How to List Every Mailbox on Litigation Hold

Litigation Hold preserves the contents of a mailbox, and it keeps doing so indefinitely unless someone set a duration. It is easy to turn on and just as easy to forget about. Then someone asks which mailboxes are on hold, and you want an answer in a minute, not an afternoon. This short script gives you that answer as a CSV.

What you need

PowerShell 7 and the ExchangeOnlineManagement module.
An account that is allowed to run Get-Mailbox in your tenant.
If you are on a machine without a web browser, such as a headless Ubuntu server, add -Device to the connect command. PowerShell prints a code, and you finish signing in from any other computer. Microsoft Learn explains the options.

The script

Connect-ExchangeOnline -ShowBanner:$false

$props = 'DisplayName', 'PrimarySmtpAddress',
         'LitigationHoldDate', 'LitigationHoldDuration'

Get-Mailbox -ResultSize Unlimited -Filter 'LitigationHoldEnabled -eq $true' |
    Select-Object $props |
    Export-Csv ./LitigationHoldUsers.csv -NoTypeInformation

Disconnect-ExchangeOnline -Confirm:$false

What it does

Connects to Exchange Online and asks for every mailbox where LitigationHoldEnabled is true. Using -Filter lets Exchange do the filtering instead of pulling every mailbox down first.
Saves the display name, email address, the date the hold was placed, and the hold duration to LitigationHoldUsers.csv. A duration of Unlimited means the hold has no end date.
Disconnects when it finishes. The script only reads data. It doesn’t change any holds.

This list is only Litigation Hold

A mailbox can also be held by an eDiscovery case or by a Microsoft Purview retention policy, and those don’t set LitigationHoldEnabled. They show up in a different property. To see every hold on one mailbox, run this:

Get-Mailbox user@contoso.com | Format-List LitigationHoldEnabled, InPlaceHolds

In the InPlaceHolds output, an ID that starts with UniH is an eDiscovery hold, and an ID that starts with mbx or skp is a retention policy. If the list is empty, an organization-wide retention policy can still apply. This command lists those:

Get-OrganizationConfig | Format-List InPlaceHolds

Microsoft Learn has the full breakdown of hold types.

A reason to run it regularly

Exchange doesn’t put new mailboxes on Litigation Hold automatically. Someone has to do it after the mailbox is created, as Microsoft notes. If your organization intends to keep certain mailboxes on hold, compare this list against your user list now and then, and you will find the ones that were missed.

A fuller version of this script is in my pwsh repository on GitHub. It adds options for the output file and device code sign-in, and it cleans up names before writing the CSV. It is free and open source under the MIT license.