How to Configure Microsoft Purview for Slack & Teams eDiscovery Litigation Holds

When corporate counsel issues a sudden litigation hold, IT departments must instantly freeze millions of cross-platform messages to prevent the illegal spoliation of evidence. The Solution: To execute a legally defensible preservation protocol without alerting the employees under investigation, Enterprise IT must deploy Microsoft Purview eDiscovery (Premium). By utilizing authorized third-party data connectors to ingest Slack Enterprise Grid data into Exchange Online mailboxes, administrators can apply silent, in-place holds across both Microsoft Teams and Slack simultaneously. This satisfies strict EDRM (Electronic Discovery Reference Model) preservation requirements while drastically reducing third-party data ingestion fees.

The Compliance Crisis: Spoliation and the “Export Trap”

When a corporation faces an SEC audit, an HR lawsuit, or intellectual property litigation, the legal department issues a preservation memo. Historically, IT responded to this by telling employees to “stop deleting emails” or by forcefully exporting terabytes of raw inbox data to PST files and shipping them to external law firms.

In 2026, this legacy approach is a massive legal and financial liability.

• Spoliation of Evidence: If an employee deletes a highly relevant Slack message or Teams chat after a hold is issued, the opposing counsel will accuse your company of “Spoliation of Evidence.” Judges routinely issue devastating financial sanctions—and sometimes default judgments—against corporations that fail to take “reasonable steps” to freeze data.
• The CFO’s “Export Trap”: External eDiscovery processing platforms (like Relativity, Logikcull, or Everlaw) charge exorbitant ingestion and hosting fees based on data volume (often hundreds of dollars per gigabyte). If IT blindly exports the entire company’s Slack and Teams history to outside counsel, the legal bill will bankrupt the quarter’s operating budget.

Advanced Preservation Architecture (Deep Dive)

Microsoft retired its “classic” eDiscovery portals in late 2025. Today, Microsoft Purview eDiscovery (Premium) is the undisputed command center for legal data governance, but mapping modern chat applications into its architecture requires strict technical precision.

Deciphering Microsoft 365 E5 Compliance Licensing Requirements

Before configuring a single hold, IT must address the licensing hurdle. Standard Office 365 E3 licenses only provide basic eDiscovery (Standard), which cannot intelligently thread Teams conversations or utilize advanced AI analytics. To deploy these advanced features, the specific custodians (the employees placed on hold) must be licensed with either a full Microsoft 365 E5 license or the Microsoft 365 E5 Compliance Add-on.

Transitioning to EDRM-Aligned Purview

Purview eDiscovery (Premium) maps directly to the Electronic Discovery Reference Model (EDRM). It provides an end-to-end workflow to identify, preserve, collect, process, and review data without it ever leaving the Microsoft 365 security boundary, massively reducing the risk of a data breach during transit to outside counsel.

Mapping Teams Litigation Holds: Standard vs. Private Channels

Placing Microsoft Teams on hold is notoriously complex because “Teams” is not a single database; it is a UI that pulls data from multiple backend locations. To successfully freeze Teams data, administrators must target the correct underlying storage:

• 1:1 and Group Chats: These are stored in hidden folders within the individual users’ Exchange Online mailboxes. The hold must be placed on the specific custodians’ mailboxes.
• Standard Channel Messages: These are stored in the group mailbox associated with the Microsoft 365 Group. The hold must be placed on the Group.
• Shared and Private Channel Messages: Private channel chats are stored in the mailboxes of the specific channel members, while files are stored in a dedicated, hidden SharePoint site.

Preserving Cross-Tenant Collaboration Chats

In modern business, employees frequently chat with external vendors via Teams Shared Channels (B2B Direct Connect). When a cross-tenant collaboration hold is required, Purview can only preserve the data that physically resides within your tenant’s boundaries. If your employee is chatting in a channel hosted by a partner company, you must legally request the partner’s IT department to place a hold on their side.

Ingesting Slack via Third-Party Data Connectors

If your engineering department uses Slack while the rest of the business uses Teams, you cannot execute two separate, disjointed legal holds. You must consolidate the preservation layer.

• The Architecture: Microsoft 365 allows administrators to deploy authorized third-party data connectors (provided by vendors like Veritas or TeleMessage) to build an API bridge to Slack Enterprise Grid.
• The Execution: The connector continuously pulls Slack direct messages, channel chats, and attachments, formatting them into standard email items (using the kind:externaldata property), and seamlessly injects them into the respective users’ Exchange Online mailboxes. Once the Slack data is inside Exchange, Purview can place a single, unified Litigation Hold over both Teams and Slack simultaneously.

Step-by-Step: Executing a Silent In-Place Litigation Hold

The most critical requirement of an internal investigation (such as an embezzlement or insider trading probe) is that the employee must not know they are being investigated. Purview handles this elegantly via Silent In-Place Holds.

1. Create the eDiscovery (Premium) Case: Navigate to the Microsoft Purview compliance portal and establish a new case with strict access controls (restricting access to authorized eDiscovery managers and corporate counsel only).
2. Add Custodians: Identify the specific users under investigation. Purview will automatically map their primary Exchange mailbox and OneDrive account.
3. Map Additional Locations: Manually attach the Microsoft 365 Groups (for Teams channels) and the Slack-ingested mailboxes relevant to those custodians.
4. Apply the Hold: Execute the hold policy.

The UX Result: The hold is entirely invisible to the employee. If the user attempts to delete a highly incriminating Teams message or empty their recycle bin, the item disappears from their screen as expected. However, on the backend, Purview silently intercepts the deletion and moves the item into a hidden, immutable Recoverable Items partition that the user cannot access, preserving it flawlessly for the legal team.

The Architect’s Dilemma: Purview Native vs. Third-Party eDiscovery

Once the data is frozen, the enterprise must decide where to actually read and review the evidence. Do you process the data entirely within Purview, or do you export it to a dedicated eDiscovery platform?

Early Case Assessment (ECA) Data Culling Workflows

The Financial Verdict: Smart enterprises use Purview eDiscovery (Premium) to freeze 100% of the data and use Purview’s Early Case Assessment (ECA) search queries to cull the data set by 90% (removing system notifications, personal chatter, and spam). They only export the remaining 10% of highly responsive documents to platforms like Relativity, saving millions of dollars in external hosting fees while maintaining perfect compliance.

Frequently Asked Questions (eDiscovery & Purview)

Does a Purview Litigation Hold notify the employee?

No. By default, applying a hold in Microsoft Purview is a silent, backend operation. The user receives no alerts, and their daily experience in Outlook, Teams, or Slack remains completely unchanged, making it ideal for sensitive internal investigations.

Can Purview capture edited Teams and Slack messages?

Yes. When a hold is active, Purview does not just save the final state of the message. If an employee sends a message, edits it to hide incriminating details, and then deletes it, Purview retains the original message, the edited version, and the deletion event, providing a complete forensic audit trail.

What happens to the legal hold if a user account is deleted?

If a user leaves the company and their Entra ID account is deleted, their mailbox and OneDrive data will typically be purged after 30 days. However, if a Purview hold is active on that account, it converts the data into an “Inactive Mailbox.” The data is retained indefinitely and remains fully searchable for the duration of the legal case, without requiring an active M365 license.