Events
Take the Microsoft Learn Challenge
Nov 19, 11 PM - Jan 10, 11 PM
Ignite Edition - Build skills in Microsoft security products and earn a digital badge by January 10!
Register nowThis browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Use eDiscovery (preview) to identify, preserve, collect, review, analyze, and export content that's responsive to your organization's internal and external investigations. Complete the following steps in the eDiscovery workflow to set up prerequisites and configure eDiscovery (preview).
Tip
Do you prefer an interactive configuration guide experience? Check out the Getting started with Microsoft Purview eDiscovery guide.
For more information about how eDiscovery (preview) can help you with investigations in your organization, see Learn about eDiscovery (preview).
Tip
If you're not an E5 customer, use the 90-day Microsoft Purview solutions trial to explore how additional Purview capabilities can help your organization manage data security and compliance needs. Start now at the Microsoft Purview trials hub. Learn details about signing up and trial terms.
Before getting started with eDiscovery (preview), you should confirm your Microsoft 365 subscription and any add-ons. Depending on the licensing and subscriptions for your organization, you'll have access to specific premium eDiscovery features in the Microsoft Purview portal.
To access and use eDiscovery (preview), administrators need to verify that their organization has a supported subscription and the appropriate licenses are assigned to users. For more information about subscriptions and licensing, see the subscription requirements for eDiscovery.
If you want users to use any of the eDiscovery-related tools in the Microsoft Purview portal, you must assign the users the appropriate permissions. The easiest way to assign roles is to add the user the appropriate role group on the Role groups page in the Microsoft Purview portal.
For step-by-step guidance, see Assign permissions in eDiscovery (preview).
Tip
Do you prefer an interactive configuration guide experience? Check out the Configure permissions and global settings guide.
eDiscovery (preview) requires the following Enterprise apps to be enabled in your Microsoft 365 or Office 365 organization. If these apps aren't enabled, you can't access all eDiscovery (preview) view, filter, and search features.
App | App ID |
---|---|
ComplianceWorkbenchApp | 92876b03-76a3-4da8-ad6a-0511ffdf8647 |
MicrosoftPurviewEDiscovery | b26e684c-5068-4120-a679-64a5d2c909d9 |
Microsoft Exchange Online Protection | 00000007-0000-0ff1-ce00-000000000000 |
Office365Zoom | 0d38933a-0bbd-41ca-9ebd-28c4b5ba7cb7 |
Note
The MicrosoftPurviewEDiscovery app provides support for exporting data via scripts in when premium eDiscovery features are enabled. For more information about exporting data via scripts, see Get caseOperation.
Depending on the needs of your organization and individual cases, you may need to review and configure global eDiscovery (preview) settings:
To get started with an investigation, you must create a case and configure case settings. The user who creates the case is automatically added as a member. Members of the case can access the case in the Microsoft Purview portal and perform eDiscovery tasks.
After creating a new case, you're automatically directed to the Searches tab in the case and you're ready to create a search for the case. Searches help you find the items you want to collect for the case.
After the search query completes, you'll see the results displayed on the Statistics or Sample tabs (depending on the initial results type you chose) for the search. To view the results for the result type not chosen initially, select the applicable tab and you can generate results for the view.
For example, if you choose Statistics as the search result type initially, but after the search is completed you'd like to view Sample results, you'd select the Sample tab and select Generate sample results and define sample view settings. Select Run query to generate the sample results.
For more details about working with search results, see Review, evaluate, and refine search results in eDiscovery (preview).
After reviewing the items returned in the search query and you've refined your search as needed, you can take specific actions on selected items included in the search results.
When you're satisfied with the results of a search and you're ready to review and analyze those search results, you can add them to a review set in the case. Review sets provide a static, known set of content that you can search, filter, tag, analyze, and take other actions on items as part of your investigation. To add search result items to a review set, see Add search results to a review set in eDiscovery (preview).
Exporting and downloading search results can assist helping internal and external partners current in your investigations. Download reports provide summary information for selected items in the search results in a .csv file. Exporting search results allows you to customize what items are included in the export, the types of items exported, the export format for item, and more. For more information about exporting search results, see Export search results in eDiscovery (preview).
To download the summary information for the search result items, complete the following steps:
To export information for items in the search results, select Export and complete the details needed for the item export. For step-by-step guidance, see Export search results in eDiscovery (preview).
You can create holds to preserve content that might be relevant to an eDiscovery case. Hold can be created at any time and aren't dependent on searches. For step-by-step guidance, see Create holds in eDiscovery (preview).
Events
Take the Microsoft Learn Challenge
Nov 19, 11 PM - Jan 10, 11 PM
Ignite Edition - Build skills in Microsoft security products and earn a digital badge by January 10!
Register nowTraining
Module
Manage Microsoft Purview eDiscovery (Standard) - Training
Manage Microsoft Purview eDiscovery (Standard)
Certification
Microsoft Certified: Information Protection and Compliance Administrator Associate - Certifications
Demonstrate the fundamentals of data security, lifecycle management, information security, and compliance to protect a Microsoft 365 deployment.