Споделяне чрез

Add custodians to an eDiscovery (Premium) case

  • Статия

Tip

eDiscovery (preview) is now available in the new Microsoft Purview portal. To learn more about using the new eDiscovery experience, see Learn about eDiscovery (preview).

Use the built-in custodian management tool in Microsoft Purview eDiscovery (Premium) to coordinate your workflows around managing custodians and identifying relevant, custodial data sources associated with a case. When you add a custodian, the system can automatically identify and place a hold on their Exchange mailbox and OneDrive for Business account. During the discovery process of your investigation, you might also identify other data sources (such as mailboxes, sites, or Teams) that a custodian accessed or contributed to. In this situation, you can use the custodian management tool to associate those data sources will a specific custodian. After you add custodians to a case and associate other data source with them, you can quickly preserve data and search the custodial data.

You can add and manage custodians in eDiscovery (Premium) cases in four steps:

  1. Identify the custodians.
  2. Choose custodian data locations.
  3. Configure hold settings.
  4. Review the custodians and complete the process.

Tip

If you're not an E5 customer, use the 90-day Microsoft Purview solutions trial to explore how additional Purview capabilities can help your organization manage data security and compliance needs. Start now at the Microsoft Purview compliance portal trials hub. Learn details about signing up and trial terms.

Make sure you have the necessary permissions

To add custodians to a case, you must be a member of the eDiscovery Manager role group. This provides you with the necessary permissions to add custodians to a case and place a hold on the custodial data sources. For more information, see Assign eDiscovery permissions.

Step 1: Identify custodians

Note

For a limited time, this classic eDiscovery experience is also available in the new Microsoft Purview portal. Enable Compliance portal classic eDiscovery experience in eDiscovery (preview) experience settings to display the classic experience in the new Microsoft Purview portal.

  1. Go to https://compliance.microsoft.com and sign in with a user account that has been assigned the appropriate eDiscovery permissions.
  2. In the left navigation pane, select eDiscovery > eDiscovery (Premium), and select the Cases tab.
  3. Select the case that you want to add custodians to.
  4. Select the Data sources tab, and then select Add data source > Add new custodians.
  5. Add one or more users in your organization as custodians to the case by typing the first part of a person's name or alias. Both active and inactive users are searched. After you find the correct person, select their name to add them to the list.

Step 2: Choose custodian data locations

After you select custodians, the system automatically attempts to identify and verify these users and their data sources. After adding custodians to the list, the tool automatically includes the primary mailbox and OneDrive account for each active user that has been added as a custodian. If the user is inactive, the tool will only identify the primary mailbox. You can choose not to include these data sources when adding custodians to the case.

In addition to a custodian's mailbox and OneDrive account, you can also associate other data locations to a custodian, such as SharePoint site or a Microsoft Team the custodian is a member of. This allows you to preserve, collect, analyze, and review content in other data sources associated with the custodians of the case.

To deselect the primary mailbox and OneDrive account for a custodian:

Note

For a limited time, this classic eDiscovery experience is also available in the new Microsoft Purview portal. Enable Compliance portal classic eDiscovery experience in eDiscovery (preview) experience settings to display the classic experience in the new Microsoft Purview portal.

  1. Expand the custodian to view the primary data locations that have been automatically associated to each custodian.

  2. Select Clear next to Mailbox or OneDrive to remove a custodian's mailbox or OneDrive account from being associated as a data location for this custodian.

    Configure locations to associate to a custodian.

To associate other mailboxes, sites, Teams, or Viva Engage groups to a specific custodian:

  1. Expand a custodian to display the following services to associate data locations with the custodian. Select Edit next to a service to add a data location.

    • Exchange: Use to associate other mailboxes to the custodian. Type into the search box the name or alias (a minimum of three characters) of user mailboxes or distribution groups. Select the mailboxes to assign to the custodian and then select Add.
    • SharePoint: Use to associate SharePoint sites to the custodian. Select a site in the list or search for a site by typing a URL in the search box. Select the sites to assign to the custodian and then select Add. If a user is inactive, their OneDrive site will need to be added as an additional SharePoint location here.
    • Teams: Use to assign the Microsoft Teams the custodian is currently a member of. Select the teams to assign to the custodian and then select Add. After you add a team, the system automatically identifies and locates the SharePoint site and group mailbox associated to that team and assigns them to the custodian.
    • Viva Engage: Use to assign the Viva Engage groups the custodian is currently a member of. Select the groups to assign to the custodian and then select Add. After you add a team, the system automatically identifies and locates the SharePoint site and group mailbox associated to that group and assigns them to the custodian.

    Note

    You can use the Exchange and SharePoint location pickers to associate any mailbox or site in your organization to a custodian. , This includes associating the mailbox and site for a Microsoft Team or Viva Engage group that a custodian is not a member of. To do this, you have to add both the mailbox and site associated with each team or Viva Engage group.

  2. You can view the total number of mailboxes, sites, Teams, and Viva Engage groups assigned to each custodian by expanding each custodian in the table. When you've finalized the assigned data locations for each custodian, these associations will be maintained and used during the collection, processing, and review stages in the eDiscovery (Premium) workflow.

  3. After adding custodians and configuring their data locations, select Next to go to the Hold settings page.

Step 3: Configure hold settings

After you've finalized the custodians and their data locations, you can place some or all of the custodians on hold. When you place a custodian on hold, all content in all content locations that are associated with the custodian is preserved until you remove the hold or release the custodian from the hold. In some cases, you may want to add custodians to a case without placing them on hold. For more information about managing holds, see Manage holds in eDiscovery (Premium).

To place the custodians and data sources on hold:

Note

For a limited time, this classic eDiscovery experience is also available in the new Microsoft Purview portal. Enable Compliance portal classic eDiscovery experience in eDiscovery (preview) experience settings to display the classic experience in the new Microsoft Purview portal.

  1. On the Hold settings page, you can apply a hold to individual custodians by selecting the checkbox under the Hold column. Alternatively, you can place all custodians on hold by selecting the Hold checkbox at the top of the column.

  2. Verify the custodian hold selections and then select Next.

    Note

    If you don't place a hold on a custodian, the custodian and their associated data sources will be added to the case but the content in those data sources won't preserved by the hold that associated with the case.

Step 4: Review the custodians and complete the process

Before you actually add the custodians to the case, you can review the list of custodians, the data locations assigned to them, and the hold settings.

Note

For a limited time, this classic eDiscovery experience is also available in the new Microsoft Purview portal. Enable Compliance portal classic eDiscovery experience in eDiscovery (preview) experience settings to display the classic experience in the new Microsoft Purview portal.

  1. Verify and review all the data sources count and the hold setting associated with each custodian in the table. If necessary, go back to the Identify custodian or Hold settings pages to make any changes.

  2. Select Submit to add custodians and their data locations to the case and apply all custodial hold settings.

    The new custodians are added to the case and displayed on the Data sources tab.

    Custodians listed on the Data sources tab.

Retry hold action

Once a custodian is placed on hold, you can validate the status in the Hold column of the list page. If the hold status isn't equal to True (when hold is enabled) or False (when hold is disabled), you can multi-select the relevant custodians and select Retry hold action at the top of the page. Retry hold action is only available for custodial sources and when multiple custodians are selected. If Retry hold action is performed for data sources successfully placed or released from hold, no action is triggered.