Question

During an incident in Microsoft Defender XDR, you confirm that a phishing email delivered to 40 mailboxes is malicious. However, three of the recipient mailboxes are subject to an active eDiscovery legal hold for unrelated litigation. You need to remove the malicious email from all 40 mailboxes using Threat Explorer's remediation action while ensuring you do not violate preservation obligations for the mailboxes under hold. What should you do?

Accepted Answer

Use Threat Explorer to soft delete the email from all 40 mailboxes, because soft delete moves the message to the Recoverable Items folder where it remains preserved by the legal hold.

Answer

Use Threat Explorer to hard delete the email from all 40 mailboxes, since hard delete is the only supported remediation action for confirmed malicious mail.

Answer

Skip remediation entirely for all 40 mailboxes until the legal hold is released, to avoid any risk of altering preserved content.

Answer

Manually purge the email from the three held mailboxes with a Content Search purge action, then soft delete from the remaining 37 in Threat Explorer.