How Exchange SubstrateHolds Retains Deleted Teams Messages for eDiscovery

When an employee clicks the delete option on a Microsoft Teams message, the text vanishes from their screen in under 1 second, leaving no trace in the chat window. However, the data itself is not erased from the corporate network. Instead, the message enters a hidden compliance pipeline governed by Exchange Online, remaining fully accessible to administrators.

This architectural disconnect means that the visual feedback provided by the Teams application does not reflect the actual lifecycle of the underlying data. Corporate compliance officers and legal teams routinely use Microsoft Purview eDiscovery to retrieve these supposedly deleted conversations. The mechanism relies on a hidden backend directory known as the SubstrateHolds folder.

As remote work has cemented chat platforms as the primary venue for corporate communication, understanding this retention architecture has become critical for both employees and employers. The assumption of ephemeral messaging often clashes with strict regulatory requirements that mandate the preservation of business records.

Microsoft designed this system specifically to prevent the destruction of evidence during internal investigations or external lawsuits. "Messages visible in the Teams app are not an accurate reflection of whether they're retained or permanently deleted for compliance requirements," Microsoft's 2024 technical documentation states explicitly.[1]

To comprehend how a deleted message survives, one must look past the Teams application itself. Microsoft Teams operates primarily as a user interface shell that pulls information from various Microsoft 365 services, rather than functioning as a standalone, self-contained database.

The Dual-Storage Architecture of Teams

Every time a user sends a message in Teams, the system writes the data to 2 separate locations simultaneously. The primary operational copy goes to an Azure-powered chat service, which delivers the real-time messaging experience and synchronizes the chat history across desktop and mobile devices.

Simultaneously, a compliance copy is journaled into Exchange Online. For direct 1:1 or group chats, this copy is deposited into a hidden folder within the individual user's Exchange mailbox. For channel messages, the data routes to a hidden folder inside the overarching Microsoft 365 Group mailbox.

"The original copy of the Teams message is preserved in a hidden folder in Exchange Online, called the SubstrateHolds folder," explains SysCloud, a cloud backup provider, in their 2024 technical breakdown. This dual-storage approach ensures that 100 percent of the compliance record remains isolated from the user's direct control.

Because the compliance copy lives in Exchange Online, it is governed by Exchange retention policies rather than the Azure chat service. When a user deletes a message, the Azure service removes it from the active interface, but the Exchange backend follows a completely different set of rules.

This separation of powers is what allows IT departments to maintain immutable records without cluttering the daily user experience. The employee sees a clean, curated chat history, while the organization retains a comprehensive, unalterable ledger of every keystroke transmitted across the network.

The 21-Day Hidden Purgatory

The journey of a deleted message involves a highly specific, 3-stage timeline that delays permanent erasure. When a user deletes a message, it does not immediately drop into the final SubstrateHolds folder. Instead, it enters a hidden holding state for exactly 21 days.[1]

During this 21-day window, the message remains invisible to the user but is fully indexed and searchable by compliance administrators using eDiscovery tools. This built-in delay acts as a universal buffer, capturing accidental deletions and ensuring that short-term data destruction attempts fail.[3]

Only after the 21-day purgatory expires does the system physically move the data into the SubstrateHolds directory. This folder sits within the Recoverable Items structure of Exchange Online, a secure partition designed specifically to house soft-deleted data out of the user's reach.

Once inside SubstrateHolds, the message must remain there for a mandatory minimum of 1 day. This hardcoded requirement ensures that backend synchronization processes have adequate time to log the item's status before any permanent purge operations can be initiated.[1]

Finally, an automated Exchange timer job is responsible for permanently deleting expired items from SubstrateHolds. However, this timer job does not run continuously; Microsoft notes that it typically takes between 1 and 7 days to execute its sweep of the hidden folders.[1]

How SubstrateHolds Captures the Record

By combining these backend delays, the actual lifespan of a deleted message becomes clear. The 21-day initial hold, plus the 1-day minimum, plus the 1-to-7-day timer job window, means a deleted message survives for a minimum of 23 to 29 days.

Crucially, this 23-to-29-day survival period applies even in Microsoft 365 environments that have no explicit retention policies configured. The baseline architecture inherently preserves deleted communications for nearly a month, directly contradicting the immediate erasure implied by the user interface.

If an organization actively configures a retention policy—which typically takes 48 hours to propagate across the tenant—this timeline extends dramatically. A standard corporate policy might mandate that all Teams chats be retained for 3 years to comply with financial regulations or data privacy frameworks like the GDPR.[2]

Under a 3-year retention policy, the timer job is explicitly instructed to ignore the deleted message until the full 1,095 days have passed. The user's deletion command simply hides the message from their own view, while the SubstrateHolds folder securely archives it for the next 3 years.

The system applies the exact same logic to edited messages. When an employee alters a sent message, the original text is instantly copied to the SubstrateHolds folder before the new text overrides the active chat. The application displays an "Edited" tag, but the backend retains the complete version history.[1]

Microsoft Purview and the eDiscovery Process

To access this hidden trove of data, corporate investigators do not log into the Teams application or ask for the employee's password. Instead, they utilize Microsoft Purview eDiscovery, a centralized compliance dashboard available to administrators with specific security clearances.

Purview allows an investigator to cast a wide net across the entire Microsoft 365 ecosystem. By entering specific keywords, date ranges, or user identities, the administrator queries the Exchange SubstrateHolds folders directly, bypassing the Azure chat service entirely.[1]

The search results display the full context of the conversation, clearly marking which messages were deleted or edited, along with the original timestamps down to the millisecond. This capability is frequently deployed during human resources investigations, intellectual property disputes, or routine compliance audits.

Accessing eDiscovery is not a casual process. Microsoft requires administrators to possess specific roles, such as the eDiscovery Manager or Compliance Administrator designation, to run these searches. Furthermore, every search query executed in Purview generates its own un-erasable audit log.

This strict auditing ensures that IT staff cannot quietly spy on employee conversations without leaving a digital footprint. The system is designed for formal, legally defensible investigations rather than routine managerial surveillance.

The Impact of Litigation Holds

The most powerful tool in the compliance administrator's arsenal is the Litigation Hold. When an organization anticipates legal action, they are legally obligated to halt all routine data destruction processes to preserve potential evidence.

Applying a Litigation Hold to a user's mailbox instantly suspends the Exchange timer job for that specific account. Any messages currently sitting in the SubstrateHolds folder, as well as any future messages the user attempts to delete, are frozen in place indefinitely.[1][2]

Employees are not notified when their account is placed under a Litigation Hold. The Teams interface continues to function normally, allowing them to delete and edit messages, completely unaware that the backend purge mechanisms have been disabled.

Courts globally recognize Microsoft Teams data as mandatory discoverable material. Failing to produce these hidden records during a lawsuit can result in severe judicial penalties for evidence spoliation, making the SubstrateHolds architecture a critical liability shield for large enterprises.

Ultimately, the architecture of Microsoft Teams reflects a fundamental shift in workplace technology. The platform prioritizes institutional memory and legal defensibility over individual data control, ensuring that the corporate record remains intact regardless of what disappears from the screen.