Applying & Removing Legal Hold

OVERVIEW

Use Legal Hold to keep a copy of your emails and/or files regardless of your system-set archiving retention policy. The 'Legal Hold' status will trump your Email Retention Policy and retain the messages for ever, as long as the legal hold status of a message remains enforced.  Legal Hold can be applied and removed at different levels from the search results page:
        1. On an entire search results set.
        2. On a filtered search result set.
        3. On an individual result (email/file).


LEGAL HOLD ON A SEARCH/FILTER

         1. From the search (or filtered) results page, use the Legal Hold Actions... drop-down menu, and select Place all results on legal hold.




        2. Once you've selected the desired action to perform, a confirmation popup window will prompt you to confirm the action taken.

        3. Click OK to confirm and start applying the Legal Hold status to the selected result set.



        4. The progress meter displayed on the top right corner of the search result page will allow you to track the status of your request live. The different statuses are as follow:
                * Scheduling.
                * Queued.
                * New
                * Processing.
                * Succeeded.



***NOTE: It is not required to stay on the search result screen while the Legal Hold request is processing. You can go to other pages, logout of the archive, etc. This will not disrupt the Legal Hold request from processing.

        5. Once the status indicates succeeded, refresh the page to see the legal hold status applied to your search results (seen below).

        6. Click on the 'Show Legal Hold Count' button as shown above. This will indicate the number of search results placed on legal hold.



***NOTE: Every time you access a search, where results have been placed on legal hold, you have to click on the "Show Legal Count" to display the amount of messages placed on hold. This can be helpful when you have a search that has new results that haven't been placed on hold.

        7. To remove the Legal Hold status from the entire result set, select the Remove all results from legal hold from the Legal Hold Actions... drop-down menu and follow the same steps as for applying legal hold.


INDIVIDUAL LEGAL HOLD

The archive service allows you to selectively place and remove messages from legal hold. In order to do so, from the search results page:

        1. Locate the message that needs to be placed or removed from legal hold. 

        2a. Click on the grey locker icon to place the message on legal hold to ensure that nobody can tamper or delete the data.

        2b. Click on the blue locker icon to remove the message from legal hold to set back the email to the archive standard retention policy. 

        3. Once you've selected the desired action to perform, a confirmation popup window will prompt you to confirm the action taken. Click OK to confirm and start applying/removing the Legal Hold status from the selected message.

        4. The legal hold request will be queued for processing. The legal hold status (locker icon) will be updated accordingly once the request goes through and you refresh the page.


AUDITING LEGAL HOLD ACTIVITY

Any time a legal hold is placed or removed, (at the search, filter, or individual level) all the activity is logged and reportable from the Saved Searches page.

        1. Click on the SEARCH tab.

        2. Click on the "Audit" button next to the search for which you want to audit the activity.



        3. From there, you'll have access to the entire search activity, including the legal hold activity. The username, date, time, IP address, and action taken are available from this page and can be reported on.

                3a. Search and filter-level legal hold activity will be shown in the form of an 'Action' and a 'Tag' being applied (legal hold).

                3b. Individual legal hold activity will be shown in the form of an 'Action', a 'Tag' being applied (legal hold), and the unique 'Message UUID' of the email that has been placed or removed from Legal Hold.



TECHNICAL SPECIFICATIONS AND DETAILS

* Legal Hold cannot be applied to a search containing over one million search results (messages and/or files). If you encounter this scenario, we recommend breaking down the search, using the Filter My Result option.

* You can place a legal hold status to any or all items in a given search result set. This means that legal hold can be applied in three instances:
        * On an entire search result.
        * On a filtered search result.
        * On an individual result.

* A legal hold will prohibit items from being removed during automatic maintenance routines. Legal holds are typically used when legal actions is taking place for the pertinent searches. Legal holds can be placed on messages (an their associated attachments), files, and co-mingled email and file search results.

* Any file tagged with the legal hold attribute cannot be purged from the archive service, even if an automatic retention policy is configured to remove those items. Legal hold will overwrite any system-set retention policy.

* From a performance standpoint, we estimate that legal hold takes on average 1ms per message, plus some buffer. Placing a result set with X results on legal hold would take approximately X*1ms.

* Search Administrators, and Search Administrator Plus have the ability to use legal hold as a search criterion. To learn more about this, refer to the Wizard search page.

* Legal hold is applied at the message level and is not tied to a specific search. As such, when a message is placed on legal hold, the legal hold tag will be visible whenever a user views the message in the search interface. Likewise, when a legal hold us removed from a message, the message will no longer be on legal hold, and the legal hold tag will no longer be visible when a user views the message in the search interface. In case you have multiple Search Admins running different searches, if one SA removes legal hold from an email in 'his' search, it will affect the other Search Admin search(es) with legal hold if they have the same email.