Litigation Hold vs Retention Policy in Microsoft 365

Litigation hold and a Microsoft Purview retention policy both preserve email on the Exchange server, both are set by an administrator, and both operate silently — no visible tag on the message, no notification in Outlook, no reminder in the reader's day. That is where the similarity ends. A litigation hold is a legal-preservation control that freezes an entire mailbox against deletion or modification, usually indefinitely. A retention policy is a lifecycle control that keeps mail for a defined period and, in most configurations, deletes it on schedule.

This post is an explainer, not legal advice. It covers what each mechanism actually does, how the Recoverable Items quota changes when a mailbox goes on hold — the detail that most often ambushes admins after the fact — and who inside your organization should be signing off on the decision. If you are choosing between the two under an active preservation letter, talk to your counsel; nothing on this page is a substitute for that conversation.

The verdict up front#

Use a litigation hold when a legal matter has been notified or is reasonably anticipated and every message in the target mailbox must be preserved intact — regardless of what the user does, what a retention policy would otherwise remove, or how long the matter lasts. A hold is broad, blunt, and defensible.

Use a Microsoft Purview retention policy when the goal is records management — keep mail for the period a regulator or your own policy requires, then delete on schedule. Policies are granular, reviewable, and designed to run continuously across the organization rather than to respond to a single event.

The two can and often should coexist on the same mailbox. When they collide, the hold wins: any active hold (litigation, eDiscovery, or in-place) prevents the deletion that a retention policy would otherwise perform. Most real Microsoft 365 deployments run a Purview retention policy across every mailbox for governance, and layer a litigation or eDiscovery hold on the specific mailboxes involved in an active matter.

The mistake is picking one because it appears to do what you want, without understanding the other well enough to see that it does something different.

Litigation hold vs retention policy: at a glance#

Both mechanisms live in Microsoft 365, both use the same hidden Recoverable Items folder to store preserved copies, and both are invisible to the user by design. On every other dimension they behave differently.

Where litigation hold wins#

Legal defensibility is the whole point. When outside counsel serves a preservation letter, the organization has a duty to prevent spoliation — accidental or deliberate destruction of relevant evidence — and courts expect a demonstrable control, not a good-faith attempt. A litigation hold, enabled through `Set-Mailbox -LitigationHoldEnabled $true` in Exchange Online PowerShell, satisfies that expectation from the moment it is applied.

The scope is total. Inbox, Sent Items, Deleted Items, Calendar, Contacts, Notes, personal folders, drafts, and messages received during the hold — every item in every folder is preserved. Nothing has to be selected in advance, which is what makes a hold defensible: an attorney does not have to prove which messages were relevant at the moment of preservation. They were all preserved.

Preservation runs deep. If a user deletes a message, empties Deleted Items, and empties Recoverable Items, the copy still exists in a hidden `Purges` subfolder of Recoverable Items — invisible to the user, discoverable through eDiscovery search. If a user edits a message that supports editing (a draft, a note), the original version is preserved in `Versions`. The hold applies to items the user cannot see and to actions the user tried to conceal.

The controls are simple to operate. Enabling a hold is a single-parameter change. Releasing it is another single-parameter change (though releasing is a decision with legal weight, and most organizations require sign-off from counsel). Optional fields let compliance record the hold owner, a case reference, and a notification shown to the user in Outlook explaining that the mailbox is subject to hold.

If your organization has any real exposure to litigation, regulatory investigation, or subpoena, a litigation hold is the correct tool for the affected mailboxes. A retention policy will not do the job — retention is designed to allow deletion on schedule; a hold is designed to prevent it.

Where a Microsoft Purview retention policy wins#

Lifecycle governance is the whole point. If an organization keeps every email forever, storage cost is one problem and privacy exposure is another. Regulations such as GDPR treat unnecessary retention as its own risk, and organizations with defined records schedules — financial, medical, government — face requirements to delete after a defined period, not just to keep.

A Microsoft Purview retention policy handles that. Configure a policy to retain mail for seven years and then delete, or to delete after 30 days without retaining, or to retain forever without deleting — the same policy engine covers all three shapes. Scope is flexible: a policy applies to a set of mailboxes, distribution groups, or the whole tenant, and Purview retention labels let users or auto-classification rules tag individual items with a retention profile that differs from the surrounding policy.

Coverage extends beyond Exchange. A single Purview policy can cover mail, SharePoint sites, OneDrive accounts, Teams chats and channel messages, and Yammer. That is the piece a litigation hold does not do — a hold is Exchange-specific, and preserving Teams or SharePoint content requires either a Purview hold or an eDiscovery hold configured against those workloads.

For records-management scenarios — the periodic housekeeping that is not a legal matter — retention policies are the right tool. They are what an information-governance function configures once and reviews annually. A litigation hold, misapplied here, would preserve everything indefinitely and prevent the deletion the policy exists to perform.

One wrinkle worth knowing: a Purview retention policy in retain-and-delete mode uses the same hidden Recoverable Items subfolders (particularly `SubstrateHolds`) to preserve copies during the retention window, even when the user has deleted the visible copy. This is by design — it is what makes the retention half of the policy enforceable — and it is why the Recoverable Items folder can grow unexpectedly on mailboxes with active retention policies, even without a formal litigation hold in place.

The Recoverable Items quota jump admins miss#

This is the detail that ambushes admins after the fact, and it is the reason the two mechanisms are worth understanding together rather than in isolation.

By default, Exchange Online allocates 30 GB to a mailbox's Recoverable Items folder — the hidden subtree that holds deleted items, purged items, versioning copies, and preserved copies from policies. In normal operation, users never see the folder in Outlook and it rarely fills.

When a mailbox is placed on litigation hold — or when a Purview retention policy applies to it, or when an in-place hold is enabled — Exchange Online automatically raises the Recoverable Items quota from 30 GB to 100 GB (with a soft warning threshold at 90 GB). That expansion is not something the admin has to configure; it happens because the hold is going to accumulate copies of every deleted or modified item, and the smaller quota would fill within weeks on an active mailbox.

Releasing a hold does not shrink the mailbox back#

Removing a litigation hold does not automatically shrink the Recoverable Items quota back to 30 GB — the mailbox stays at 100 GB after release. It also does not delete preserved copies immediately; they age out through the normal Recoverable Items retention (14 days by default in Exchange Online, configurable up to 30) once the hold is released and no other hold applies.

This has budgeting implications that show up months later. A tenant with hundreds of mailboxes on long-running holds carries the storage even after the matters resolve, and reclaiming it requires releasing every hold that touches each mailbox — not just the most recent one — and then waiting out the recovery window. Compliance teams that enable hold as a routine hedge should model the storage cost against the compliance benefit before making it standard practice.

Licensing and pricing (verify on the vendor page)#

Microsoft's licensing for retention and hold features has changed several times. The current entitlement is only reliable on Microsoft's own licensing pages — treat what follows as the shape to expect, not a quote.

• Litigation hold requires Exchange Online Plan 2, which is included in Microsoft 365 E3, E5, A3, A5, G3, G5, and Business Premium, and available as a standalone add-on for Exchange Online Plan 1 mailboxes.
• Microsoft Purview retention policies for Exchange are included in the same set of Microsoft 365 enterprise SKUs. Retention labels and advanced auto-classification require higher tiers (E5 or the standalone information-protection add-on).
• eDiscovery holds inside eDiscovery cases are available in both eDiscovery Standard (bundled with E3-tier plans) and eDiscovery Premium (E5 or add-on), with different query, review, and processing capabilities.
• Both mechanisms consume mailbox storage as they accumulate preserved copies. The storage is included in the licensed mailbox quota until the mailbox needs archive expansion, at which point Auto-Expanding Archiving is the supported path.

Who each mechanism is genuinely for#

A litigation hold is the correct control for a compliance or legal team responding to a specific matter — anticipated litigation, an internal investigation, a regulator's request, a subpoena. It is designed for that job. It is not designed for routine records management, and it is not meant to be left on every mailbox indefinitely as a hedge against unknown future events, though many organizations do exactly that and accept the storage cost as the tradeoff.

A Microsoft Purview retention policy is the correct control for an information-governance function running a records schedule across the organization. It answers the question `how long do we keep mail for role X, and when does it get deleted.` It is meant to be routine, reviewable, and applied at scale.

An eDiscovery hold — a per-case hold configured through an eDiscovery case in Microsoft Purview — sits between the two. It is a scoped preservation for a specific matter, with a query defining which items and locations are preserved, rather than the mailbox-wide freeze of a litigation hold. Larger organizations use it as the day-to-day mechanism during active matters, reserving litigation hold for cases where the full mailbox has to be locked.

If you are configuring any of these for the first time, that decision belongs with your legal or compliance function, not with IT alone. A misconfigured hold or retention policy is a compliance issue in a way that a misconfigured spam filter is not.

A third option, honestly — where AI Emaily fits#

Neither of these mechanisms is what most users interact with directly. Both operate on the Exchange server, silently, and neither changes what a modern email client is trying to do for the person actually using the mailbox — triage the queue, draft the replies, close the loops. AI Emaily is an AI-native email client that connects to a Microsoft 365 mailbox through the same OAuth surface Outlook does, which means every server-side retention policy and every litigation hold applying to that mailbox continues to apply exactly as it did before. Nothing about the compliance posture of the mailbox changes because you added a client on top.

What AI Emaily adds is a distinct transparency layer that runs alongside the server-side preservation: an audit trail of every action the agent takes on your behalf, Copilot approval required before any send, and one-tap undo on triage moves. That is orthogonal to holds and retention — the server preserves what compliance requires; the client shows you what the agent did on the same timeline.

The concession is important: AI Emaily is not an eDiscovery platform, does not replace either mechanism discussed here, and should not be treated as a substitute for either. If your job is to preserve email for legal defensibility, use a litigation or eDiscovery hold. If your job is to run a records schedule, use Microsoft Purview. If your job is to help the person reading the mail get through the day without the AI making anything unauditable, that is the one we build for. Pricing is at /pricing and a 7-day free trial is on the homepage at /. We build AI Emaily.