Applying Holds to Teams Private Channel Messages

An Unclear Announcement About Legal Holds for Teams

Office 365 Notification MC202846

The wording of Microsoft’s February 2 announcement (MC202846) that legal hold is now supported for Teams private channels might have confused some. The announcement starts with “we have begun rolling out legal hold for Microsoft Teams,” which isn’t accurate. It has been possible to put the group mailboxes used by Teams on legal hold via PowerShell or by including group mailboxes in holds owned by eDiscovery cases for quite a while. For example, to set a group mailbox on litigation (everything is retained hold), you can run the command:

The real meaning of MC202846 is that holds are now supported to control the compliance records created for conversations in private channels. As noted in this article, private channels don’t have a group mailbox, so the same capture mechanism for compliance records used for regular channels doesn’t work.

Holding Teams Conversations

When messages are posted to regular channels, the Office 365 substrate captures copies of the messages and stores them in the Team Chat folder of the group mailbox belonging to the team. The lack of a group mailbox for private channels means that the substrate stores compliance records for private channels in the mailboxes of all the members of the private channel, which is the same approach taken to capture records of 1:1 and group chats. Therefore, compliance records for a team are divided as follows:

  • Messages posted to regular channels. Stored in the Team Chat folder of the group mailbox belonging to the team.
  • Messages posted to private channels. Stored in the Team Chat folder of the mailboxes belonging to all private channel members.

Team Chat is a sub-folder of the Conversation History folder. “Team Chat” is the English language name. If you want to be sure that you’re accessing the right folder with PowerShell, check the folder type. For example, I often use a command like this to discover when the last compliance record was written to a mailbox:

Teams Compliance Records Are Copies

Despite the efforts of some backup vendors, aided and abetted by a lack of understanding about Teams compliance records, it is untrue that messages stored in Exchange mailboxes are real Teams message data that are a good backup source. The Teams message store is in Azure CosmosDB, and the mailbox items are incomplete copies created as Outlook mail items. The upside is that because the compliance records exist in Exchange mailboxes, they are indexed and therefore discoverable by Office 365 content searches, available for retention processing, and suitable targets for holds.

Distinguishing Private Channel Messages

The problem with storing copies of private channel messages alongside copies of personal data is how data governance processing can distinguish the items. After all, you probably don’t want the retention policy set for personal chats to apply to private channel messages. To solve the problem, compliance records for private channels are marked with a different source, allowing components like the Managed Folder Assistant to ignore private channel data when processing retention policies.

Code in the Managed Folder Assistant also handles ELC (Electronic Lifecycle) processing, a fancy name for checking if items must be retained because they come within the scope of a hold. ELC checks items before they are removed from a mailbox and keeps a copy if required by a retention policy or hold. Microsoft has updated the hold logic to allow processing of private channel items, which then means that private channel items now support holds.

Using MFCMAPI to view Teams compliance records in an EXO mailbox
Figure 1: Using MFCMAPI to view Teams compliance records in an EXO mailbox

Clients can’t get at the Team Chat folder to view or remove items (as seen in Figure 1, you can use MFCMAPI to look at the items), so all compliance records for private channels created since their introduction are still in group mailboxes. In effect, a hold existed for these items. After the update rolls out, holds placed on the mailboxes of members of a private channel will include the messages posted to that channel.

Holding Private Channel Messages

Because all members of a private channel store copies, it’s enough to put the mailbox of a single member of a private channel on hold to impose the hold on the messages posted to that private channel. The obvious flaw in this strategy is that if the chosen member leaves the organization and their mailbox is deleted, the hold lapses. The workaround is to include the mailboxes of two, or three members in the hold, but what happens if all the chosen members leave?

It would be better if the addition of a group mailbox to a hold created implicit holds on all private channel content stored in member mailboxes, but that’s not the way things work. At least, not for now.


Compliance is such an interesting topic! Seriously, when you need to understand Office 365 data governance, consider leveraging the wealth of experience in the Office 365 for IT Pros eBook.

Advertisements

5 Replies to “Applying Holds to Teams Private Channel Messages”

  1. Hi Tony,

    Sorry – side question here, where are the conversations for Private Channels stored? Also in the main Team/Group Mailbox?
    Or does the private channel also create separate Group Mailbox?

    I.e. If the main Team Group mailbox is on eDiscovery hold, then this will cover Private channel conversations too?

    TIA

  2. Hi Tony,

    Thanks for the write up. I was wondering with regards to one-to-one chat conversations, I believe that they to have compliance records generated that saved to the users mailbox, does that mean that they are also captured by a litigation hold even if the organization has a 24 hour retention period?

    1. Teams compliance records are only processed by retention policies for Teams. Normal retention policies leave the compliance records alone. If you create a retention policy to remove Teams compliance records after 24 hours, that is what will happen. Because the litigation hold is in place, the deletion is captured in the SubstrateHolds folder (I believe… need to check) and is kept there until the hold is released, just like the interaction between any other retention policy and holds.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.