What is a legal hold?
Legal holds preserve content in Microsoft 365, preventing users from permanently disposing of data that might be relevant to an investigation. From a users point of view, they can still delete messages, but those messages are still searchable and retrievable via eDiscovery.
Legal hold has recently launched for private channels in Microsoft Teams. Now I haven’t used private channels at all in our organization because we’re an open book, but I’m gonna try out private channels and see how this legal hold feature works. So let’s get started, make a little private channel in our team called secret chats and I’m going to make it private. Next, and I’ll add Blair. Alright, done, secret chats between me and Blair. Let’s have some secret chats. This is a place for secret chats. Keep it secret, keep it safe. Ok so we’ve got our little secret chat and they were gonna place this under legal hold and the place where we do legal holds is under the advanced eDiscovery or the eDiscovery section in the Security and Compliance Center. So we’ve logged in into the Security and Compliance center here, we’re going to go down to eDiscovery. we’re making an advanced eDiscovery case. We will make a new case: secret chats have gone too far. Let’s go to the home page use the default settings, ok, and then we’ll click on Holds, ok. So essentially what So we’ll create a case or create a hold, secret chat hold. So when I first did this it didn’t work because I was looking for the channel messages that were stored in the team’s group mailbox but private messages in private channels are actually stored in each user’s own mailbox so instead of putting the legal hold on the actual group mailbox we have to put the legal hold on the actual user mailboxes. In this example we’re just going to do the channel messages but it’s a different process for messages and files for private channels. So to perform an eDiscovery search of content in a private channel you have to search across the team, the site collection associated with the private channel, if you want to get the team’s files that were sent because when you make a private channel it also makes an additional site collection to store those files, and the mailboxes of private channel members to include messages. So in order to figure out who those users are in the private channel there’s a couple of ways that we can do that. So we can do it by the Teams Admin Center. So at portal.office.com we can go to admin here and we can go to show all and we’ll scroll down to Teams and then manage teams and then we will find the team and we’ll go to channels here and we’ll go to channels and we will find the secret chats channel and we’ll see the members. So it should display who those members are myself and Blair. Now the other way you’re supposed to be able to get teams channel members is via PowerShell, now I just tested these but the version of the module that I had, even though I just installed it, doesn’t have the -membershiptype private parameter and there was no Get-TeamChannelUser available for me so I won’t demonstrate that because it didn’t work for me. So now that we’ve got those team’s channel members, we’re going to apply a legal hold to those users which is myself Blair. So now I’ve added myself and Blair to the secret chat hold and we’ll save. So we’ve now selected the users that are members of the private channel for the locations that we’re going to put the hold on, and we’ll choose a query which is going to be secret chats, save, so we’re going to be putting a hold on all content that matches that query which is secret chats. So now that we’re under hold we’ll switch back to the secret chats private channel and I’ve posted a message that says they’re on to us we want to delete all secret chats, and we will delete these messages, but even though we’ve deleted them we should still be able to search them in eDiscovery. Then we’ll switch back and we’ll run a search and we’ll do a new search for that content. Secret chat search, we won’t do any custodians, we will do the users that are in the private channel. Which is myself and Blair. We’ve now chosen myself and Blair for the search, next. Search criteria, we’re going to look for the key word of secret chats and next. And we’ll run that search. The search is completed and we can see that it’s found 10 items. Now this could include actual mailbox content for these users, but we’re really just interested in the the team’s channel messages. So I’m going to add the results to the review set. I’ll make a new, actually let’s do a conversational review set. Secret chat conversations Close, review sets, secret chat conversations. So our review set is now available, let’s have a look whether we can see our secret chats, and we can see that those messages are there even though they’ve been deleted in the channel. So that’s how you apply a legal hold to a team’s channels private messages, and that feature has been marked as launched
