eDiscovery

During the course of business, organizations may find themselves having to produce records for litigation. These requests are frequently referred to as discovery, and the production of electronic records is commonly referred to as eDiscovery.

The Microsoft 365 platform includes two levels of eDiscovery capabilities—Standard, based on keywords and phrases and document properties, and Premium, with advanced case management capabilities. Both eDiscovery products utilize a container object called a case, which is used to organize various activities and artifacts related to the particular discovery matter.

Standard eDiscovery

The Standard eDiscovery product (previously called Core eDiscovery) is comprised of holds, searches, and exports.

Searches are exactly what they sound like—an activity used to locate content in the Microsoft 365 tenant. You can perform a search across workloads in Microsoft 365 such as Exchange mailboxes and public folders; Teams, SharePoint, and OneDrive for Business sites; and Viva Engage (previously Yammer).

When working with searches, you can create queries to help identify content. You can build simple queries that only utilize keywords. You can also build complex queries that include content types (such as contacts, calendar items, email messages, or documents), date ranges, message recipients, and a broad variety of item properties, as shown in Figure 10.15:

Figure 10.15 – Defining search conditions for an eDiscovery search

You can also use an eDiscovery case to put content on hold—that is, to preserve it from deletion. Creating a hold follows a similar process as creating a search. The only real difference is that instead of just identifying content, the hold will institute a retention action against the content.

Tip

Content placed on hold in an eDiscovery case supersedes any deletion activities in the tenant— even if the content is under a retention policy with a delete action.

After you have located content as part of an eDiscovery case search, you may need to produce the results for someone such as a legal team member. This process is calledexport. You can export the results of searches to flat files as well as PST archive files (for email messages).