Official documentation checked October 14, 2026.
A legal hold preserves evidence; it does not turn Microsoft 365 Copilot into an eDiscovery search tool or grant users access to preserved copies. When a file or mailbox is subject to a hold or retention policy, separate two questions: can the user access the current working content, and can an authorized investigator search the preserved records?
Do not remove a hold, broaden mailbox permissions or copy preserved material into an ordinary library just to obtain a Copilot answer. The case owner and compliance administrator should control evidence access.
Understand Working Content and Preserved Copies
Retention is not always an editing lock. Depending on the policy and content type, a user may still edit or delete the working item while Microsoft 365 preserves a compliance copy. Record labels and other restrictions can impose different behavior. A retention period and an eDiscovery hold can also overlap; do not infer the final deletion date from one setting alone.
For SharePoint and OneDrive, Microsoft’s retention documentation distinguishes ordinary content from the hidden Preservation Hold library. That library is not designed for interactive use. Microsoft directs discovery work to eDiscovery and warns against modifying, deleting or moving its retained files.
For Exchange, an authorized reviewer must check the actual mailbox hold configuration, its scope and any applicable duration. A mailbox on hold is not necessarily a mailbox that every investigator, delegate or Copilot experience can search.
Preservation and authorization are independent. A hold does not give another employee new reading rights. Conversely, a user being able to open a live item does not guarantee that Copilot will retrieve it or reproduce every version.
Choose the Right Route for the Question
- A question about a current business document: verify that the intended user can open that exact working document through the approved app. Check that the specific Copilot feature supports that source. Test with an approved nonsensitive document first, and inspect citations.
- A request for deleted items, older versions or held evidence: ask the authorized eDiscovery team to search the appropriate locations and dates. Do not use a conversational answer as evidence that the search was exhaustive.
- A request for what someone asked Copilot: use the separate Copilot interaction search workflow. The prompt and response records are not the same objects as the original files mentioned in an answer.
For each legal request, record the custodian, source location, requested time range, relevant hold and authorized reviewer. These details let the case owner select the right collection scope without sharing more information than necessary.
There is no general Copilot “held content” switch that makes the hidden preservation store available for ordinary grounding. Nor should you assume that adding Full Access or Reviewer permissions makes a particular Copilot mailbox feature supported. Use the product’s documented source support and the organization’s approved access process.
Troubleshoot Missing Content Without Changing the Hold
First decide what is missing. If a live document does not open directly, ask its owner to investigate the existing permission or availability issue. If it opens but Copilot does not use it, try an explicitly selected supported source and check the answer’s citations. Do not treat a missing answer as proof that the retained evidence has been lost.
If an eDiscovery search does not locate an expected record, the case administrator should review the correct custodian and location, search conditions, processing status and hold timing. Preserve the unsuccessful search and its settings as investigation evidence. There is no verified universal 24-hour indexing promise after applying a hold.
Copilot conversation retention needs its own review: Microsoft’s Copilot retention guidance explains how retained interaction records differ from the history visible to the user. A conversation disappearing from the app does not establish that every compliance copy has been deleted.
The safe outcome is a verified working-content answer or an authorized evidence collection, depending on the request. Neither requires weakening the legal hold or opening an entire mailbox to additional users.