How to find mailboxes on litigation hold in Exchange Online

Before you start

Use an account in the Organization Management, Recipient Management or View-Only Management role group. A mailbox needs an Exchange Online Plan 2 licence, or Plan 1 with an Exchange Online Archiving licence, to be placed on litigation hold.

The script reads settings as Exchange holds them when it runs, so the CSV is a snapshot, and Microsoft says a new hold can take up to 240 minutes to take effect. Inactive mailboxes, which a hold keeps after their account was deleted, are left out unless you add a switch. The examples read and export and change nothing.

Option 1

Find mailboxes on litigation hold with PowerShell

Install the module once, then connect and export the mailboxes on litigation hold. Microsoft says filtering on the client is faster with the Get-EXO cmdlets, so the script uses Where-Object.

# Install once, if the module is not already installed.
Install-Module ExchangeOnlineManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-ExchangeOnline
try {
    $mailboxes = Get-EXOMailbox -ResultSize Unlimited -PropertySets Minimum,Hold
    $report = @($mailboxes | Where-Object { $_.LitigationHoldEnabled -eq $true } |
        Sort-Object DisplayName |
        Select-Object DisplayName,PrimarySmtpAddress,RecipientTypeDetails,
            LitigationHoldDate,LitigationHoldOwner,LitigationHoldDuration)
    if ($report.Count -eq 0) {
        Write-Output 'No mailboxes are on litigation hold.'
    } else {
        $path = './litigation-hold-mailboxes.csv'
        $report | Export-Csv -Path $path -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) mailboxes are on litigation hold."
    }
} finally {
    Disconnect-ExchangeOnline -Confirm:$false
}

The CSV has 1 row for each mailbox on hold, with who set it (LitigationHoldOwner) and when (LitigationHoldDate). LitigationHoldDuration reads Unlimited for a hold with no end, or a time span such as 365.00:00:00. The script passes -ResultSize Unlimited because the default is 1000. To narrow the export, add -RecipientTypeDetails SharedMailbox; to include inactive mailboxes, add -IncludeInactiveMailbox.

Check a single mailbox

Reconnect with Connect-ExchangeOnline, then read 1 mailbox.

# Run while connected to Exchange Online. Replace the example mailbox.
Get-EXOMailbox -Identity 'person@example.com' -PropertySets Minimum,Hold |
    Select-Object DisplayName,LitigationHoldEnabled,LitigationHoldDate,LitigationHoldOwner,
        LitigationHoldDuration,InPlaceHolds

InPlaceHolds lists eDiscovery holds and retention policies, so it shows what LitigationHoldEnabled does not.

Option 2

Check a mailbox's litigation hold in the admin centre

1. Sign in to the Microsoft 365 admin centre for the correct tenant.
2. Go to Users > Active users and select the person.
3. On the Properties flyout panel, select the Mail tab, then under More actions, select Manage litigation hold.
4. Read the Turn on litigation hold checkbox. When it is ticked, Hold duration (days) shows the time limit; a blank box means items are kept indefinitely.
5. Close the flyout without selecting Save changes, so nothing changes.

If Manage litigation hold is missing, the mailbox may lack an Exchange Online Plan 2 licence. This suits 1 person; for every mailbox, use PowerShell or Altivane.

Common questions

Does a mailbox that is not on litigation hold have nothing held?

No. Litigation hold is 1 of several ways to keep content. The InPlaceHolds property lists eDiscovery holds, In-Place Holds and retention policies, and ComplianceTagHoldApplied is true when a retention label keeps items.

Why is a former employee's mailbox missing from the list?

The script reads active mailboxes. A mailbox on hold when its account was deleted becomes an inactive mailbox, kept until the hold is removed. Add -IncludeInactiveMailbox to the Get-EXOMailbox command to list it.

Why is a mailbox on hold growing?

Items a person deletes stay in the Recoverable Items folder while the hold lasts, and Microsoft raises that folder's quota from 30 GB to 100 GB. To see the largest mailboxes, see how to export Exchange Online mailbox sizes.