eDiscovery Hold Release & Post-Hold Cleanup

When eDiscovery holds, litigation holds, or retention policies are released, administrators must understand the cleanup process to properly manage user expectations and ensure complete remediation.

TL;DR

Exchange mailboxes — After hold release, a 30-day delay hold is automatically applied. Content in Recoverable Items remains until Managed Folder Assistant (MFA) processes the mailbox (runs ~weekly). Total cleanup: 7-37 days.
SharePoint/OneDrive — Preservation Hold Library content is retained for 30 days after policy release, then cleaned by a timer job every 7 days. Total cleanup: up to 37 days.
Teams — Content stored in Exchange (SubstrateHolds folder) and SharePoint follows the respective cleanup timelines for each workload.
User experience — Desktop Outlook indexes Recoverable Items, so users will see "Discovery" results in searches until cleanup completes. This is expected behavior.

Audience: IT Administrators, Compliance Officers, Security Engineers

Assumed knowledge: Basic M365 administration, PowerShell, eDiscovery Guide

Scope: Post-hold cleanup procedures for Exchange, SharePoint, OneDrive, and Teams

Where Preserved Content Lives

Workload	Preservation Location	User Visibility
Exchange Online	Recoverable Items folder (DiscoveryHolds, SubstrateHolds, Purges, Versions, Deletions)	Hidden from navigation, but indexed and searchable in Outlook
SharePoint Online	Preservation Hold Library	Hidden; only Site Collection Admins can access
OneDrive for Business	Preservation Hold Library	Hidden; only Site Collection Admins can access
Teams messages	SubstrateHolds subfolder in user's Exchange Recoverable Items	Hidden from users
Teams files	SharePoint Preservation Hold Library (Team site)	Hidden system library

Recoverable Items Subfolders

Deletions — Soft-deleted items (user deleted from Deleted Items)
DiscoveryHolds — Items preserved by eDiscovery holds or retention policies
SubstrateHolds — Teams chat and cloud app items preserved by retention
Purges — Hard-deleted items (when single item recovery is enabled)
Versions — Original copies of modified items (copy-on-write)

Key Timing Reference

Process	Duration	Notes
Delay Hold (Exchange)	30 days after hold release	Automatically applied; prevents accidental data loss
Managed Folder Assistant	Runs every ~7 days	Processes retention and cleanup for each mailbox
SharePoint Grace Period	30 days after hold release	Content retained; timer job suspended
SharePoint Timer Job	Runs every 7 days	Only processes content older than grace period
Maximum Cleanup Time	Up to 37 days	Worst case for both Exchange and SharePoint

Understanding Hold Types

Before releasing any hold, identify all holds on a location. A mailbox or site may have multiple holds—removing one doesn't release content if others remain.

Litigation Hold vs. eDiscovery Hold: Key Differences

These two hold types are often confused but serve different purposes and have distinct behaviors:

Aspect	Litigation Hold	eDiscovery Hold
Purpose	Preserve entire mailbox for anticipated or active litigation	Preserve specific content for a defined legal case or investigation
Scope	Mailbox-wide — preserves everything (sent, received, deleted) indefinitely or for a specified duration	Query-based — can preserve only content matching specific criteria (dates, keywords, custodians)
Applies To	Exchange mailboxes only	Exchange, SharePoint, OneDrive, and Teams
Management	Exchange Admin Center or PowerShell (`Set-Mailbox`)	Microsoft Purview Portal → eDiscovery cases
Granularity	All-or-nothing per mailbox	Can target specific locations, date ranges, or keywords
Case Association	Not tied to a case — standalone hold	Always associated with an eDiscovery case
Legal Hold Notice	Manual notification required	Premium: Automated legal hold notifications to custodians
Release Impact	Triggers 30-day delay hold on the mailbox	Triggers delay hold only if no other holds remain
Best For	Broad preservation when you need everything from specific users	Targeted preservation when you know what you're looking for

When to Use Which

Litigation Hold: Use when Legal says "preserve everything from these users" and you don't yet know what's relevant. Simple, broad, mailbox-only.
eDiscovery Hold: Use when you need cross-workload preservation (Teams, SharePoint), targeted content (specific date ranges or keywords), or Premium features like custodian management and automated notifications.
Both together: Common scenario—apply Litigation Hold immediately for broad protection, then create an eDiscovery case for the actual search and review workflow.

Hold Types Overview

Hold Type	Applies To	Management Location
Litigation Hold	Exchange mailboxes only	Exchange Admin Center or PowerShell
eDiscovery Hold	Exchange, SharePoint, OneDrive, Teams	Microsoft Purview Portal
Retention Policy	All workloads	Purview → Data Lifecycle Management
Retention Label	Individual items	Purview → Records Management

Identifying Holds on Mailboxes

PowerShell: Check Mailbox Hold Status
# Connect to Exchange Online
Connect-ExchangeOnline -UserPrincipalName admin@tamu.edu

# Get comprehensive hold information
Get-Mailbox -Identity "user@tamu.edu" | Format-List DisplayName,
  LitigationHoldEnabled,
  InPlaceHolds,
  ComplianceTagHoldApplied,
  DelayHoldApplied

Decoding InPlaceHolds GUIDs:

Prefix	Hold Type	How to Find Source
`UniH`	Retention Policy	`Get-RetentionCompliancePolicy` in Security & Compliance PowerShell
`mbx`	eDiscovery hold (query-based)	Search eDiscovery cases for GUID
`cld`	eDiscovery hold (entire mailbox)	Search eDiscovery cases for GUID

Identifying Holds on SharePoint/OneDrive

PowerShell: Check SharePoint Site Hold Status
Connect-SPOService -Url https://tamu-admin.sharepoint.com

Get-SPOSite -Identity "https://tamu.sharepoint.com/sites/sitename" | 
  Select-Object Url, LockState, ComplianceAttribute

Empty ComplianceAttribute = No hold applied
GUID string = One or more holds active

Releasing Holds

Release Litigation Hold (Exchange)

Remove Litigation Hold
Set-Mailbox -Identity "user@tamu.edu" -LitigationHoldEnabled $false

# Verify
Get-Mailbox -Identity "user@tamu.edu" | Format-List LitigationHoldEnabled

note

It may take up to 240 minutes (4 hours) for the Litigation Hold removal to fully propagate. Do not attempt to delete items from Recoverable Items until this period has elapsed.

Release eDiscovery Case Hold

Via Purview Portal:

Navigate to Microsoft Purview Portal → eDiscovery → Standard or Premium
Open the case → Hold tab
Edit or delete the hold policy

Via PowerShell:

Release eDiscovery Case Hold
Connect-IPPSSession -UserPrincipalName admin@tamu.edu

# Remove specific mailbox from hold
Set-CaseHoldPolicy -Identity "Hold Name" -RemoveExchangeLocation "user@tamu.edu"

# Or disable entire hold
Set-CaseHoldPolicy -Identity "Hold Name" -Enabled $false

Release Retention Policy Hold

Remove Location from Retention Policy
Connect-IPPSSession -UserPrincipalName admin@tamu.edu

# Remove specific location from policy
Set-RetentionCompliancePolicy -Identity "Policy Name" -RemoveExchangeLocation "user@tamu.edu"
Set-RetentionCompliancePolicy -Identity "Policy Name" -RemoveSharePointLocation "https://tamu.sharepoint.com/sites/sitename"

caution

Modifying retention policies affects all locations in the policy. Remove specific locations rather than deleting the entire policy unless authorized.

Preservation Lock

If a retention policy has Preservation Lock enabled, you cannot remove the mailbox from the policy, exclude it, or disable the Managed Folder Assistant. Contact Microsoft Support for assistance with locked policies.

Post-Release: Delay Holds (Exchange)

When any hold is removed from an Exchange mailbox, a delay hold is automatically applied for 30 days. This prevents accidental permanent deletion.

Check Delay Hold Status
# Check delay hold status
Get-Mailbox -Identity "user@tamu.edu" | Format-List DelayHoldApplied, DelayReleaseHoldApplied

DelayHoldApplied — Set to True when Litigation Hold, In-Place Hold, or eDiscovery hold is removed
DelayReleaseHoldApplied — Set to True when retention policy is removed

Option A: Wait for Natural Expiration (Recommended)

The delay hold expires automatically after 30 days. Safest approach.

Option B: Remove Immediately

warning

Only remove delay holds when absolutely certain the hold release is permanent and authorized. Once removed, MFA can immediately begin purging preserved content. Requires the Legal Hold role in Exchange Online.

Remove Delay Hold (Use with Caution)
Set-Mailbox -Identity "user@tamu.edu" -RemoveDelayHoldApplied

For mailboxes with DelayReleaseHoldApplied set to True (from retention policy release):

Remove Delay Release Hold
Set-Mailbox -Identity "user@tamu.edu" -RemoveDelayReleaseHoldApplied

Post-Release: Managed Folder Assistant (Exchange)

The Managed Folder Assistant (MFA) is the background process that enforces retention and cleans up expired content.

Runs automatically approximately every 7 days per mailbox (timer job)
Exchange location must have at least 10 MB of data before retention settings apply
Evaluates items against active retention policies and holds
Permanently deletes items no longer subject to any hold

Force MFA to Process a Mailbox

Start Managed Folder Assistant
Start-ManagedFolderAssistant -Identity "user@tamu.edu"

note

This queues the mailbox for processing but doesn't guarantee immediate execution. Large mailboxes may take hours.

Check MFA Status

Check MFA Processing Status
$diagLogs = Export-MailboxDiagnosticLogs -Identity "user@tamu.edu" -ExtendedProperties
$xml = [xml]($diagLogs.MailboxLog)
$xml.Properties.MailboxTable.Property | Where-Object {$_.Name -like "ELC*"} | Format-Table Name, Value

Key properties:

ELCLastSuccessTimestamp — When MFA last processed the mailbox
ELCLastRunDeletedFromDumpsterCount — Items deleted from Recoverable Items

Post-Release: SharePoint/OneDrive Timeline

SharePoint and OneDrive use a different cleanup mechanism:

Phase	Day	What Happens
Hold Released	0	Grace period begins
Grace Period	1-30	Content retained; timer job suspended
Timer Job Resumes	31+	Evaluates content for deletion
Content Deleted	31-37	Items removed by timer job

Accessing Preservation Hold Library

Direct URL:

Preservation Hold Library Paths
https://tamu.sharepoint.com/sites/sitename/PreservationHoldLibrary
https://tamu-my.sharepoint.com/personal/user_tamu_edu/PreservationHoldLibrary

Only Site Collection Administrators can access this library.

Check PHL Contents (PnP PowerShell)

Check Preservation Hold Library
Connect-PnPOnline -Url "https://tamu.sharepoint.com/sites/sitename" -Interactive

$phl = Get-PnPList -Identity "Preservation Hold Library" -ErrorAction SilentlyContinue
if ($phl) {
    Write-Host "PHL Item Count: $($phl.ItemCount)"
}

Manual Cleanup Procedures

When Manual Cleanup Is Needed

Recoverable Items folder approaching quota (prevents normal mailbox operations)
Business requirement for immediate cleanup
MFA hasn't cleared content after expected timeframe
Users continue seeing preserved content in searches

Exchange: Check Recoverable Items Size

Check Recoverable Items Folder Size
Get-MailboxFolderStatistics -Identity "user@tamu.edu" -FolderScope RecoverableItems | 
    Format-Table Name, ItemsInFolder, FolderSize -AutoSize

Quota limits:

Scenario	Warning	Hard Limit
No hold	20 GB	30 GB
Hold applied	90 GB	100 GB

Exchange: Compliance Search Purge

Modern, supported method. Limitation: Only processes 10 items per mailbox per execution.

Compliance Search Purge
Connect-IPPSSession -UserPrincipalName admin@tamu.edu

# Create search
New-ComplianceSearch -Name "Cleanup-User-RI" -ExchangeLocation "user@tamu.edu" -ContentMatchQuery "kind:email"

# Start search
Start-ComplianceSearch -Identity "Cleanup-User-RI"

# Wait for completion, then purge
New-ComplianceSearchAction -SearchName "Cleanup-User-RI" -Purge -PurgeType HardDelete

For large cleanups, loop the purge action multiple times.

Exchange: Search-Mailbox (Legacy but Faster)

Deprecation Notice

Microsoft has announced plans to deprecate Search-Mailbox. Still works but plan to transition to compliance search for long-term processes.

Requires: Mailbox Import Export role (not assigned by default)

Search-Mailbox Cleanup (Legacy)
# Delete all content from Recoverable Items
Search-Mailbox -Identity "user@tamu.edu" -SearchDumpsterOnly -DeleteContent -Force

SharePoint/OneDrive: Manual PHL Cleanup

Only possible after all holds are released and grace period passed.

Clean Preservation Hold Library
Connect-PnPOnline -Url "https://tamu.sharepoint.com/sites/sitename" -Interactive

$phlItems = Get-PnPListItem -List "Preservation Hold Library" -PageSize 500

foreach ($item in $phlItems) {
    Remove-PnPListItem -List "Preservation Hold Library" -Identity $item.Id -Force
}

After cleanup, empty the Recycle Bins:

Empty Recycle Bins
Clear-PnPRecycleBinItem -All -Force
Clear-PnPRecycleBinItem -All -SecondStageOnly -Force

Teams-Specific Considerations

Teams content spans multiple storage locations:

Content Type	Storage Location	Hold Mechanism
1:1/Group chats	Each participant's Exchange mailbox	Exchange hold on each user
Channel messages	Team's Group mailbox	Exchange hold on Group mailbox
Channel files	Team's SharePoint site	SharePoint hold
Chat files	Sender's OneDrive	OneDrive hold
Private channel messages	Member mailboxes + dedicated SharePoint	Both Exchange and SharePoint holds

Check Team's Group Mailbox

Check Teams Group Mailbox Hold Status
$group = Get-UnifiedGroup -Filter "DisplayName -eq 'Team Name'"
Get-Mailbox -GroupMailbox -Identity $group.PrimarySmtpAddress | Format-List DisplayName, InPlaceHolds, LitigationHoldEnabled

Release Requires Action on Multiple Fronts

Release from eDiscovery case — Remove both Exchange and SharePoint locations
Release litigation hold from Group mailbox (if applicable)
Handle delay holds on Group mailbox
Process MFA for Group mailbox and all team members
Clean SharePoint PHL for team site

Why Users See "Discovery" Items in Searches

This is the most common user confusion after holds are lifted:

Desktop Outlook indexes the entire mailbox, including hidden Recoverable Items folder
Even though folders are hidden from navigation, their contents appear in search results
Users see results labeled "Discovery" or "Recoverable Items"
This is expected behavior — indicates preservation worked correctly
Items disappear from search only after cleanup completes

What Users Report vs. Reality

User Report	Actual Cause	Resolution
"I see items in a Discovery folder"	Items in DiscoveryHolds appearing in search	Wait for MFA cleanup
"I deleted this email but it keeps coming back"	Item in Recoverable Items, not visible mailbox	MFA will process; user cannot affect this
"Search shows emails I never received"	Preserved copies of modified items	Normal behavior; clears after cleanup

Client Timeline for Search Index Updates

Client	Time to Reflect Cleanup	User Action
Outlook Web (OWA)	Immediate after MFA	Hard refresh browser
Outlook Windows	1-24 hours after MFA	Optional: Rebuild search index
Outlook Mac	1-24 hours after MFA	Optional: Reindex Spotlight
Outlook Mobile	Minutes to hours	Pull to refresh or reset account

OWA is the best way to verify actual server state — no local caching delays.

User Communication Templates

Initial Communication

Subject: Legal Hold Released - What to Expect

The legal hold on your mailbox has been released. Here is what to expect:

WHAT YOU MAY NOTICE:
• You may continue to see items in search results labeled "Discovery" or 
  "Recoverable Items" for the next 4-6 weeks
• You cannot delete these items yourself - this is normal
• Items will automatically disappear as the system processes cleanup

TIMELINE:
• Most items removed within 2-4 weeks
• Some items may take up to 6 weeks to fully clear
• No action required from you

If you have questions, contact [Help Desk].

Follow-Up (Still Seeing Items)

Subject: Re: Discovery Items Still Appearing in Search

Thank you for reporting that you still see "Discovery" items. This is expected.

WHY THIS HAPPENS:
Your email application indexes a hidden system folder called "Recoverable Items" 
where preserved content was stored. This content is being automatically removed, 
but your local search index may take additional time to update.

WHAT YOU CAN DO:
1. Try searching in Outlook Web (outlook.office.com) - shows current server state
2. [Windows] Rebuild Outlook search index: Control Panel → Indexing Options → Rebuild
3. [Mac] Allow Spotlight to reindex (may happen automatically)

Items should disappear within [X weeks]. Contact us if they persist beyond that.

Administrator Checklist

Pre-Release

Authorization obtained and documented
All affected locations identified (mailboxes, sites, Teams)
Current hold state documented
All hold types identified (litigation, eDiscovery, retention policies)

Release Execution

eDiscovery case holds released
Litigation holds released
Retention policy locations removed
Delay hold decision documented (wait 30 days vs. remove immediately)
All holds verified removed

Post-Release

MFA started for affected mailboxes
Expected completion date calculated (today + 37 days max)
Users notified with timeline expectations

Verification (2+ weeks later)

Recoverable Items folder sizes checked
PHL item counts checked
User confirmed search results normalized
Final documentation completed

Troubleshooting Quick Reference

Issue	Likely Cause	Quick Fix
Items won't delete from Recoverable Items	Hold still active or delay hold	Verify all holds released; check `DelayHoldApplied`
User sees "Discovery" in searches	Normal behavior during cleanup	Wait for MFA; have user check OWA
PHL cleanup fails	Hold still active on site	Check `ComplianceAttribute` on site
MFA not processing	System throttling	Wait and retry; check `ELCLastSuccessTimestamp`
Storage not decreasing	Items in Recycle Bin	Empty site Recycle Bins
Teams content persists	Multiple storage locations	Check both Group mailbox and SharePoint site

eDiscovery Guide — Creating cases, placing holds, running searches
Microsoft: How retention works for Exchange
Microsoft: How retention works for SharePoint
Microsoft: Delete items in Recoverable Items folder
Microsoft: Identify hold types on a mailbox
Microsoft: Recoverable Items folder in Exchange Online

Where Preserved Content Lives​

Key Timing Reference​

Understanding Hold Types​

Litigation Hold vs. eDiscovery Hold: Key Differences​

Hold Types Overview​

Identifying Holds on Mailboxes​

Identifying Holds on SharePoint/OneDrive​

Releasing Holds​

Release Litigation Hold (Exchange)​

Release eDiscovery Case Hold​

Release Retention Policy Hold​

Post-Release: Delay Holds (Exchange)​

Option A: Wait for Natural Expiration (Recommended)​

Option B: Remove Immediately​

Post-Release: Managed Folder Assistant (Exchange)​

Force MFA to Process a Mailbox​

Check MFA Status​

Post-Release: SharePoint/OneDrive Timeline​

Accessing Preservation Hold Library​

Check PHL Contents (PnP PowerShell)​

Manual Cleanup Procedures​

When Manual Cleanup Is Needed​

Exchange: Check Recoverable Items Size​

Exchange: Compliance Search Purge​

Exchange: Search-Mailbox (Legacy but Faster)​

SharePoint/OneDrive: Manual PHL Cleanup​

Teams-Specific Considerations​

Check Team's Group Mailbox​

Release Requires Action on Multiple Fronts​

Why Users See "Discovery" Items in Searches​

What Users Report vs. Reality​

Client Timeline for Search Index Updates​

User Communication Templates​

Initial Communication​

Follow-Up (Still Seeing Items)​

Administrator Checklist​

Pre-Release​

Release Execution​

Post-Release​

Verification (2+ weeks later)​

Troubleshooting Quick Reference​

Related Resources​