MS Purview - how to add hold on to users who has left the organisation

Hi Krishanu Deb Roy,

Thank you for your detailed question — I completely understand the challenge you’re facing when trying to place holds on users who have already been deleted.

Based on how Microsoft Purview works today, the behavior you’re seeing is expected, and I’ll summarize the key points along with the available options:
Why you’re unable to place a hold on deleted users

In Microsoft Purview, eDiscovery holds can only be applied to existing data sources, such as active mailboxes, inactive mailboxes, or associated OneDrive/SharePoint locations.

When a user is deleted:

• Their mailbox is retained for up to 30 days (soft-delete period) and can still be restored.

After this period, if no hold or retention policy was applied beforehand, the mailbox and its data are permanently deleted and cannot be targeted by eDiscovery.

Best practice (what should be done before deletion)

To preserve user data for legal or compliance purposes, Microsoft recommends:

• Apply a Litigation Hold, eDiscovery hold, or retention policy before deleting the user
• This ensures the mailbox is converted into an inactive mailbox, which remains searchable and can be included in eDiscovery cases later
  What you can do now (possible recovery options)

Depending on the current state, here are your options:

1. If the user was deleted within 30 days
   • Restore the user from Azure AD
   • Re-enable the mailbox
   • Apply the required hold
   • Then delete again (to convert it into an inactive mailbox)
2. If retention policies were already applied
   • The mailbox should already be preserved as an inactive mailbox
   • You can include it in eDiscovery searches or exports
3. If no hold/policy existed and the 30-day window has passed

Unfortunately, the data is permanently deleted and cannot be recovered or placed on hold

For OneDrive / SharePoint / Teams data

Instead of relying on per-user holds, Microsoft recommends using Purview retention policies:

• These can apply to all users or locations

They ensure content is preserved even after a user account is deleted

once a mailbox is permanently deleted without a prior hold or retention policy, it cannot be placed on hold or recovered unless it’s still within the restore window or preserved earlier.

Microsoft Reference Links:

Place a hold or export former employee data https://learn.microsoft.com/microsoft-365/admin/add-users/remove-former-employee-step-2?view=o365-worldwide#place-hold-or-export-users-data-to-a-pst-file

Manage inactive mailboxes in Exchange Online https://learn.microsoft.com/microsoft-365/compliance/create-and-manage-inactive-mailboxes

eDiscovery (Premium) overview in Microsoft Purview https://learn.microsoft.com/purview/ediscovery/overview

Create and manage retention policies (Microsoft Purview) https://learn.microsoft.com/microsoft-365/compliance/create-retention-policies

Microsoft Purview compliance / retention overview https://learn.microsoft.com/microsoft-365/enterprise/essentials-compliance

Restore a deleted user in Microsoft 365 https://learn.microsoft.com/microsoft-365/admin/add-users/restore-user

Export search results (eDiscovery export to PST) https://learn.microsoft.com/microsoft-365/compliance/export-search-results

Hope this helps. If you have any follow-up questions, please let me know. I would be happy to help.
Please do not forget to "Accept Answer" and "up-vote" wherever the information provided helps you, as this can be beneficial to other community members.

You cannot, a user object (and its associated resource such as mailbox, OneDrive and so on) must exist in order to apply a hold to it. You can remove the user after the hold is added, but it must exists at the time you first apply it.