Manage investigations with Microsoft Purview eDiscovery

  • Learning Path
  • 5 Modules

At a glance

Microsoft Purview eDiscovery supports internal investigations and legal matters by enabling the discovery, preservation, and analysis of Microsoft 365 content. Learn how to manage cases, place holds on data, run targeted searches, and organize results for review to meet legal and regulatory requirements.

Prerequisites

  • Foundational knowledge of Microsoft security and compliance technologies
  • Familiarity with Microsoft Purview and Microsoft 365 data locations

Modules in this learning path

Understand Microsoft Purview eDiscovery

Discover how Microsoft Purview supports a defensible eDiscovery process across Microsoft 365 services. Review how organizations can manage investigations by preserving content, running searches, analyzing results, and controlling access through role-based permissions.

Create and manage eDiscovery cases

Microsoft Purview eDiscovery provides a case-based structure for managing legal, compliance, and security investigations. Each case acts as a secure workspace for collecting, reviewing, and exporting relevant content. With configurable options for permissions, access, data sources, and analytics, cases help teams enforce control, maintain accountability, and tailor investigations to their organizational needs.

Manage data sources and holds in Microsoft Purview eDiscovery

Managing data sources and applying holds in Microsoft Purview eDiscovery helps ensure that investigations are scoped correctly and that relevant content is preserved. Defining where to search, applying hold policies, and using PowerShell to confirm preservation are key steps in supporting legal and regulatory requirements.

Analyze and prepare content in eDiscovery review sets

Microsoft Purview eDiscovery includes review sets to help legal and compliance teams manage, analyze, and prepare content during an investigation. Review sets provide a structured workspace where teams can filter, tag, summarize, and export case data in a repeatable, defensible way.

Start