An in-place hold takes a snapshot of the site content at the time the hold is applied and preserves later additions, changes, and deletions in the Preservation Hold Library. Users can keep working normally, but the preserved copy remains discoverable for the case. This supports legal review while maintaining a record of the content as it existed over time.
What an in-place hold changes in SharePoint
An in-place hold preserves the content state needed for a legal matter without freezing the site. Users can continue editing, adding, and deleting content, but the held copy remains available for discovery. The practical effect is that the working site stays live while SharePoint keeps a defensible preservation record of what existed over time.
That distinction matters because legal hold is about preservation, not operational shutdown. The live site remains the place users interact with, while the hold creates a protected history layer that captures content as it changes. For case teams, that means the evidence set can reflect both the current state and prior versions tied to the hold period.
On SharePoint, the preservation layer is designed to retain items that would otherwise be changed or removed. The preserved material is kept separately from normal user workflow, so a user’s day-to-day activity does not break the hold. This is what makes the control useful in litigation, investigations, and regulatory matters where continuity of access and evidentiary completeness both matter.
What gets preserved and why the Preservation Hold Library matters
When content falls under hold, later additions, modifications, and deletions are captured in the Preservation Hold Library. That means the hold does not just protect the document or page as it existed at the moment of placement, it also records the evolution of that content afterward. The result is a timeline that can support review of both the original and the changed material.
For practitioners, the important point is that deletion does not necessarily remove held content from the preservation record. A user may believe something has been removed from the site, yet the held copy can still remain available for the matter. That is why legal teams, records teams, and SharePoint administrators need a shared understanding of what the hold is expected to retain.
This preservation approach also reduces the need to suspend collaboration. Users can keep working, but the hold creates a separate record that can be searched and reviewed later. In practical terms, that is what makes an in-place hold different from a simple archive or a manual export taken once at the start of the matter.
Operational impact on users, administrators, and case review
From a user perspective, an in-place hold should be largely transparent. Normal editing, publishing, and deletion behavior continues, which is important for business continuity. From an administrative perspective, the hold introduces an evidentiary requirement: teams must be able to explain which content was preserved, when the hold was applied, and how the preserved copy relates to the working site.
For legal review, the practical value is discoverability. The preserved material provides a reliable source for review, even when the live site has changed since the matter began. That makes the hold a governance control as much as a technical one, because its value depends on both proper activation and defensible handling during the matter lifecycle.
If the organization expects the hold to support formal discovery, the process must be consistent across site owners, records staff, and case managers. The control works best when there is a clear chain from matter initiation to content identification, hold placement, and review access. Without that chain, the preserved data may still exist, but the organization can struggle to explain or produce it efficiently.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-10 — Non-repudiation | Legal holds need defensible preservation and traceability of content changes. |
| AU-9 — Protection of Audit Information | Held content must remain protected from unauthorized alteration or loss during discovery. | |
| Recommendation — Preserve audit evidence showing what content changed and when the hold captured it. Protect preserved hold data from unauthorized modification or deletion. | ||
| ISO/IEC 27001:2022 | A.5.33 — Protection of Records | An in-place hold is a records-preservation control for legal and regulatory matters. |
| A.8.15 — Logging | The hold process depends on evidence of content changes and preservation events. | |
| Recommendation — Apply records protection requirements to held SharePoint content and its retention. Log hold placement and content preservation events for later review. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Held content and preservation actions require reviewable records for legal discovery. |
| Recommendation — Centralize and retain logs for hold placement and content changes. | ||
Practitioner Guidance
What to verify: Confirm that the hold scope matches the site, library, or content set actually relevant to the matter, and verify that the Preservation Hold Library is being populated as expected after edits and deletions. If the matter involves active collaboration, check that the preserved content remains discoverable without disrupting users.
What good looks like: The live SharePoint site keeps operating, while the case team can still retrieve a credible historical record of content changes made during the hold period. The best outcome is a hold that is administratively visible, legally defensible, and operationally low-friction.
Practitioner takeaway: Treat an in-place hold as a preservation layer over an active site, not as a freeze. The key test is whether the organization can still review a defensible content history after normal user activity has continued.
