In-place legal holds can be placed in Purview eDiscovery (Standard E3 licence or Premium E5 license) using the normal Purview search scope criteria. These holds are actually preservation retention policies that control how targeted items act when changed or deleted. If effect, they save preservation copies in a hidden Recoverable Items folder within the mailbox or SharePoint/OneDrive container. These folders are indexed for retrieval by Content Search or Purview eDiscovery. In-place holds are effectively invisible to your custodians. Based on testing to date the content and most metadata of altered/deleted items is preserved for retrieval. However, the preservation copies do lose the context of where they came from, when they were altered/deleted and by whom (since mailboxes/containers can have multiple users with access).
Status and scope detail for a single legal hold
Purview eDiscovery Standard users can only view legal hold status and scope within cases by manual navigation (see below). There is no dashboard or reports covering active holds. Once upon a time legal holds included estimate result volume (GB) and item counts. These metrics are critical for QC of hold success, scope criteria as error reporting in Purview is limited (when available). To get these metrics users must create a Search (Collection in eDiscovery Premium) and view the details. These searches are dynamic and so the ‘estimated results’ may vary if rechecked on active targets. Corporate legal departments have been using these standard legal holds for years, whether directly or through an eDiscovery legal hold integration partner. Customers with even minimal legal exposure and holds generally must manage/track holds in SharePoint or other collaborative workflow solutions.
The cross case legal hold report was introduced for eDiscovery Premium in the recent new Microsoft Purview portal update (2024). The report (below) is broken down by individual target location, so you may see multiple lines for a single Hold if it’s scope covered multiple targets. The Policy status seems to be tied to initial application of policy to location rather than any kind of granular or active monitoring of the target holds. The report can be filtered and downloaded. I will post the PowerShell to pull this information when I can find and confirm it. There are no metrics in this report and like the majority of Microsoft 365 the metric/event information is dynamic rather than tracked in a historical database. Clicking on a hold just navigates to the Case/Hold pane (second image below), but the detail does not give metrics or even scope detail such as Query syntax. You have to Edit the hold to reopen the wizard and walk through the steps to check or validate your criteria.
