Does Litigation Hold Apply to OneDrive? (w/Examples) + FAQs

Yes, litigation hold applies to OneDrive for Business. Under Federal Rule of Civil Procedure 37(e), organizations have a legal duty to preserve all electronically stored information (ESI) — including files stored in OneDrive — once litigation is reasonably anticipated. Microsoft Purview’s eDiscovery tools allow administrators to place legal holds directly on OneDrive for Business accounts, preventing deletion, modification, or tampering with potentially relevant files. According to research from Logikcull, spoliation sanctions in federal courts have declined 35% since their peak in 2014 — yet courts still imposed sanctions in 24% of cases by 2018, and recent rulings show that intentional destruction of cloud-stored evidence can result in case dismissal.

Here is what you will learn in this article:

• 📌 How litigation hold works on OneDrive for Business and what federal rules require preservation of cloud-stored ESI
• ⚖️ The step-by-step process for placing a legal hold on OneDrive through Microsoft Purview, including licensing requirements
• 🔍 Real-world scenarios showing what happens when organizations fail to preserve OneDrive data — and the court sanctions that follow
• 🛡️ The critical differences between retention policies and eDiscovery holds, and why using the wrong tool can expose your organization to liability
• ❌ Common mistakes companies make with OneDrive litigation holds and how to avoid costly spoliation penalties

The Federal Rules That Govern OneDrive Preservation

The duty to preserve ESI — including OneDrive files — is rooted in federal law. Federal Rule of Civil Procedure 37(e) governs what happens when a party fails to preserve electronically stored information that should have been kept for litigation. The rule was amended in 2015 to create a uniform national standard for spoliation sanctions, replacing the patchwork of inconsistent rules that previously varied across federal circuits.

Under FRCP 37(e), a court may impose sanctions when three conditions are met. First, the ESI should have been preserved in anticipation or conduct of litigation. Second, it was lost because a party failed to take reasonable steps to preserve it. Third, the lost ESI cannot be restored or replaced through additional discovery.

The rule creates two tiers of consequences. Under FRCP 37(e)(1), if the court finds prejudice from the loss, it may order measures no greater than necessary to cure that prejudice. Under FRCP 37(e)(2), if the court finds the party acted with intent to deprive the other side of the information, it may presume the lost information was unfavorable, instruct the jury accordingly, or even dismiss the case or enter a default judgment.

A 5-part test was created by courts for deciding whether spoliation sanctions apply, which attempts to clarify ambiguity and create standardization across U.S. federal courts. While the 2015 amendment laid the groundwork for a more standardized approach, the way individual courts interpret the rule continues to define its practical boundaries.

The Zubulake Standard

The landmark case Zubulake v. UBS Warburg LLC (S.D.N.Y. 2003) established the foundation for modern ESI preservation duties. In that case, Laura Zubulake filed a gender discrimination suit against her former employer. She requested emails related to communications between herself and UBS Warburg employees. UBS Warburg produced only 350 pages of documents, but Zubulake herself had collected approximately 450 pages of emails — proving that more evidence existed.

The court found that UBS Warburg had a duty to preserve the missing documents because the information could reasonably be considered related to future litigation. Judge Shira Scheindlin ruled that “once a party reasonably anticipates litigation, it must suspend its routine document retention/destruction policy and put in place a ‘litigation hold’ to ensure the preservation of relevant documents.” The court issued a spoliation inference instruction, allowing the jury to infer that the destroyed evidence would have been unfavorable to UBS Warburg.

The Zubulake standard has been cited in dozens of subsequent cases and directly informed the 2006 amendments to the Federal Rules of Civil Procedure. In Voom HD Holdings, LLC v. EchoStar Satellite, LLC (2012), the First Department of the New York Supreme Court formally adopted the Zubulake standard, sanctioning EchoStar for failing to institute a litigation hold on automatic email deletion for a full year after it was on notice of anticipated litigation. These principles apply equally to modern cloud storage like OneDrive — if your organization stores relevant files in OneDrive and fails to preserve them after litigation is reasonably anticipated, you face the same obligations and risks as with any other ESI repository.

How Litigation Hold Works on OneDrive for Business

Microsoft enables organizations to place legal holds on OneDrive for Business accounts through its Purview compliance platform. When an eDiscovery hold is placed on a user’s OneDrive, the system preserves all files — including modified and deleted versions — in a hidden Preservation Hold Library within the SharePoint site underlying that user’s OneDrive. Users cannot see or access this library, but the preserved content remains available for eDiscovery searches.

This matters because OneDrive for Business is built on SharePoint Online infrastructure. When a user edits or deletes a file in their OneDrive, the original version is automatically copied to the Preservation Hold Library if a hold is active. This process happens silently in the background. The user can continue working normally, but every version of every document is retained for legal review.

A legal hold placed through eDiscovery has priority over automatic deletion settings and custom retention policies. This means that even if your organization has a policy to delete OneDrive content after a set period, the litigation hold overrides that policy and preserves the data for as long as the hold remains active. Employees cannot delete data items such as OneDrive files, Teams communication messages, or Outlook emails once a hold is in place.

Step-by-Step: Placing a Hold on OneDrive via Microsoft Purview

The process for placing an eDiscovery hold on OneDrive involves several key steps through the Microsoft Purview portal. Administrators must first have the appropriate permissions — either the eDiscovery Administrator or eDiscovery Manager role assigned in the Purview compliance portal.

1. Sign in to the Microsoft Purview portal with eDiscovery permissions.
2. Select the eDiscovery solution card and choose Cases (preview) in the left navigation.
3. Create a new case or select an existing case.
4. Navigate to the Hold policies tab within the case.
5. Click Create policy to set up a new hold.
6. Add the relevant custodians and select their OneDrive sites as data locations.
7. Optionally, apply condition filters or KQL (Keyword Query Language) filters to narrow the scope of the hold.
8. Click Apply hold to activate the preservation.

Once the hold is active, all content in the specified OneDrive accounts is preserved. Administrators can use the Hold Report feature in Purview to monitor all active holds across the tenant, verify which data locations are covered, and download reports for compliance documentation. The hold report lists all locations that are part of hold policies, whether enabled or disabled.

For organizations needing to place holds on a large number of custodians, PowerShell scripting enables bulk application of holds and more granular control over preservation settings. More advanced collection tactics involving Teams or large-scale OneDrive holds may require PowerShell coding to execute properly.

Licensing Requirements

Not every Microsoft 365 plan includes litigation hold capabilities. The licensing requirements are specific, and organizations that lack the right plan cannot place eDiscovery holds.

Organizations need at minimum a Microsoft 365 E3 plan or the equivalent compliance add-on to place eDiscovery holds on OneDrive for Business accounts. The E5 plan unlocks Premium eDiscovery features such as custodian management, legal hold notifications, AI-powered analytics, and advanced review sets. Without an E5 plan or add-on, organizations cannot take advantage of Advanced eDiscovery features including tagging, analytics, document metadata searching, conversation threading, and custodian management tools.

eDiscovery Standard vs. eDiscovery Premium for OneDrive Holds

Microsoft Purview offers two tiers of eDiscovery tools, and the differences matter when managing OneDrive litigation holds.

eDiscovery Standard (included with E3 licenses) allows organizations to create cases, place holds on Exchange mailboxes, OneDrive accounts, SharePoint sites, and Microsoft Teams locations. Administrators can run keyword searches across held content and export results. However, Standard lacks custodian management workflows, automated legal hold notifications, and advanced analytics.

eDiscovery Premium (included with E5 licenses) builds on Standard by adding custodian management, automated hold notifications that remind custodians of their preservation obligations, AI-driven document review, predictive coding, and the ability to create review sets for detailed analysis. Premium also provides more granular control over hold parameters and supports advanced workflows that integrate legal, IT, and compliance teams.

For organizations handling complex litigation with multiple custodians and large volumes of OneDrive data, Premium eDiscovery is the stronger choice. Standard is adequate for simpler matters with a limited number of custodians.

Personal OneDrive Accounts: A Different Problem

There is a critical distinction between OneDrive for Business and personal OneDrive (consumer) accounts. Microsoft Purview’s eDiscovery tools only work with OneDrive for Business accounts that are part of a Microsoft 365 tenant. Personal OneDrive accounts — the free or subscription-based accounts tied to individual Microsoft accounts — cannot be placed on hold through Purview.

This does not eliminate the legal obligation to preserve data stored in personal OneDrive accounts. If an employee uses a personal OneDrive account for work-related files, and those files are relevant to anticipated litigation, the organization still has a duty to preserve that data under FRCP 37(e). The difference is that the technical mechanism for preservation is not built into the platform.

In practice, this means organizations must issue litigation hold notices to employees instructing them to preserve all relevant data in personal cloud accounts. IT teams may need to collect the data manually, use third-party forensic tools, or work with the employee to export the files. Courts have made it clear that the absence of a convenient technical tool does not excuse a party from its preservation obligations.

This is why company policies that allow employees to store work files in personal cloud accounts create significant legal risk. When litigation arises, the organization has less control over preservation and faces a higher chance of spoliation claims. Organizations should establish clear policies restricting work-related files to corporate-controlled environments — specifically OneDrive for Business accounts within the organization’s Microsoft 365 tenant.

Retention Policies vs. eDiscovery Holds: A Dangerous Confusion

One of the most common and dangerous mistakes organizations make is treating Microsoft 365 retention policies as a substitute for eDiscovery holds. These are fundamentally different tools designed for different purposes, and using the wrong one can leave your organization exposed to spoliation sanctions.

Retention policies are compliance tools meant for managing data lifecycle — keeping data for regulatory periods and deleting it when no longer needed. They apply broadly across locations and are managed through Microsoft Purview’s Data Lifecycle Management. eDiscovery holds, by contrast, are legal tools meant to freeze specific custodians’ data in place for a particular legal matter.

The correct method for implementing a litigation hold on OneDrive data is through the eDiscovery hold option, not through retention policies. OneDrive data is especially vulnerable when organizations rely solely on retention policies because the behavior of retained content differs. For instance, while all content retained in the Preservation Hold Library is discoverable, retained versions of content may not always be discoverable — only the latest current version may appear in searches, while older versions are available for restoration but not direct discovery.

Three Real-World Scenarios

Scenario 1: Employee Deletes OneDrive Files After Hold Notice

Maria works in the sales department and receives a litigation hold notice from her company’s legal team regarding a contract dispute. She panics and deletes several files from her OneDrive that she believes could be problematic. She also empties her OneDrive recycle bin.

In Jones v. Riot Hospitality Group LLC (2024), a court dismissed the plaintiff’s case with prejudice under FRCP 37(e)(2) after finding intentional deletion of text messages despite court orders to preserve. The appellate court affirmed, stating that “to dismiss a case under Rule 37(e)(2), a district court need only find that the Rule 37(e) prerequisites are met, the spoliating party acted with the intent required under Rule 37(e)(2), and lesser sanctions are insufficient.”

Had Maria’s company placed the eDiscovery hold in Purview before sending the notice, the deleted files would have been preserved automatically in the Preservation Hold Library — regardless of Maria’s actions. This scenario illustrates why both a legal notice and a technical hold are necessary. Neither one alone provides complete protection.

Scenario 2: Departed Employee’s OneDrive Data Is Lost

James leaves the company in March. His manager receives an email notification that James’s OneDrive will be deleted in 30 days. The manager downloads a few project files but ignores the rest. In July, the company receives a lawsuit related to work James performed. Legal needs James’s OneDrive files, but the data was permanently deleted.

Microsoft’s documentation confirms that when a user account is deleted, the OneDrive Clean Up Job runs and marks the account for deletion. The default retention period is 30 days, followed by 93 days in the site collection recycle bin. After that, the data is permanently gone. Importantly, content in the recycle bin is not indexed, meaning eDiscovery searches cannot locate it there.

However, if a OneDrive is placed on hold as part of an eDiscovery case, the OneDrive will not be deleted until the hold is removed — even if the user account is deleted. The critical lesson: organizations should place eDiscovery holds on departing employees’ OneDrive accounts before removing their licenses or deleting their accounts whenever litigation is reasonably anticipated.

Scenario 3: Small Business Uses Personal OneDrive for Work Files

A small marketing firm allows its five employees to use personal OneDrive accounts to store client files. When a former client sues the firm for breach of contract, the firm’s attorney issues a litigation hold notice. However, the firm discovers it has no way to technically enforce preservation on personal OneDrive accounts. Two employees have already deleted old client files during routine cleanup.

In EEOC v. Formel D USA, Inc. (2024), the court found that the employer failed to take reasonable steps to preserve text messages and mobile device data despite being on notice of the duty to preserve. The court ordered the company to produce its actual litigation hold notices and imposed sanctions including a forensic examination at the defendant’s expense. The court emphasized that the lack of a preservation policy does not absolve a party from its duty to preserve ESI.

Unlicensed OneDrive Accounts and Litigation Holds

A common concern arises when employees leave and their Microsoft 365 licenses are reassigned. Starting in January 2025, Microsoft began enforcing a policy that automatically archives unlicensed OneDrive accounts on their 93rd unlicensed day. This raised alarm among legal and IT teams about whether archived accounts would still honor existing holds.

Microsoft clarified in late 2025 that organizations retaining unlicensed OneDrive accounts solely for eDiscovery or legal holds under Purview will not incur storage or access fees. Archived OneDrive accounts fully honor retention policies, eDiscovery settings, and all holds while in the archived state. This means companies can remove a departed employee’s license, and as long as an eDiscovery hold is in place, the data remains preserved and searchable — at no additional cost.

The deletion process for unlicensed accounts follows a specific order of precedence. Microsoft honors retention mechanisms in this sequence: (1) OneDrive retention period, (2) retention policies, and (3) legal holds. After all retention mechanisms are satisfied, the account is recycled and permanently deleted. An eDiscovery hold effectively overrides the normal deletion timeline.

An earlier announcement in July 2024 (Message ID MC836942) had suggested that organizations would need to set up archive billing for unlicensed OneDrive accounts at $0.05/GB/month, plus $0.60/GB for reactivation. That announcement created significant confusion because it did not distinguish between business access and eDiscovery access. Microsoft’s updated guidance resolved this by confirming that eDiscovery-related holds are exempt from these fees.

Third-Party eDiscovery Tools for OneDrive

While Microsoft Purview provides native hold capabilities, many organizations supplement or replace Purview with third-party eDiscovery platforms for more advanced needs.

RelativityOne integrates directly with Microsoft 365 to collect OneDrive data. It allows legal teams to preserve and collect ESI from OneDrive, Outlook, and other enterprise tools without leaving the platform. The system requires registering a Collect application in Azure Portal and configuring API access to the organization’s Microsoft 365 tenant. One limitation: Relativity cannot collect data from inactive employee mailboxes because the Microsoft Graph API does not support access to inactive mailboxes.

Exterro offers end-to-end eDiscovery capabilities including legal holds, collection, review, and production. The platform integrates with Microsoft 365 and provides automation features for managing hold notices across large custodian populations. Legal teams can use Exterro to manage both the technical hold (preserving data in place) and the legal notice (informing custodians of their obligations) from a single interface.

Reveal Legal Hold supports preservation in place for Microsoft Purview using Standard eDiscovery. For custodians that are part of a hold, the platform can preserve both their Exchange mailbox and OneDrive in Microsoft 365. The integration extends to Teams, SharePoint, and shared mailboxes for organizations using Entra ID tenants. Users need either Compliance Administrator or eDiscovery Administrator role permissions to set up the integration.

These tools address some of the limitations of native Purview eDiscovery, including more robust search capabilities, AI-powered document review, better export handling, and centralized management of holds across multiple data sources beyond Microsoft 365.

Mistakes to Avoid

Failing to properly manage OneDrive litigation holds can result in spoliation sanctions, adverse inferences, or even case dismissal. Here are the most common errors and their consequences.

Mistake 1: Relying on retention policies instead of eDiscovery holds. Retention policies are not designed for litigation preservation. OneDrive data under a retention policy may behave differently than data under an eDiscovery hold, particularly regarding discoverability of retained versions. Using a retention policy instead of an eDiscovery hold may not meet the reasonable steps standard under FRCP 37(e).

Mistake 2: Delaying the hold until a lawsuit is formally filed. The duty to preserve arises when litigation is reasonably anticipated, not when the complaint is served. In Zubulake, the court found the preservation obligation arose when the plaintiff filed her EEOC complaint — two months before she was even terminated. The court noted further that the obligation was probably triggered even four months earlier because “almost everyone associated with Zubulake recognized the possibility that she might sue.”

Mistake 3: Failing to hold departed employees’ OneDrive accounts. When an employee leaves, their OneDrive data begins the deletion process within 30 days. If the departing employee was involved in matters that could lead to litigation, the organization must place a hold before removing the license or deleting the account.

Mistake 4: Not verifying that the hold is working. Placing a hold and assuming it works is not sufficient. Administrators should use the Hold Report feature in Purview to verify that holds are active and covering the intended data locations. In multiple cases, organizations discovered that holds were improperly configured, leaving data unprotected.

Mistake 5: Sending hold notices without implementing technical holds. A litigation hold notice tells employees to preserve data, but it relies on human compliance. Technical holds in Purview actually prevent data from being deleted regardless of user actions. Both steps — notice and technical hold — are necessary for a defensible process.

Mistake 6: Overlooking OneDrive data in BYOD environments. Employees using personal devices may sync OneDrive for Business files locally. If those devices are wiped or returned without proper data collection, relevant ESI may be lost. Organizations must account for locally synced OneDrive files in their preservation plans.

Mistake 7: Placing holds that are too narrow. Using overly restrictive keyword filters when creating holds can cause relevant documents to fall outside the hold’s scope. When in doubt, broader preservation is safer than narrow preservation. The Pension Committee of the University of Montreal v. Banc of America Securities case made clear that failure to follow proper eDiscovery procedures constitutes gross negligence and is sanctionable.

Do’s and Don’ts for OneDrive Litigation Holds

Do’s

• Do place eDiscovery holds immediately when litigation is reasonably anticipated. Delays create gaps where evidence can be lost, and courts evaluate the timeliness of your preservation efforts.
• Do coordinate between legal and IT teams. Legal identifies the custodians and scope; IT implements the technical holds in Purview. Miscommunication between these teams is a common source of preservation failures.
• Do document every step of the hold process. Keep records of when holds were placed, which custodians and data locations were included, and any changes made. This documentation is your evidence of reasonable preservation efforts.
• Do include OneDrive in your preservation scope. Many organizations focus on email and forget that OneDrive files — contracts, spreadsheets, presentations, and internal documents — may be equally relevant to litigation.
• Do audit active holds regularly. Cases evolve, custodians change roles, and new data sources emerge. Quarterly reviews of all active holds ensure nothing falls through the cracks.

Don’ts

• Don’t assume retention policies are enough. Retention policies and litigation holds serve different purposes. A retention policy alone does not demonstrate the intentional, case-specific preservation that courts expect.
• Don’t delete user accounts before verifying hold status. Once a user account enters the deletion process, the clock starts ticking. If no hold is in place, OneDrive data will be permanently destroyed within approximately 123 days (30-day retention + 93-day recycle bin).
• Don’t ignore personal OneDrive accounts. If employees store work files in personal cloud accounts, your preservation obligation extends to that data. Develop policies that restrict work files to corporate-controlled environments.
• Don’t release holds prematurely. Removing a hold before litigation concludes can trigger the normal deletion process. Only release holds when legal counsel confirms the matter is fully resolved.
• Don’t rely solely on employee compliance with hold notices. Human error and intentional deletion are real risks. Technical holds in Purview provide the safety net that hold notices alone cannot guarantee.

Relevant Court Rulings

Jones v. Riot Hospitality Group LLC (2024)

In this Title VII case, the plaintiff intentionally deleted text messages despite court orders to preserve them. The plaintiff also collaborated with witnesses to hide relevant ESI. The court dismissed the case with prejudice under FRCP 37(e)(2), finding that intentional spoliation was evident and prejudicial. The appellate court affirmed, establishing that courts need only find that the 37(e) prerequisites are met and that lesser sanctions are insufficient to address the loss.

EEOC v. Formel D USA, Inc. (2024)

The EEOC accused Formel D of failing to preserve emails, text messages, and data from laptops and cell phones. The court found that Formel D had no preservation policies for mobile devices and failed to take reasonable steps to preserve data despite being on notice. In an unusual move, the court ordered the company to produce its actual litigation hold notices and imposed sanctions including a forensic examination at the defendant’s expense. This case underscores that the absence of a preservation policy actually increases a company’s liability.

Maziar v. City of Atlanta (2024)

The court found the City of Atlanta grossly negligent in its failure to preserve text message evidence. Even though the court found no bad faith under FRCP 37(e)(2), it determined that sanctions were warranted under 37(e)(1) due to prejudice to the plaintiff. The court denied the defendant’s motion for summary judgment and awarded attorney fees to the plaintiff. This ruling illustrates that even negligent spoliation — not just intentional destruction — can trigger real consequences.

GN Netcom v. Plantronics

The District Court of Delaware imposed a $3 million punitive monetary sanction due to a corporate executive’s bad-faith and intentional destruction of prejudicial ESI. This sanction was imposed in addition to other penalties, demonstrating that courts may layer multiple sanctions for severe spoliation conduct. The case serves as a warning that individual executive conduct can expose an entire organization to massive financial liability.

FAQs

Does litigation hold apply to OneDrive for Business?

Yes. Organizations can place eDiscovery holds on OneDrive for Business accounts through Microsoft Purview, preserving all files including deleted and modified versions.

Can I place a litigation hold on a personal OneDrive account?

No. Microsoft Purview only supports holds on OneDrive for Business accounts within a Microsoft 365 tenant, but legal preservation obligations still apply to personal accounts.

What Microsoft 365 license do I need for OneDrive litigation holds?

Yes, a specific license is required. You need at minimum a Microsoft 365 E3 plan or an equivalent compliance add-on to place eDiscovery holds on OneDrive accounts.

Does a retention policy replace a litigation hold on OneDrive?

No. Retention policies serve data lifecycle management purposes and are not a legally defensible substitute for the case-specific preservation that eDiscovery holds provide.

What happens to OneDrive data when an employee leaves?

Yes, the data is at risk. By default, a departed employee’s OneDrive is deleted after 30 days, with 93 additional days in the recycle bin before permanent deletion occurs.

Can deleted OneDrive files be recovered if a hold is in place?

Yes. When an eDiscovery hold is active, deleted and modified files are preserved in the hidden Preservation Hold Library and remain fully searchable through Purview.

Are there fees for holding an unlicensed employee’s OneDrive?

No. Microsoft confirmed that organizations retaining unlicensed OneDrive accounts for eDiscovery or legal holds under Purview do not incur additional storage or access fees.

Can third-party tools place litigation holds on OneDrive?

Yes. Tools like RelativityOne, Exterro, and Reveal integrate with Microsoft 365 to preserve and collect OneDrive data as part of broader eDiscovery workflows.

What is the penalty for failing to preserve OneDrive data?

Yes, penalties can be severe. Under FRCP 37(e), courts may impose curative measures, adverse inference instructions, monetary sanctions, or case dismissal for intentional spoliation.

Does the litigation hold preserve OneDrive file metadata?

Yes. eDiscovery holds preserve files in their original form, including metadata such as creation date, modification history, authorship details, and file properties.