Add non-custodial data sources to an eDiscovery (Premium) case

In Microsoft Purview eDiscovery (Premium) cases, it doesn't always meet your needs to associate a Microsoft 365 data source with a custodian in the case. But you may still need to associate that data with a case so that you can search it, add it to a review set, and analyze and review it. The feature in eDiscovery (Premium) is called non-custodial data sources and lets you add data to a case without having to associate it to a custodian. It also applies the same eDiscovery (Premium) functionality to non-custodial data that's available for data associated with custodian. Two of the most useful things that you can apply to non-custodial data is placing it on hold and processing it using Advanced indexing.

Tip

If you're not an E5 customer, use the 90-day Microsoft Purview solutions trial to explore how additional Purview capabilities can help your organization manage data security and compliance needs. Start now at the Microsoft Purview compliance portal trials hub. Learn details about signing up and trial terms.

Add a non-custodial data source

Follow these steps to add and manage non-custodial data sources in an eDiscovery (Premium) case.

  1. On the eDiscovery (Premium) home page, select the case that you want to add the data to.

  2. Select the Data sources tab and then select Add data source > Add data locations.

  3. On the New non-custodial data locations flyout page, choose the data sources that you want to add to the case. You can add multiple mailboxes and sites by expanding the SharePoint or Exchange sections and then selecting Edit.

    Add SharePoint sites and Exchange mailboxes as non-custodial data sources.

    • SharePoint - Select Edit to add sites. Select a site in the list or you can search for a site by typing the URL of the site in the search bar. Select the sites that you want to add as non-custodian data sources and select Add.

    • Exchange - Select Edit to add mailboxes. Type a name or alias (a minimum of three characters) in the search box for mailboxes or distribution groups. Select the mailboxes that you want to add as non-custodian data sources and select Add.

    Note

    You can use the SharePoint and Exchange sections to add sites and mailboxes associated with a Team or Yammer group as non-custodial data sources. You have to separately add the mailbox and site associated with a Team or Yammer group.

    Also, adding a root site URL (such as https://contoso-my.sharepoint.com/personal/ or https://contoso-my.sharepoint.com/) as a SharePoint data source isn't supported. You have to add specific sites.

  4. After you add non-custodial data sources, you have the option to place those locations on hold or not. Select or unselect the Hold checkbox next to the data source to place it on hold.

  5. Select Add at the bottom of the New non-custodial data locations flyout page to add the data sources to the case.

    Each non-custodial data source that you added is listed on the Data sources page. Non-custodial data sources are identified by the Data location value in the Source type column.

    Non-custodial data sources on the Data sources tab.

After you add non-custodial data sources to the case, a job named Reindexing non-custodial data is created and displayed on the Jobs tab of the case. After the job is created, the Advanced indexing process in initiated and the data sources are reindexed.

Manage the hold for non-custodial data sources

After you place a hold on a non-custodial data source, a hold policy that contains the non-custodial data sources for the case is automatically created. When you place other non-custodial data sources on hold, they are added to this hold policy.

  1. Open the eDiscovery (Premium) case and select the Hold tab.

  2. Select NCDSHold-<GUID>, where the GUID value is unique to the case.

    The flyout page display information and statistics about the non-custodial data sources on hold.

    The flyout page for non-custodial data sources hold displays statistics.

  3. Select Edit hold to view the non-custodial data sources placed on hold and perform the following management tasks:

    • On the Locations page, you can release a non-custodial data source by removing it from the hold. Releasing a data source doesn't remove the non-custodial data source from the case. It only removes the hold that was placed on the data source.

    • On the Query page, you can edit the hold to create a query-based hold that is applied to all tha non-custodial data sources in the case.