The three holds
| Hold | Scope | Set where |
|---|---|---|
| Litigation hold | Whole mailbox, on/off, optional duration | Mailbox property (Set-Mailbox -LitigationHoldEnabled) |
| Purview retention (retain) | Policy-scoped, granular | The modern layer (retention concept) |
| eDiscovery hold | Case-scoped, query-able | Purview eDiscovery cases |
All share the mechanic: deleted/edited items are preserved in Recoverable Items (the hidden dumpster) beyond the user's reach — the mailbox keeps everything the hold covers regardless of user deletes, MRM tags, or Purview delete-policies (holds win, always). The dumpster has its own quota; a mailbox on hold with heavy churn can fill Recoverable Items and start FAILING deletes — the obscure-but-real 'my Deleted Items won't empty' on a held mailbox.
The inactive mailbox lifecycle
Remove the licence/user from a HELD mailbox and it doesn't delete — it becomes inactive: no licence, no sign-in, invisible in normal lists, but fully preserved and eDiscovery-searchable for as long as ANY hold covers it. The mechanics that matter:
- Creation is order-dependent (mailbox-species concept): hold MUST exist before the account goes, or you get a normal 30-day soft-delete and then nothing. The leaver runbook's critical step.
- Recovery vs restore: recover = new mailbox inheriting the content (a returning employee); restore = merge content into another mailbox (a manager absorbing a leaver's mail). Different cmdlets, different outcomes — pick deliberately.
- The end: remove all holds and the inactive mailbox becomes soft-deleted (then gone) — releasing holds is a point-of-no-return, gated by legal sign-off.
What to watch (proofs)
- The held population: mailboxes with any hold (Get-Mailbox | fl LitigationHold, Hold, Retention) — the 'nothing leaves here' census, reconciled to legal's matter list.
- Inactive inventory: Get-Mailbox -InactiveMailboxOnly — each row a leaver + a hold rationale (species concept); the release queue is legal's, not IT's.
- Dumpster pressure: Recoverable Items size on high-churn held mailboxes — the failing-deletes pre-incident.
- Order-of-operations proof: the leaver runbook showing hold-before-offboard, with one audited example — the difference between 'preserved' and 'gone on day 31'.