Litigation Hold & Retention Coverage

The question it answers: Which mailboxes and locations are covered by no retention policy and no hold?

If a mailbox is covered by no retention policy and no hold, a user can delete mail and it is gone for good after the recoverable-items window - including evidence. Mailboxes that nothing retains are listed first, together with whole locations (all sites, all OneDrives, all group mailboxes) no org-wide policy covers.

Note

An org-wide policy does not apply to mailboxes it explicitly excludes (-mbx entries in InPlaceHolds). Retention labels users apply by hand are not counted. The MRM retention policy column is Exchange’s older archive/delete policy and does not retain anything by itself.

At a glance

Where in the app	Tenant › Compliance & Audit › Retention & Hold Coverage
Workload	Compliance
Kind	Table · dashboard tile
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	Microsoft 365 E3 or higher (retention policies); litigation hold needs Exchange Online Plan 2 or an archiving add-on.
Report id (API and MCP)	tenant.compliance.retention-coverage

Columns

Column	Key	Type
Mailbox / location	DisplayName	Text
Retained	Covered	Status
Covered by	CoveredBy	Text
Type	MailboxType	Text
Litigation hold	LitigationHold	YesNo
Other holds	OtherHolds	Text
MRM policy	MrmPolicy	Text
Address	Address	Text

Filters

Filter	Key (API)	On when the page opens
Only what nothing retains	not-retained	Yes

What it needs

Licence: Microsoft 365 E3 or higher (retention policies); litigation hold needs Exchange Online Plan 2 or an archiving add-on.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Exchange.ManageAsApp	Office 365 Exchange Online	Manage Exchange As Application

Roles and other setup:

• Purview role for the app: Compliance Administrator (or a view-only compliance role)

Data sources it reads

• Connect-IPPSSession (prefix Cc)
• Get-RetentionCompliancePolicy -DistributionDetail
• Get-EXOMailbox (LitigationHoldEnabled, InPlaceHolds, RetentionPolicy)

Through the API and MCP

GET /ir-api/v1/reports/tenant.compliance.retention-coverage?size=100
GET /ir-api/v1/reports/tenant.compliance.retention-coverage?filter=not-retained

An AI assistant reads it with the MCP tool get_report and the id tenant.compliance.retention-coverage. The client needs the Read grant for Compliance. See Using the API.