Add a Litigation Hold Action to a User Flow
Litigation Hold (also known as In-Place Hold) preserves a user’s Exchange Online mailbox content for legal or compliance purposes, preventing items from being permanently deleted or modified. As of v7.0, Litigation Hold is available as an action within User Offboarding Flows, allowing MSPs to automate this compliance step as part of their standard offboarding process.
Including Litigation Hold in your offboarding flow ensures that mailbox preservation is applied consistently and at the correct point in the offboarding sequence — for example, before a mailbox is converted or an account is disabled.
The tasks in this procedure are performed at the MSP level.
Prerequisites
Microsoft 365 requirements
- The target user must have an Exchange Online mailbox.
- The service principal used by Nerdio Manager must have sufficient Exchange Online permissions to apply Litigation Hold. Specifically, the eDiscovery Manager or equivalent role is required at the tenant level.
Role-based access control (RBAC) and permissions
At the customer level:
- Accounts.UserFlows
- Accounts.UserFlows.Read
- Accounts.Users.Offboard
At the MSP level:
- Msp.UserFlows
- Msp.UserFlows.Create
- Msp.UserFlows.Update
- Msp.UserFlows.Page
- Msp.UserFlows.Read
Nerdio Manager roles
The following Nerdio Manager roles allow you to add Litigation Hold to a User Flow:
- MSP Admins can create and edit User Flow templates, including adding the Litigation Hold action.
Nerdio Manager access levels
Following the Principle of Least Privilege (PoLP), you can define one or more Nerdio Manager custom role(s) to manage User Flows.
Add Litigation Hold to an offboarding template
- In Nerdio Manager for MSP, navigate to Shared Settings > Microsoft 365 > User Flows.
- Open an existing offboarding template by clicking its name, or create a new one.
- In the Actions section, select the Execution Time at which Litigation Hold should be applied. In most offboarding scenarios, this action should be placed Before or On the offboarding date, prior to any account deprovisioning actions.
- Click Add Action.
- From the Available Actions dropdown, select Litigation Hold, then click Add.
- Configure the action options (see below).
- Click Create or Save.
Configure the Litigation Hold action options
| Option | Description |
|---|---|
| Enable Litigation Hold | Enables In-Place Hold on the user’s Exchange Online mailbox. Select this to preserve all mailbox content. |
| Hold Duration | Optionally specify a duration (in days) for which the hold should remain in place. Leave blank to hold indefinitely. |
| Notes | An optional free-text field for internal notes or legal case references. This content is stored in the hold configuration in Exchange Online. |
Note: Litigation Hold requires that the user’s mailbox is active at the time the action runs. If the account has already been disabled or the mailbox deleted, this action will fail. Ensure Litigation Hold is sequenced before any mailbox deletion or account disable actions in your flow.
Verify that Litigation Hold was applied
After an offboarding flow containing a Litigation Hold action has run, you can verify the hold was applied successfully from the Initiated Flows view.
- Navigate to Shared Settings > Microsoft 365 > User Flows > Initiated Flows.
- Locate the relevant flow and click to open its details.
- Review the action log. The Litigation Hold action should show a Completed status.
For an additional verification step, the hold status can be confirmed directly in the Microsoft Purview compliance portal or via Exchange Online PowerShell (Get-Mailbox <user> | Select LitigationHoldEnabled).
Need help?
Raise a support ticket for this item.
Comments (0 comments)