Microsoft Purview · eDiscovery
Hold
Place and manage legal holds on content to preserve it during investigations and litigation.
Scope: Hold management within assigned eDiscovery cases
Permissions
- Case Holds - Create and manage case holds
- Location Holds - Place holds on mailboxes, SharePoint sites, and Teams
- Query-Based Holds - Configure query-based holds for specific content
- Hold Status - Monitor hold status and errors
- Release Holds - Release holds when litigation concludes
Common use cases
- Preserving evidence for ongoing litigation
- Implementing litigation hold notices
- Preventing deletion of potentially relevant data
- Responding to legal preservation requirements
Best practices
- Apply holds immediately upon litigation trigger event
- Use query-based holds to limit over-preservation
- Document hold rationale and scope decisions
- Monitor hold errors and resolve promptly
- Issue formal hold notifications to custodians
- Never release holds without legal approval
- Maintain hold audit trail for defensibility
Security considerations
- Premature hold release can result in spoliation sanctions
- Overly broad holds increase storage costs and eDiscovery burden
- Hold activities are logged and may be reviewed in litigation
- Ensure holds are defensible and well-documented
- Coordinate with legal counsel before any hold modifications
Common questions
When should I assign the Hold role?
Assign Hold when you need to: Preserving evidence for ongoing litigation; Implementing litigation hold notices; Preventing deletion of potentially relevant data; and Responding to legal preservation requirements. It is part of Microsoft Purview and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Hold role do?
The Hold role grants permissions including: Case Holds - Create and manage case holds; Location Holds - Place holds on mailboxes, SharePoint sites, and Teams; Query-Based Holds - Configure query-based holds for specific content; Hold Status - Monitor hold status and errors; and Release Holds - Release holds when litigation concludes. See the Permissions section above for the full list.
What are the security risks of the Hold role?
Key considerations when assigning Hold: Premature hold release can result in spoliation sanctions; Overly broad holds increase storage costs and eDiscovery burden; Hold activities are logged and may be reviewed in litigation; and Ensure holds are defensible and well-documented. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.