Office 365 Email Encryption: Benefits and Best Practices

Key Points

What you'll learn in this article

Office 365 Litigation Hold preserves mailbox content for legal and eDiscovery needs, including deleted and modified items.
Native Office 365 Litigation Hold can be limited for organizations with complex legal hold, records management, and non-IT user workflows.
Litigation hold planning should account for modern collaboration data, not just email, because legal matters may involve messages, files, edits, reactions, and threads across multiple platforms.
eDiscovery speed matters because legal teams need to search, review, export, and produce relevant communications quickly and defensibly.
Mimecast helps streamline litigation hold with cloud archiving, real-time preservation, fast search, eDiscovery tools, collaboration capture, audit trails, and governance capabilities.

What is Litigation Hold in Office 365?

A Litigation Hold in Office 365 preserves all mailbox content, including deleted, original, and modified versions of items for the purpose of eDiscovery for legal purposes.

Deleted and modified content is safeguarded for a specific period until the Litigation Hold is removed.

Common Office 365 Litigation Hold challenges

Office 365 Litigation Hold may only support organizations with rudimentary legal hold requirements.

If your organization routinely handles a large volume of sensitive information, Litigation Hold with Office 365 may present the following shortcomings:

Limited integration with basic record management policies.
Non-IT users cannot implement holds on their own. They require IT assistance.
Mailboxes with holds must be managed by an IT professional using a command-line interface or Exchange Administration Center.
Processing delays can create legal risk. Microsoft Purview litigation holds may take up to 24 hours to take effect, while Mimecast applies holds in real time.
Coverage beyond Microsoft 365 can add complexity. Non-M365 platforms may require connectors that delay processing or reduce message context.
Generic AI classification can increase review noise. Irrelevant results can slow legal teams and make it harder to find communications that matter.

Why is Office 365 Legal Hold essential for business?

Office 365 Litigation Hold is essential for businesses to protect themselves in the event of a lawsuit. Since most business and communication is done online these days, organizations must take care to remain compliant with various regulatory bodies.

Litigation Hold enables organizations to retain copies of electronically stored information even if the user has deleted the information.

It is an important compliance measure for organizations to enact to protect sensitive information. For teams comparing retention options, Microsoft Community discussions can be useful for understanding common admin questions, but legal hold decisions should still be guided by formal compliance requirements and legal counsel.

How to set up Litigation Hold in Microsoft 365?

To enact a Litigation Hold:

Go to the Microsoft 365 admin center and select User
Click on Active users.
Select the user that you want to place on Litigation hold.
On the properties menu, select the Mail tab.
Under More actions, click Manage litigation hold.
Click the Turn on litigation checkbox and enter optional details.
Click Save changes to create the hold.

Best practices for Office 365 litigation hold

Litigation Holds can only preserve information that has been deleted after it has been enacted, therefore it is recommended that organizations place Litigation Holds on all end-user inboxes as a prophylactic compliance measure.

If an inbox does not have a litigation hold in place when the end-user deletes information, the deleted documentation cannot be recovered.

An admin can set Litigation Holds on mailboxes as soon as an employee is hired and keep them enacted for a set amount of time desired by the organization.

Office365 enables Litigation Holds of up to one year (365 days).

Organizations should also consider whether litigation hold requirements extend beyond email. Modern legal matters often involve messages, edits, reactions, files, and conversation threads across collaboration platforms, so preservation policies should cover all relevant communication channels, not only mailboxes.

Related controls such as Office 365 email encryption can help protect sensitive communications, but they do not replace the need to preserve records for legal and compliance review.

Mimecast’s strength in archiving and governance supports better litigation holds with less work from IT teams.

See Why Gartner® Named Mimecast a Leader in Digital Communications Governance →

Streamlining Litigation Hold in Office 365

For legal and IT teams tasked with managing litigation hold in Office 365, the tools built into the Microsoft platform may not be robust enough to satisfy email management requirements in every company.

Email is often used as evidence in litigation today. As the dominant form of business communication, email messages may be used to document knowledge, motivation, intent and timing of actions. Consequently, there is a growing body of regulations governing email retention and the ability to produce messages and metadata for evidentiary use.

The challenge for businesses is to streamline management of litigation hold for Office 365 in order to reduce costs and minimize the burden on legal and IT teams. For many organizations, native Office 365 legal hold may not deliver the flexibility, centralized control and time-saving capabilities needed to accelerate e-discovery and simplify litigation hold in Office 365. That's where Mimecast can help.

Speed matters in litigation. In real-world enterprise side-by-side testing, Mimecast completed eDiscovery tasks 6.7x faster than Microsoft Purview, with search, results, and export completed in approximately 1 hour 12 minutes compared to 8 hours for Microsoft. That difference helps legal teams respond to litigation demands faster and with greater confidence.

Manage Litigation Hold for Office 365 with Mimecast

Mimecast's governance and compliance platform provides powerful tools for streamlining Litigation Hold in Office 365. As a cloud-based solution, Mimecast deploys in hours through native API integrations, not the weeks-long cycles Microsoft may require for full Purview configuration. This allows legal and IT teams to establish holds and begin preserving data immediately, without middleware servers or complex PowerShell configuration.

To ensure Office 365 security compliance, SEC 17a 4 compliance and compliance with other regulations, Mimecast retains three encrypted and tamper-proof copies of every email, storing them in geographically diverse data centers. Because Litigation Hold in Office 365 often requires access not only to emails but to proof of delivery and non-repudiation information, message encryption status, encryption keys context, and metadata as well, Mimecast captures all metadata in addition to email content. Administrators can use fast search and Office 365 eDiscovery tools to accelerate the task of producing relevant information, whether the source is microsoft email, a new email, archived mailbox content, or communications accessed through the Outlook client or another email client. Mimecast's purpose-built AI models, trained specifically on enterprise communication patterns, analyze sentiment, language, and content to surface the most relevant messages during eDiscovery review. This reduces the false positive fatigue generated by generic AI classification, allowing legal teams to focus on genuinely relevant data instead of sifting through thousands of irrelevant results.

Modern litigation hold must also extend beyond email. Mimecast captures and preserves communications from Microsoft Teams, Slack, Zoom, and other collaboration platforms in real time through native API integrations, maintaining full message context, conversation threading, edit histories, and metadata in native formats. This gives legal teams a complete, defensible record of relevant communications, regardless of where those conversations occurred.

Mimecast advantages for Litigation Hold in Office 365

With Mimecast tools for managing litigation hold in Office 365, you can:

Provide legal and IT teams with easy-to-use tools to simplify e-discovery, legal hold and compliance.
Enable rapid decision-making early in the case assessment process.
Provide proof of delivery and non-repudiation metadata.
Preserve secure email records, including encrypted email, message encryption metadata, and associated digital certificate details when available.
Simultaneously apply and manage multiple, granular litigation holds.
Produce audit trails for all e-discovery activity.
Simplify search with a single online repository of both live and archived email.
Complete eDiscovery tasks faster, with testing showing Mimecast search, results and export completed 6.7x faster than Microsoft Purview.
Preserve forensic context, including deleted messages, edit histories and full conversation threads across captured platforms.
Use predictable, transparent pricing regardless of data volume or platform.
Leverage agentic AI to ask natural language questions of archived data during eDiscovery.

In addition to streamlining Litigation Hold in Office 365, Mimecast enables litigation readiness in other platforms and serves as a FINRA and HIPAA compliant email service.

Learn more about Mimecast tools for Litigation Hold for Office 365, and about Mimecast's government IT solutions.

What is a Litigation Hold notice?

A Litigation Hold Notice is a letter sent by an organization's legal department to employees in the event of new or pending litigation involving the company.

This notice advises employees to keep, and not destroy or delete, any physical or electronically stored information (ESI) that may be pertinent to the legal case. This is done to preserve information that will streamline a legal team's discovery process.

How do I check if my mailbox is on Litigation Hold?

End-users are not aware if their inbox is on Litigation Hold as it runs seamlessly in the background without interrupting the user’s daily activities.

If you are an admin that has the authority to place email inboxes on Litigation Hold, and you want to verify that the hold is in place and active you:

Go to the Exchange admin center and go to Recipients.
Select Mailboxes, and in the list of user mailboxes, choose the one you want to verify has a hold, and then click Edit.
On the mailbox properties page, click Mailbox features.
Under Litigation hold, confirm that hold is enabled.
Click View details to verify when the mailbox was placed on Litigation Hold and by whom.

What is the difference between Litigation Hold and InPlace Hold?

There are two different types of holds available on the Exchange Server, one that places all items in a mailbox on hold, and one that places only specific items in a mailbox on hold.

To place an entire inbox on hold, an admin would enact a Litigation Hold using the LitigationHoldEnabled property of a mailbox. As the entire contents of a mailbox are being preserved, only one Litigation Hold can be placed on an inbox at a time.

To place a hold on only items that match particular criteria, an admin would enact an InPlace Hold. Multiple InPlace Holds can be put on a mailbox at one time.

Why Litigation Hold is not an alternative to backup?

Litigation Hold is not an alternative to a backup because it only pertains to items located within an end-users inbox, and must also be enabled prior to items being deleted in order for recovery to be successful.

Litigation Hold is helpful for purposes of eDiscovery and is a critical aspect of compliance maintenance but is not meant to replace broader record-keeping, backup, email encryption, or security controls. For example, an organization may use a mail flow rule to route, label, or encrypt email, but that rule does not provide the same preservation function as a defensible legal hold.

It also does not address every preservation requirement across collaboration platforms, third-party communications, or full forensic context. Similarly, the ability to encrypt emails supports secure communication, but encryption alone does not provide complete retention, recovery, eDiscovery, or governance coverage. Organizations with broader legal, compliance, and governance needs should evaluate whether native Office 365 Litigation Hold is enough to preserve all relevant communications in a defensible way.