eDiscovery in Microsoft 365 (Legal & Compliance)
🎯 Objective
To understand how eDiscovery helps organizations search, preserve, and investigate data for legal and compliance purposes.
🧠 What is eDiscovery?
eDiscovery is a Microsoft 365 compliance feature that allows organizations to:
- Search organizational data
- Preserve evidence
- Investigate user activity
- Export data for legal review
🛠️ Prerequisites
- Microsoft 365 Compliance Admin access
- eDiscovery Premium/Standard permissions
- Access to Microsoft Purview portal
🔐 Step 1: Open Microsoft Purview Portal
- Go to:
https://compliance.microsoft.com - Navigate to:
eDiscovery
📁 Step 2: Create an eDiscovery Case
- Click:
Create Case - Enter:
- Case Name
- Description
- Click Save
👥 Step 3: Add Members to the Case
- Open the created case
- Navigate to:
Settings → Members - Add investigators or admins
📂 Step 4: Add Data Sources
Select locations to investigate:
✔ Exchange mailboxes
✔ SharePoint sites
✔ OneDrive accounts
✔ Teams messages
🔍 Step 5: Perform Content Search
- Click:
Search → New Search - Configure search conditions:
Examples:
- Specific keywords
- Sender email
- Date range
⚖️ Step 6: Apply Legal Hold
- Navigate to:
Holds - Create hold policy
- Select users or locations
👉 This prevents deletion of important evidence.
📤 Step 7: Export Search Results
- Review search results
- Click:
Export Results
🧪 Step 8: Review Investigation Data
Analyze:
✔ Emails
✔ Files
✔ User communications
💡 Real-World Scenario
Organization receives legal notice:
✔ Search employee emails
✔ Preserve communication records
✔ Export evidence for legal team
✅ Key Takeaways
✔ Helps in investigations
✔ Preserves critical evidence
✔ Supports compliance requirements
✔ Enables centralized data search
🧠 Conclusion
eDiscovery in Microsoft 365 is an essential compliance feature that helps organizations manage legal investigations and regulatory requirements efficiently.