Skip to main content
All CollectionsIntegrationsMicrosoft 365
Microsoft 365 Preserve-In-Place Integration
Microsoft 365 Preserve-In-Place Integration

Preserve data with Legal Hold and Microsoft 365. Keep your corporate communications data safe & defensible.

Sophia Ho avatar
Written by Sophia Ho
Updated over a week ago

Introduction

Leverage Logikcull's legal hold capabilities with Enterprise integrations to preserve data during a legal hold. Preserve-In-Place features allow you to mitigate risk, prevent data loss, and maximize defensibility by preserving data from Microsoft 365 Exchange (Exchange mailboxes and OneDrive documents) directly from Logikcull. Note that exchange mailboxes also include Teams one-on-one, one-to-many, and private channel conversations.

Simply check the applicable boxes when creating a Legal Hold to preserve a custodian's Microsoft Office 365 data.


Pre-Requisites:

Permissions:

  • In Logikcull: Users must be able to create Legal Holds (Account Admin or Account Owner)

  • In Microsoft Purview: User must have eDiscovery Manager or eDiscovery Administrator permissions

Licenses:

  • Users (sender and preserved custodians) must have MSFT 365 E5 licenses

  • Users must have eDiscovery (Premium) MSFT license

Depending on your IT setup, User may need to be assigned to the Logikcull App

How to Use Microsoft Preserve-In-Place for Legal Holds

A. Set Up the Ms365 Preserve Integration:

Navigate to the User Profile page > Integrations > click Connect to Ms365 Preserve

A sign-in modal will appear in a new window. Enter your Microsoft credentials:

Once connected, you should see a banner displayed with the message: "Successfully authenticated Ms365 Preserve" and the Integration card should show a "Connected" icon:

  1. Check the box option to Preserve Data.

  2. Create/modify your Hold Message.

  3. Preserve Data, toggle the Microsoft 365 button to activate Preservation, and select the services you wish to preserve.

    πŸ’‘Tip: Exchange Mailboxes include one-on-one, one-to-many, and private channel Teams conversations.

  4. Add Custodians. Select from the populated list of custodians which individual Microsoft Exchange inboxes to Preserve along with the Legal Hold notification.

  5. Review and Send your Legal Hold.

C. Release a Legal Hold

To release a Hold, hover cursor over three-dot-kebab on the Hold card. Select Release Hold.

Releasing a hold in Logikcull will automatically release the Custodians from the Hold in MS365. It will not Close the e-Discovery case. To close an e-Discovery case, you can follow the steps in Microsoft's published documentation here.

Common Errors

Why am I seeing "Unable to Load Cases" error message?

If you're seeing "Unable to Load Cases," it is likely due to a permissions issue in Microsoft Purview. User credentials used for the MS365 integration must have eDiscovery Administrator or eDiscovery Manager permissions in order to "View Cases" in Microsoft Purview.

Why is my preservation failing?

If you have received a notification that your preservation is failing, this is likely because there is an active Hold in Logikcull, but the corresponding Matter in MS365 is closed. You must update the existing matter in Microsoft to active.


Frequently Asked Questions

What happens on the Microsoft 365 side?

If you did not select an existing Purview case, Logikcull will create a new Purview case right from Logikcull.

Will Deleted Items be Preserved?

Yes, Logikcull's Microsoft Preserve in Place integration does preserve deleted items. However - Logikcull's Cloud Upload integration for MS365 Mail will not include Deleted Items that have been purged from the trash - even with an active Preservation.

If you are looking to ensure that all preserved data is pulled, you will need to export the preserved data directly from Purview prior to uploading into Logikcull as a File Upload.

What happens if there is a retention policy in place?

Preservation from Logikcull will override any retention policy in place for the selected Exchange Inbox(es). Once the preservation is activated in Logikcull, this will prevent files and/or messages from being automatically (or manually) deleted. If any content was deleted prior to Preservation being activated due to retention policy or manual deletion, that content will remain deleted.

Can I select to preserve both Microsoft and Google inboxes in the same legal hold?

You may preserve both Microsoft and Google inboxes in the same Legal Hold. Simply select both options during the creation of the legal hold.

How does the Microsoft integration work?

Logikcull leverages Microsoft Graph API.

What are the eDiscovery scopes required to use Microsoft Preserve-In-Place?

In order to use the Microsoft preservation integration, Logikcull requests the following eDiscovery scopes:

eDiscovery.Read.All

eDiscovery.ReadWrite.All

If your organization previously authorized the Microsoft 365 integration prior to the expanded eDiscovery scopes, you will be asked to re-authenticate to the Microsoft integration to utilize the Preserve-In-Place feature, using credentials with eDiscovery Manager/eDiscovery Administrator permissions.


Did this answer your question?