Get started with eDiscovery (preview)

Use eDiscovery (preview) to identify, preserve, collect, review, analyze, and export content that's responsive to your organization's internal and external investigations. Complete the following steps in the eDiscovery workflow to set up prerequisites and configure eDiscovery (preview).

Tip

Do you prefer an interactive configuration guide experience? Check out the Getting started with Microsoft Purview eDiscovery guide.

For more information about how eDiscovery (preview) can help you with investigations in your organization, see Learn about eDiscovery (preview).

Tip

If you're not an E5 customer, use the 90-day Microsoft Purview solutions trial to explore how additional Purview capabilities can help your organization manage data security and compliance needs. Start now at the Microsoft Purview compliance portal trials hub. Learn details about signing up and trial terms.

Subscriptions and licensing

Before getting started with eDiscovery (preview), you should confirm your Microsoft 365 subscription and any add-ons. Depending on the licensing and subscriptions for your organization, you'll have access to specific premium eDiscovery features in the Microsoft Purview portal.

To access and use eDiscovery (preview), administrators need to verify that their organization has a supported subscription and the appropriate licenses are assigned to users. For more information about subscriptions and licensing, see the subscription requirements for eDiscovery.

Step 1: Assign permissions

If you want users to use any of the eDiscovery-related tools in the Microsoft Purview portal, you must assign the users the appropriate permissions. The easiest way to assign roles is to add the user the appropriate role group on the Role groups page in the Microsoft Purview portal.

For step-by-step guidance, see Assign permissions in eDiscovery (preview).

Tip

Do you prefer an interactive configuration guide experience? Check out the Configure permissions and global settings guide.

Step 2: Verify that required eDiscovery apps are enabled

eDiscovery (preview) requires the following Enterprise apps to be enabled in your Microsoft 365 or Office 365 organization. If these apps aren't enabled, you can't access all eDiscovery (preview) view, filter, and search features.

App	App ID
ComplianceWorkbenchApp	92876b03-76a3-4da8-ad6a-0511ffdf8647
MicrosoftPurviewEDiscovery	b26e684c-5068-4120-a679-64a5d2c909d9
Microsoft Exchange Online Protection	00000007-0000-0ff1-ce00-000000000000
Office365Zoom	0d38933a-0bbd-41ca-9ebd-28c4b5ba7cb7

Note

The MicrosoftPurviewEDiscovery app provides support for exporting data via scripts in when premium eDiscovery features are enabled. For more information about exporting data via scripts, see Get caseOperation.

Step 3: Configure settings

Depending on the needs of your organization and individual cases, you may need to review and configure global eDiscovery (preview) settings:

• Analytics: Turn on Attorney-client privilege detection within your working sets. If you turn attorney-client privilege detection on, the attorney-client privilege model is run on your data and helps flag documents likely to be privileged. This flag is based on the content and by comparing participants against a user-provided attorney list. This doesn't replace the need for privilege review, this meant to help you get started.
• Guest users: Manage guest access to cases in your organization. Invitations to guests are sent after your approval.
• Tag templates: Tags help organize content in a review set to complete various workflows. Tags can be reused across multiple review sets and cases with tag templates. You can group tags by sections and allow single or multiple choice tagging.
• Historical versions (preview): SharePoint versioning allows for tracking the activity of an item, which can help in providing an audit trail. Historical versions allows organizations to quickly search not only the current version of documents in SharePoint, but across all the previous versions of those documents stored in that SharePoint site. This additional visibility can help in finding previous versions that may be relevant to an investigation or case.

Step 4: Create a case

To get started with an investigation, you must create a case and configure case settings. The user who creates the case is automatically added as a member. Members of the case can access the case in the Microsoft Purview portal and perform eDiscovery tasks.

Step 5: Create a search

After creating a new case, you're automatically directed to the Searches tab in the case and you're ready to create a search for the case. Searches help you find the items you want to collect for the case.

Step 6: Review and refine search results

After the search query completes, you'll see the results displayed on the Statistics or Sample tabs (depending on the initial results type you chose) for the search. To view the results for the result type not chosen initially, select the applicable tab and you can generate results for the view.

For example, if you choose Statistics as the search result type initially, but after the search is completed you'd like to view Sample results, you'd select the Sample tab and select Generate sample results and define sample view settings. Select Run query to generate the sample results.

For more details about working with search results, see Review, evaluate, and refine search results in eDiscovery (preview).

Step 7: Take action on search results

After reviewing the items returned in the search query and you've refined your search as needed, you can take specific actions on selected items included in the search results.

Add search results to a review set

When you're satisfied with the results of a search and you're ready to review and analyze those search results, you can add them to a review set in the case. Review sets provide a static, known set of content that you can search, filter, tag, analyze, and take other actions on items as part of your investigation. To add search result items to a review set, see Add search results to a review set in eDiscovery (preview).

Export or download search results

Exporting and downloading search results can assist helping internal and external partners current in your investigations. Download reports provide summary information for selected items in the search results in a .csv file. Exporting search results allows you to customize what items are included in the export, the types of items exported, the export format for item, and more. For more information about exporting search results, see Export search results in eDiscovery (preview).

Download search results

To download the summary information for the search result items, complete the following steps:

1. On the Statistics or Sample tabs, select Download reports.
2. Save the .csv file to your local computer or network share.

Export search results

To export information for items in the search results, select Export and complete the details needed for the item export. For step-by-step guidance, see Export search results in eDiscovery (preview).

Create holds

You can create holds to preserve content that might be relevant to an eDiscovery case. Hold can be created at any time and aren't dependent on searches. For step-by-step guidance, see Create holds in eDiscovery (preview).