You have a Microsoft 365 subscription. All users have their email stored in Microsoft Exchange Online. In the mailbox of a user named User1, you need to preserve a copy of all the email messages…

Question

Options

• AFrom the Security & Compliance admin center, create an eDiscovery case.
• BFrom the Exchange admin center, create a mail now rule.
• CFrom the Security & Compliance admin center, start a message trace.
• DFrom Microsoft Defender for Cloud Apps, create an access policy.

• A
  78% (28)
• B
  3% (1)
• C
  14% (5)
• D
  6% (2)

Explanation

Creating an eDiscovery case in the Security & Compliance admin center is the correct approach. Within an eDiscovery case, you can define a hold with a keyword query (e.g., 'ProjectX') scoped to User1's mailbox. This query-based hold preserves only the items matching the keyword, ensuring copies are retained in the Recoverable Items folder even if the user deletes them. This is precisely the mechanism designed for preservation of specific content. Why the others are wrong: A mail flow rule (B) can redirect or copy incoming messages but does not retroactively preserve existing messages or reliably handle all scenarios. A message trace (C) shows delivery metadata for troubleshooting, not content preservation. A Defender for Cloud Apps access policy (D) controls access to cloud apps and is unrelated to email preservation.

No community discussion yet for this question.