Introduction
Leverage Logikcull's legal hold capabilities with Enterprise integrations to preserve data during a legal hold. Preserve-In-Place features allow you to mitigate risk, prevent data loss, and maximize defensibility by preserving data from Microsoft 365 Exchange (Exchange mailboxes and OneDrive documents) directly from Logikcull. Note that exchange mailboxes also include Teams one-on-one, one-to-many, and private channel conversations.
Simply check the applicable boxes when creating a Legal Hold to preserve a custodian's Microsoft Office 365 data.
Pre-Requisites:Permissions:
Licenses:
Depending on your IT setup, User may need to be assigned to the Logikcull App |
How to Use Microsoft Preserve-In-Place for Legal Holds
A. Set Up the Ms365 Preserve Integration:
Navigate to the User Profile page > Integrations > click Connect to Ms365 Preserve
A sign-in modal will appear in a new window. Enter your Microsoft credentials:
Once connected, you should see a banner displayed with the message: "Successfully authenticated Ms365 Preserve" and the Integration card should show a "Connected" icon:
Check the box option to Preserve Data.
Create/modify your Hold Message.
Preserve Data, toggle the Microsoft 365 button to activate Preservation, and select the services you wish to preserve.
💡Tip: Exchange Mailboxes include one-on-one, one-to-many, and private channel Teams conversations.
Add Custodians. Select from the populated list of custodians which individual Microsoft Exchange inboxes to Preserve along with the Legal Hold notification.
Review and Send your Legal Hold.
C. Release a Legal Hold
To release a Hold, hover cursor over three-dot-kebab on the Hold card. Select Release Hold.
Releasing a hold in Logikcull will automatically release the Custodians from the Hold in MS365. It will not Close the e-Discovery case. To close an e-Discovery case, you can follow the steps in Microsoft's published documentation here.
Common Errors
Why am I seeing "Unable to Load Cases" error message?
If you're seeing "Unable to Load Cases," it is likely due to a permissions issue in Microsoft Purview. User credentials used for the MS365 integration must have eDiscovery Administrator or eDiscovery Manager permissions in order to "View Cases" in Microsoft Purview.
Why is my preservation failing?
If you have received a notification that your preservation is failing, this is likely because there is an active Hold in Logikcull, but the corresponding Matter in MS365 is closed. You must update the existing matter in Microsoft to active.
Frequently Asked Questions
What happens on the Microsoft 365 side?
If you did not select an existing Purview case, Logikcull will create a new Purview case right from Logikcull.
Will Deleted Items be Preserved?
Yes, Logikcull's Microsoft Preserve in Place integration does preserve deleted items. However - Logikcull's Cloud Upload integration for MS365 Mail will not include Deleted Items that have been purged from the trash - even with an active Preservation.
If you are looking to ensure that all preserved data is pulled, you will need to export the preserved data directly from Purview prior to uploading into Logikcull as a File Upload.
What happens if there is a retention policy in place?
Preservation from Logikcull will override any retention policy in place for the selected Exchange Inbox(es). Once the preservation is activated in Logikcull, this will prevent files and/or messages from being automatically (or manually) deleted. If any content was deleted prior to Preservation being activated due to retention policy or manual deletion, that content will remain deleted.
Can I select to preserve both Microsoft and Google inboxes in the same legal hold?
You may preserve both Microsoft and Google inboxes in the same Legal Hold. Simply select both options during the creation of the legal hold.
How does the Microsoft integration work?
Logikcull leverages Microsoft Graph API.
What are the eDiscovery scopes required to use Microsoft Preserve-In-Place?
In order to use the Microsoft preservation integration, Logikcull requests the following eDiscovery scopes:
eDiscovery.Read.All
eDiscovery.ReadWrite.All
If your organization previously authorized the Microsoft 365 integration prior to the expanded eDiscovery scopes, you will be asked to re-authenticate to the Microsoft integration to utilize the Preserve-In-Place feature, using credentials with eDiscovery Manager/eDiscovery Administrator permissions.