Microsoft Preservation and Emergency Requests: Police Template

Microsoft is more reserved than some platforms about how it handles preservation and emergency requests in public. It publishes a law enforcement portal and a short but specific rule for emergency requests, but its public pages we could read do not describe a preservation procedure. This guide says exactly what Microsoft publishes, what the federal statute adds, and gives you templates built on those two sources, with the gaps marked. For the full process for obtaining Outlook and Microsoft account records, see our Microsoft law enforcement data request guide.

Who can use these routes

The portal's own landing page says it is only for authorised law enforcement officials who wish to submit lawful orders seeking the production of evidence in connection with an official investigation, and that Microsoft evaluates each request case by case. Users confirm they are an authorised law enforcement official or government employee, or have been granted access by Microsoft. The address currently forwards to v2.leportal.microsoft.com, which shows the same page.

The portal's "Login Troubles?" panel explains account set-up: you first create a non-government Microsoft account (for example an Outlook or Hotmail account) as a secondary form of verification, then verify it during registration by providing an official government email address; the Microsoft account is the sign-in credential and the verified government address represents your portal account. For login problems only, the panel lists support aliases by region (United States: [email protected]; EU Member States: [email protected]; Brazil: [email protected]; other countries: [email protected]) and a phone number, +1 425-722-1299, option 2. Microsoft presents these as login support contacts, not as routes for submitting requests. If you are a victim, you cannot use the portal; report the crime to police through the cybercrime help hub for your country.

Preservation requests: what Microsoft publishes

Microsoft's law enforcement requests report FAQ says all law enforcement requests arrive through the secure portal, and that data Microsoft decides to provide is returned through the same portal. Its report also notes that Microsoft receives various forms of legal requests from UK authorities, including preservation requests. Beyond that, the pages we read do not say:

• how a preservation request is submitted or labelled inside the portal;
• which identifiers it accepts (Microsoft account email address, phone number and so on);
• how long Microsoft keeps preserved data, or whether it can be extended;
• whether the account holder is told about a preservation.

Treat the options inside your portal account as the authority on these points. Do not assume Microsoft follows any other company's period.

What the statute says: 90 days, renewable once

Under 18 U.S.C. § 2703(f)(1), a provider of electronic communication or remote computing service, "upon the request of a governmental entity, shall take all necessary steps to preserve records and other evidence in its possession pending the issuance of a court order or other process." Under § 2703(f)(2), the records "shall be retained for a period of 90 days, which shall be extended for an additional 90-day period upon a renewed request by the governmental entity." This is the statute's rule, not a Microsoft statement, and the wording is unchanged in the US Code as published by the Office of the Law Revision Counsel, current through Public Law 119-124 (15 October 2026); neither § 2702 nor § 2703 has been amended since 2018. Diarise the end date and renew in time.

The account type and location matter. Microsoft's report FAQ says it requires a subpoena or its equivalent before disclosing non-content and discloses content only in response to a warrant (or its local equivalent), that services in the European Union are provided by Microsoft Ireland Operations Limited, incorporated in Ireland, and that when a request seeks data from an enterprise customer (commercial, government or educational), it always attempts to redirect law enforcement to obtain the information directly from that customer.

Emergency requests: what Microsoft publishes

Microsoft says it considers emergency requests from law enforcement agencies around the world when a disclosure is necessary to prevent an emergency involving danger of death or serious physical injury to a person. Its stated requirements:

• the request must be in writing, on official letterhead, and signed by a law enforcement authority;
• it must contain a description of the emergency;
• it must explain how the information sought will assist law enforcement in addressing the emergency.

Microsoft says each request is evaluated by its compliance team before data is disclosed, and that disclosure is limited to the data it believes would enable law enforcement to address the emergency. It names suicide threats, kidnappings and other threats of imminent violence as among the most common emergency requests, and says it does not charge for compliance in emergency situations. It makes no promise of response time.

The statute behind the exception is 18 U.S.C. § 2702(b)(8) (contents) and § 2702(c)(4) (customer records): a provider may disclose to a governmental entity "if the provider, in good faith, believes that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay." The text is permissive.

Notice. Microsoft says it gives prior notice to users whose data is sought, except where prohibited by law, and may withhold notice in exceptional circumstances, such as emergencies where notice could endanger an identifiable person or group (for example child exploitation investigations) or where it would be counterproductive (for example a hacked account). It gives delayed notice after a valid non-disclosure order expires, unless an exceptional circumstance remains present. It does not say whether a preservation request alone triggers notice.

Where to send it: Microsoft's FAQ says all law enforcement requests arrive through the secure portal. It publishes no separate emergency form, email address or phone line, and we have not printed any. The login support contacts listed by the portal are for access problems only.

Template: preservation request

Microsoft publishes no preservation format, so this template follows the statute only. Adapt to your agency's format and the fields the portal asks for; not legal advice.

[AGENCY NAME]
[AGENCY ADDRESS]
Date: [DATE]

To: Microsoft Corporation (submitted through the Law Enforcement Request Portal)
Subject: Request to preserve records, 18 U.S.C. section 2703(f)

Agency case number: [CASE NUMBER]
Requesting officer: [NAME, TITLE/RANK], [OFFICIAL EMAIL], [OFFICE PHONE]

Account identifier: [FULL MICROSOFT ACCOUNT OR OUTLOOK EMAIL ADDRESS]
Other identifiers held: [PHONE NUMBER / NONE]

Pursuant to 18 U.S.C. section 2703(f), this agency requests that you take all necessary steps to preserve records and other evidence in your possession relating to the account above, including [SUBSCRIBER INFORMATION / SIGN-IN AND IP RECORDS / MAIL HEADER RECORDS / STORED CONTENT], for the period [START DATE] to [END DATE], pending the issuance of legal process.

Legal process to follow: [SEARCH WARRANT / COURT ORDER / SUBPOENA], expected [DATE].
Non-disclosure order: [ATTACHED, REFERENCE ____ / NONE]

Please confirm receipt and the preservation period to [OFFICIAL EMAIL].
[NAME, TITLE/RANK]

Template: emergency request

This template is written to Microsoft's three published requirements. Print it on official letterhead and have a law enforcement authority sign it. Adapt to your agency's format; not legal advice.

[OFFICIAL AGENCY LETTERHEAD]
Date and time: [DATE, TIME, TIME ZONE]

To: Microsoft Corporation (submitted through the Law Enforcement Request Portal)
Subject: Emergency request for disclosure, 18 U.S.C. sections 2702(b)(8) and 2702(c)(4)
Agency case number: [CASE NUMBER]

Description of the emergency: [DANGER OF DEATH OR SERIOUS PHYSICAL INJURY TO WHOM, WHAT HAS HAPPENED, WHEN YOU BECAME AWARE, AND WHY DISCLOSURE IS NEEDED WITHOUT DELAY]

How the information will assist: [HOW THE DATA WILL HELP LOCATE, IDENTIFY OR PROTECT THE PERSON]

Account identifier: [FULL MICROSOFT ACCOUNT OR OUTLOOK EMAIL ADDRESS / OTHER IDENTIFIER]
Information requested (limited to what addresses the emergency): [E.G. RECENT SIGN-IN IP ADDRESSES AND TIMESTAMPS / SUBSCRIBER INFORMATION]

Legal basis: 18 U.S.C. sections 2702(b)(8) and 2702(c)(4). Formal legal process will follow: [WARRANT/ORDER, EXPECTED DATE].

Contact: [NAME, TITLE/RANK], [OFFICIAL EMAIL], [OFFICE PHONE], [MOBILE PHONE]

Signed: [NAME, TITLE/RANK OF SIGNING LAW ENFORCEMENT AUTHORITY]

Common mistakes

• Sending an unsigned or plain-text emergency request. Microsoft requires writing, official letterhead and a law enforcement authority's signature.
• Omitting the explanation. Microsoft asks for both a description of the emergency and how the information will assist.
• Asking for more than the emergency needs. Microsoft says disclosure is limited to the data it believes would address the emergency.
• Targeting enterprise accounts at Microsoft. For commercial, educational or government customers Microsoft says it attempts to redirect law enforcement to the customer.
• Assuming a preservation period. Microsoft publishes none; rely on the statute and your portal account, and renew before 90 days end.

Related

• Microsoft law enforcement data request guide (full process for records)
• Overview of platform law enforcement request guides
• Police data-request directory and the US investigator handbook

Sources

• Microsoft Law Enforcement Request Portal
• Microsoft: Government Requests for Customer Data Report (FAQ)
• 18 U.S.C. § 2703 (GovInfo, 2024 edition) and § 2702; current text: US Code, Office of the Law Revision Counsel (current through Public Law 119-124)

For other platforms see the police data-request directory, and if you are a victim rather than an investigator, start with the country-by-country cybercrime help hub. This guide summarises public sources as read on 24 October 2026; the portal may carry instructions visible only to registered users, so confirm current requirements there. It is not legal advice.