenses
- **eDiscovery (Premium):** Available with Microsoft 365 E5 or as an add-on to E3

**eDiscovery (Standard)** supports basic holds and content search across Teams data. For advanced features like [**custodian management**](https://learn.microsoft.com/en-us/purview/ediscovery-add-custodians-to-case), [**review sets**](https://learn.microsoft.com/en-us/purview/ediscovery-analyzing-data-in-review-set), and **analytics**, you need **eDiscovery (Premium)**.

## 3. Content locations to place on hold to preserve Teams content

The content locations to be placed on hold depend on the type of Teams data you need to preserve and where this data is stored. ( [Learn more about Teams data storage location](https://www.syscloud.com/saas-data-protection-center/microsoft-365/teams-data-storage/)) For instance, to retain chat data (1:1 chat and group chats) for a specific user, the hold has to be placed on the user mailbox, whereas to retain standard channel data, the hold has to be placed on the group mailbox corresponding to the team.

The following table gives the content locations to be placed on hold to retain different types of Teams data.

| Type of data | Content location |
| --- | --- |
| Teams chats for a user (1:1 chats, 1:N group chats, and private channel conversations) | User mailbox |
| Teams channel chats (excluding private channels) | Group mailbox corresponding to the team |
| Files shared in standard/shared channels | SharePoint site corresponding to the team |

## 4. How to place a user or team on legal hold

**Note**: You need to be a Compliance admin or Global admin to perform the below steps.
- **Step 1:** Navigate to the [Microsoft Purview portal](https://compliance.microsoft.com/) and sign in with your credentials.
- **Step 2:** Select the **eDiscovery** solution card and then select **Cases (preview)** in the left nav. Choose an existing case or create a new one by selecting **Create case**, providing a unique name and description, and then selecting **Save**.

- **Step 3:** Select a case, then select the **Hold policies** tab. On the **Hold policies** dashboard, select **Create policy**. Enter a name and description. Select **Create** to create the new hold policy

- **Step 4:** Select **Add data sources** on the **Hold policy** tab. In the **Manage data sources** pane, specify the users, groups, or organizational locations to include in the hold.

**Note:** When a user or a group is placed on hold, all message copies will be retained. For instance, if a user posts a message in a Teams channel and then modifies the message, both copies of the message will be retained. Without the legal hold in place, only the latest message will be retained.

- **Step 5:** Configure Hold settings:
  
  Decide between:​
- **Infinite hold**: Preserves all content in the specified locations.
- **Query-based hold**: Preserves only content matching specific criteria.
- Optionally, set a **date range** to retain content sent, received, or created within a specific timeframe.
  
- **Step 6:** Review your hold settings and click the **Apply hold** button to create the hold.

After the legal hold has been created, you can search for the content retained by the hold using an eDiscovery search. [Click here](https://docs.microsoft.com/en-us/microsoftteams/ediscovery-investigation) to know how.

## 5. Limitations of using legal holds as a backup solution

Though legal holds keep a copy of Microsoft Teams data, it is not an alternative to a third-party cloud backup solution. Many organizations believe that they can leverage Microsoft's legal holds to back up critical data. This is a dangerous misconception that can place a company’s data at risk. Here are the limitations of using legal holds as a backup solution:
- If the Microsoft 365 account falls victim to a ransomware attack and becomes encrypted, so will all the data on legal hold.
- eDiscovery feature is available for organizations with Microsoft 365 Enterprise E3 or E5 plans, which are more expensive than Microsoft (Office) 365 Business plans.
- Data cannot be restored from one user account to another. If you have a user leaving the company, you need to manually export the user’s data and import it to another account, which will take a significant amount of manual effort and time.

## Conclusion

The native legal hold capability provided by Microsoft greatly eases the eDiscovery process for litigation purposes. Nevertheless, they are not designed for backup and restore, and therefore, have serious limitations as a backup solution. Third-party cloud backup applications like [SysCloud](https://www.syscloud.com/) are better options to back up your Microsoft 365 data.