Question

A multinational financial services firm is facing anticipated litigation. Legal counsel requires that all Exchange Online mailboxes, OneDrive accounts, and Teams chats belonging to 12 named custodians be preserved in an unalterable state before any communication is sent to the custodians, and that the preservation survives any user-initiated or retention-policy-driven deletion. The security architect must design a Microsoft Purview solution that meets these legal requirements while allowing targeted collection and review of relevant content. Which approach should the architect recommend?

Accepted Answer

Create an eDiscovery (Premium) case, add the 12 custodians, place them on legal hold, and use collections with review sets for targeted culling and review.

Answer

Apply a Purview retention policy set to 'retain-only' scoped to the 12 custodians, then use Content Search to export their data.

Answer

Enable Litigation Hold on each custodian's mailbox in Exchange and rely on Purview Audit logs to reconstruct deleted OneDrive and Teams content.

Answer

Configure a Purview DLP policy to block deletion of content by the 12 custodians and export matching items through Activity Explorer.