Planning For, Conducting, and Managing eDiscovery Cases

Organizations may often be required to respond to legal investigations to locate and export data contained in their Microsoft 365 environment. The eDiscovery and Content search tools provide you with these capabilities. This chapter will explain the principles of Content search and eDiscovery in Microsoft Purview. We will learn the differences between eDiscovery (Standard) and eDiscovery (Premium) and when to use them. We will also examine how to plan for content searches and eDiscovery cases and how to delegate permissions to use search and discovery tools. Additionally, we will learn how to use these tools to discover data and respond to investigations and how to manage your eDiscovery cases.

After reading this chapter, you will know about the tools available to you in Microsoft 365 for search and discovery and the scenarios in which you need to use them.

These topics will be covered in the following order:

• Recommending...

Recommending eDiscovery (Standard) or eDiscovery (Premium)

eDiscovery is a feature within Microsoft Purview that allows you to identify and provide information pertaining to any legal cases or internal investigations that may be in progress within your organization. Compliance administrators can set controls for who can create and manage eDiscovery cases in your environment to search for content within the following Microsoft 365 locations:

• Exchange Online
• OneDrive for Business
• SharePoint Online
• Microsoft Teams
• Microsoft 365 Groups
• Yammer

If your organization is just beginning its journey into using search and discovery tools, it is important to know about the ones that are available and which of those are suitable for your needs.

Within Microsoft Purview, the following three solutions fall under the category of eDiscovery: Content search, eDiscovery (Standard), and eDiscovery (Premium). Which of these solutions you will use will be based on your...

Planning for content searches and eDiscovery

The first step is to consider the reasons that your organization needs to respond to a legal case and who is involved. Examples of those who may need to be involved in a case include (but are not limited to) the following:

• Executives
• Employees
• Legal teams
• Compliance managers
• Data protection officers
• IT teams

Note that the preceding examples would by no means have the same roles within the case. Executives and employees, for instance, will more likely be the subject of the case, while the other examples may be part of the teams responsible for conducting the investigation. This does not mean that this is a clandestine process. In most cases, the subjects of investigations will be notified that their email, documents, and collaboration activity are subject to being placed on hold, meaning that their content must be retained for the duration of the investigation. An example of such a notification is the communication...

Delegating the required permissions to use search and discovery tools

Before you start using the eDiscovery cases and content hold features, it is important to assign the appropriate permissions to the users who need access to these tools. This section will demonstrate how to do this from the Microsoft Purview compliance portal by adding users to the correct role group. The role used to control access is called eDiscovery Manager. This role also contains the following two subgroups:

• eDiscovery Manager: Can only view and edit cases that the user has access to
• eDiscovery Administrator: Can view and edit all cases regardless of permissions

To assign these roles to users in your organization, you will need to be a member of the Organization Management role group. When you have the correct access, complete the following steps to assign eDiscovery permissions to the required users:

1. Log in to the Microsoft Purview compliance portal at https://compliance.microsoft...

Creating eDiscovery cases

In this section, you will learn how to use eDiscovery (Premium) to set up a case that will allow you to perform search and investigation tasks to discover and respond to internal investigations and legal cases.

To configure an eDiscovery (Premium) case in Microsoft Purview, you must complete the following steps:

1. Log in to the Microsoft Purview compliance portal at https://compliance.microsoft.com and navigate to eDiscovery | Premium from the left menu pane:

Figure 15.6: eDiscovery menu pane in Microsoft Purview

You will see any existing eDiscovery (Premium) cases listed here (based on your role group access):

Figure 15.7: eDiscovery (Premium) case list in Microsoft Purview

2. Select Create a case, and the case creation wizard will open. You must enter a name for your case at this stage. Make sure that you give the case a descriptive name that is relevant to your investigation. You...

Managing eDiscovery cases

Now that you have created your eDiscovery (Premium) case with its base settings, you need to create the workflow for your case so it can search for content and return results for you to analyze, filter, and export. The process to follow as part of your eDiscovery (Premium) case workflow will consist of some or all of the following steps:

• Add custodians to your case
• Collect content from data sources
• Create a collection and commit the content to a review set
• Access, analyze, and filter data within your review set
• Export and download your case data

We will now go through this process step by step by opening the case we created in the previous section and setting the required features.

Adding custodians

To add custodians to your case, complete the following tasks:

1. From the Microsoft Purview compliance portal, open eDiscovery (Premium), as shown in the previous section, navigate to Cases, and click to open the case that...

Summary

This chapter introduced the principles of eDiscovery in Microsoft Purview. We learned that we need to assign the eDiscovery Manager role to any users that we want to manage eDiscovery cases and that we can then create eDiscovery cases from the Microsoft Purview compliance portal. After creating an eDiscovery case, we learned how to associate custodians (users) and other data locations with our eDiscovery case and apply holds to content in these locations. Then, we examined how to create a collection, which is a search for content against the data sources we define, and commit those search results to a review set. Finally, the chapter demonstrated that once a review set is completed and available, we can preview the results and tag, annotate, filter, and export the results so they can be presented as part of regulatory processes or legal investigations.

In the next chapter, we will explore how to plan for regulatory compliance and privacy obligations within Microsoft Purview...

Questions

1. Which of the following are not the names of eDiscovery tools in Microsoft Purview? Choose two:
   1. eDiscovery (Business)
   2. eDiscovery (Premium)
   3. eDiscovery (Basic)
   4. eDiscovery (Standard)
2. Which feature of an eDiscovery (Premium) case allows you to review, tag, annotate, and export content?
   1. Collections
   2. Holds
   3. Data sources
   4. Review sets
3. True or false? The eDiscovery Manager role group includes two subgroups called eDiscovery Managers and eDiscovery Administrators:
   1. True
   2. False
4. Which of the following roles or role groups should be used to review an eDiscovery case, using the principle of least privilege?
   1. Compliance Administrator
   2. Reviewer
   3. Organization Management
   4. Global Administrator
5. True or false? In eDiscovery (Premium) cases, it is possible to view search results in review sets in a conversational context view:
   1. True
   2. False
6. In which tab in an eDiscovery (Premium) case would you configure case information?
   1. Settings
   2. Overview
   3. Data sources
   4. Communications
7. True or false? When adding custodians...

Further reading

Please refer to the following links for more information:

• Microsoft Purview eDiscovery solutions: https://learn.microsoft.com/en-us/microsoft-365/compliance/ediscovery?WT.mc_id=M365-MVP-4039827&view=o365-worldwide
• Manage legal investigations in Microsoft 365: https://learn.microsoft.com/en-us/microsoft-365/compliance/manage-legal-investigations?WT.mc_id=M365-MVP-4039827&view=o365-worldwide
• Assign eDiscovery permissions in the compliance portal: https://learn.microsoft.com/en-us/microsoft-365/compliance/assign-ediscovery-permissions?WT.mc_id=M365-MVP-4039827&view=o365-worldwide
• Get started with eDiscovery (Standard): https://learn.microsoft.com/en-us/microsoft-365/compliance/get-started-core-ediscovery?WT.mc_id=M365-MVP-4039827&view=o365-worldwide
• Search for content in a eDiscovery (Standard) case: https://learn.microsoft.com/en-us/microsoft-365/compliance/search-for-content-in-core-ediscovery?WT.mc_id=M365-MVP-4039827&view...