Events
Take the Microsoft Learn Challenge
Nov 19, 11 PM - Jan 10, 11 PM
Ignite Edition - Build skills in Microsoft security products and earn a digital badge by January 10!
Register nowThis browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Electronic discovery, or eDiscovery, is the process of identifying and delivering electronic stored information (ESI) that can be used as evidence in investigations and legal cases. You can use Microsoft Purview eDiscovery (preview) to identify, review, and manage content in Microsoft 365 services to support your investigations. Supported Microsoft 365 services include:
You can search mailboxes and sites in the same eDiscovery search, and then export the search results. You can use eDiscovery cases to identify, hold, and export content found in mailboxes and sites. If your organization has an Office 365 E5 or Microsoft 365 E5 subscription (or related E5 add-on subscriptions), you can further manage cases and analyze content using premium eDiscovery features.
eDiscovery (preview) is available in the Microsoft Purview portal. The classic eDiscovery experience is available in both the Microsoft Purview portal (for a limited time) and in the Microsoft Purview compliance portal.
The Microsoft Purview compliance portal is scheduled for retirement on December 13, 2024 and classic eDiscovery experience support in the Microsoft Purview portal is scheduled for retirement in 2025.
Depending on the licensing and subscriptions for your organization, you have access to specific eDiscovery or premium eDiscovery features in the Microsoft Purview portal. All Content search features are now included within the search experience within eDiscovery (preview). However, eDiscovery (preview) doesn't currently support all features available in eDiscovery (Standard) and eDiscovery (Premium) in the compliance portal.
For a summary of eDiscovery features supported only in the compliance portal or when you enable the classic eDiscovery expereince in eDiscovery (preview), see the Microsoft Purview compliance portal-only eDiscovery features section later in this article.
For a limited time, you can choose to enable the classic eDiscovery experience found in the Microsoft Purview compliance portal in the Microsoft Purview portal. Selecting this user experience option allows you to configure and manage your eDiscovery investigations using the workflow and tools you're already familiar with while you transition to using the updated workflow and new management tools and experience in the Microsoft Purview portal.
These options determine the workflow, tools, and information you see when working with eDiscovery. These options are available for a limited time and apply only to the eDiscovery experience in the Microsoft Purview portal.
eDiscovery (preview) customers can continue to use and manage existing Content search, eDiscovery (Standard), and eDiscovery (Premium) features in the compliance portal. Changes made in the Microsoft Purview portal and the compliance portal for searches, cases, review sets, and holds in the same organization are visible in both portals. However, depending on the currently supported features and your organization's licensing and subscriptions and the user experience configured for eDiscovery in the Microsoft Purview portal, you may or may not have access to these features in the Microsoft Purview portal.
To continue to use the compliance portal in the original standalone experience, disable the New Microsoft Purview portal toggle on the Microsoft Purview portal or log directly into the following eDiscovery solution pages in the compliance portal:
Important
The Microsoft Purview compliance portal is scheduled for retirement by the end of 2024.
For customers that are already familiar with previous versions of eDiscovery, there are several notable differences when using eDiscovery (preview) in the Microsoft Purview portal:
Advanced indexing: When a custodian or noncustodial data source is added to a case in previous versions of eDiscovery, any content deemed as partially indexed or had indexing errors needs to be reindexed to determine if the contents are relevant to defined search conditions. The reindexing process was called Advanced indexing. As more partially and unindexed items were added to data sources (user's mailbox, OneDrive account, etc.) you would need to separately update the index for specific custodian or noncustodial data sources.
In eDiscovery (preview), Advanced indexing runs automatically during each search scoped for statistics results and when you add results to a review set or export search results, depending on the indexing options you've chosen for the process. Separate reindexing of data sources prior to the search process is no longer needed. This just in time indexing process helps avoid issues with stale indices that may result in indexing and search running sequentially and separately in the classic experience. Running (or rerunning) a search automatically updates all indexes.
Collections: In previous versions of eDiscovery, collections provided managers with estimates of the content that may be relevant to cases. These estimates allowed managers to make quick, informed decisions about the size and scope of content relevant to cases. Once added to a review set in the compliance portal, the collection is immutable.
In eDiscovery (preview), Statistics in searches have replaced collections. Statistics results in searches now allow managers to review important insights about the items included in the results and the relevance to the case. Searches aren't immutable in eDiscovery (preview), even after the results are added to a review set. Searches can be updated at any time. Adding only a sample of the collection into review set and deleting a search has been removed in eDiscovery (preview).
Content search: Content search in the compliance portal was a separate solution from eDiscovery used for basic searches for content. Results from content search were estimated numbers of locations and search results that you could preview or export to a local computer.
In the Microsoft Purview portal, all Content search functionality is now included in a system generated eDiscovery case by default for all members of the eDiscovery manager and Administrator role groups. If you need to limit access to content searches, use Case settings to remove or add members to the case to manage access to these searches.
The content search case has the same capability as other user-created cases. You can create holds, review sets, and more in the content search case, depending on your subscription.
Custodians: In previous versions of eDiscovery, custodians (users) were the primary component of the eDiscovery workflow. Custodians were potential persons of interest in an investigation that you added to cases.
In eDiscovery (preview), cases are the primary component of the eDiscovery workflow. People, groups, and data sources are still added to cases, but the case is the central organizing unit.
Export updates: The new export flow in eDiscovery (preview) supports a unified export structure across premium and non-premium feature exports, faster export performance, detailed reporting, and flexible export options.
Jobs: In previous versions of eDiscovery, tasks, activities, and reports associated with workflow components were called jobs. These events and reports are now referred to as processes in eDiscovery (preview).
The following table compares key eDiscovery (preview) capabilities and features:
Capability | eDiscovery feature support | Premium eDiscovery feature support |
---|---|---|
Search for content | ||
Keyword queries and search conditions | ||
Search statistics | ||
Export search results | ||
Role-based permissions | ||
Case management | ||
Place content locations on hold | ||
Advanced indexing | ||
Review sets | ||
Support for cloud attachments and SharePoint versions | ||
Optical character recognition | ||
Conversation threading | ||
Search statistics and reports | ||
Review set filtering | ||
Tagging | ||
Analytics | ||
Computed document metadata | ||
Transparency of long-running processes | ||
Full reporting for all processes | ||
Enhanced data source mapping | ||
Here's a description of each eDiscovery (preview) capability.
Some eDiscovery features are currently supported only in the Microsoft Purview compliance portal or the classic eDiscovery experience. You need to use and manage these features in the compliance portal or enable the classic eDiscovery experience in eDiscovery (preview):
Case level custodian-management: Manage the people that you identify as people of interest in the case (called custodians) and other data sources that may not be associated with a custodian. When you add custodians and noncustodial data sources to a case, you can place a legal hold on these data sources, communicate with custodians by using the legal hold notification process, and search custodian and noncustodial data sources to collect content relevant to the case.
Communications: Using eDiscovery (Premium) custodian communications, organizations can manage their workflow around communicating with custodians. Through the Communications tool, legal teams can systematically send, collect, and track legal hold notifications.
Error remediation: Fix processing errors using a process called error remediation. Error remediation allows you to rectify data issues that prevent eDiscovery (Premium) from properly processing the content during Advanced indexing. For example, files that are password protected can't be processed since the files are locked or encrypted. Using error remediation, you can download files with errors, remove the password protection, and then upload the remediated files.
Export to customer-owned Azure Storage location: When you export documents from a review set, can export them to an Azure Storage account managed by your organization. Additionally, eDiscovery (Premium) lets you customize what data is exported. This includes exporting file metadata, native files, text files, tags, and redacted documents saved to a PDF file.
Import non-Office 365 data: Not all documents that you need to analyze in eDiscovery (Premium) are in Office 365. With the non-Office 365 data import feature in eDiscovery (Premium), you can upload documents that aren't in Office 365 to a review set.
Legal hold notifications: Manage the process of communicating with case custodians. A legal hold notification instructs custodians to preserve content that's relevant to the case. You can track the notices that were received, read, and acknowledged by custodians. The communications workflow in eDiscovery (Premium) allows you to create and send initial notifications, reminders, and escalations if custodians fail to acknowledge a hold notification.
Predictive coding models: Use predictive coding models to reduce large volumes of case content to a relevant set of items that you can prioritize for review. You can create and train your own predictive coding models that help you prioritize the review of the most relevant items in a review set. The system uses the training to apply prediction scores to every item in the review set. This lets you filter items based on the prediction score, which allows you to review the most relevant (or nonrelevant) items first.
Important
Predictive coding has been retired as of March 31, 2024 and is not available in new eDiscovery cases. For existing cases with trained predictive coding models, you can continue to apply existing score filters to review sets. However, you can't create or train new models.
Cases in Microsoft Purview Insider Risk Management can be quickly escalated to new cases in eDiscovery (preview) when additional legal review is needed for potentially risky user activity. The tight integration between these solutions can help your risk and legal teams work more efficiently and can help provide a complete end-to-end view of user activities under review.
Check out how to get started with Insider Risk Management and how to easily escalate an Insider Risk Management case to an eDiscovery (Premium) case.
You can use Microsoft Security Copilot features in eDiscovery (preview) to use natural language to draft KeyQL search queries. Copilot translates natural language to KeyQL without requiring you to learn how to construct a KeyQL query, know operators, and know supported search metadata fields. Copilot can also provide a contextual summary of most items in a review set. The summary provided is in the context of text included in a selected item. This summary can save time for reviewers by quickly identifying information helpful when tagging or exporting items. Security Copilot summarizes the entire item, including any documents, meetings transcripts, or attachments. Most all of the common document file types are supported.
For more information about using Security Copilot with review sets, see Summarize an item by using Security Copilot.
Events
Take the Microsoft Learn Challenge
Nov 19, 11 PM - Jan 10, 11 PM
Ignite Edition - Build skills in Microsoft security products and earn a digital badge by January 10!
Register now