eDiscovery in Microsoft 365

eDiscovery (electronic discovery) refers to the process of identifying, collecting, and producing electronically stored information (ESI) in response to a legal request or investigation. In Microsoft 365, eDiscovery capabilities are built into the Microsoft Purview compliance portal and are divided into three tiers: Content Search, eDiscovery (Standard), and eDiscovery (Premium). Each tier provides increasing levels of functionality for searching, preserving, and exporting data.

The primary purpose of eDiscovery in Microsoft 365 is to help organizations comply with legal and regulatory requirements by allowing authorized users to:

The exam focuses on understanding the capabilities of each tier and when to use them.

eDiscovery in Microsoft 365 leverages the indexing and search capabilities of the Microsoft 365 platform. When you create a search, the system queries the unified indexing layer that indexes all content in Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. The search uses Keyword Query Language (KQL) syntax, which allows for complex queries including keywords, date ranges, sender/recipient, file types, and more.

When you place a hold, the system uses the Microsoft 365 Hold feature, which works by preserving the original version of content even if a user modifies or deletes it. For Exchange Online, this is implemented by placing the mailbox on In-Place Hold or Litigation Hold; for SharePoint and OneDrive, it uses Preservation Hold libraries. The hold is applied at the item level, meaning that if a user edits a document, the original version is retained in the preservation hold library, and the edit is allowed to proceed.

Content Search: - Simple search tool for finding content across mailboxes and sites. - Searches run against indexed content and return results quickly (typically within minutes). - Results can be exported as CSV, PST, or individual items. - Maximum export size: 5 TB per export job. - No case management or hold capabilities.

eDiscovery (Standard): - Adds case management: cases are containers that hold searches, holds, and exports. - Allows you to create holds associated with a case. - Supports searching across all workloads (Exchange, SharePoint, OneDrive, Teams, Yammer). - Holds are applied to mailboxes, sites, and public folders. - Default hold duration: indefinite until removed. - Maximum number of cases: 300 per tenant.

eDiscovery (Premium): - Advanced workflow with review sets, analytics, and predictive coding. - Review sets allow you to add search results to a separate container for analysis. - Analytics include email threading, near-duplicate detection, and themes. - Predictive coding uses machine learning to identify relevant documents. - Supports legal hold notifications and custodian management. - Maximum review set size: 1 TB per case.

Legal Hold: - Prevents deletion or modification of content. - For Exchange: places mailbox on Litigation Hold or In-Place Hold. - For SharePoint/OneDrive: creates a Preservation Hold library. - Hold duration can be indefinite or based on a date range. - Users can still work on content; original versions are preserved.

While MS-900 does not require command-line knowledge, understanding the PowerShell equivalents helps grasp the underlying mechanics.

To create a Content Search via PowerShell:

New-ComplianceSearch -Name "Project X Search" -ExchangeLocation All -SharePointLocation All -ContentMatchQuery "project AND confidential"

To start a search:

Start-ComplianceSearch -Identity "Project X Search"

To create an eDiscovery case and hold:

New-ComplianceCase -Name "Case 001" -CaseType Standard
New-CaseHoldPolicy -Name "Hold Policy" -Case "Case 001" -ExchangeLocation "user@contoso.com"

To verify holds are applied:

Get-Mailbox -Identity "user@contoso.com" | FL LitigationHoldEnabled

If LitigationHoldEnabled is True, the hold is active.

eDiscovery integrates with: - Microsoft Purview Data Lifecycle Management: Retention policies and labels can conflict with eDiscovery holds. A hold always takes precedence over a deletion policy. For example, if a retention policy is set to delete emails after 3 years but a hold is placed on a mailbox, the held items are preserved even after the retention period. - Microsoft Purview Audit (Standard and Premium): All eDiscovery actions (searches, holds, exports) are logged in the audit log. This provides a chain of custody for legal proceedings. - Microsoft Purview Information Protection: Sensitivity labels can be applied to documents during the eDiscovery review process, but labels do not affect the search or hold capabilities. - Microsoft Teams and Yammer: eDiscovery can search messages, files, and conversations in Teams and Yammer. For Teams, this includes private channel messages and shared files.

The MS-900 exam expects you to know:

Be careful: The exam may ask which eDiscovery tool to use for a specific scenario. For example, if the scenario requires only searching and exporting data without holds, the answer is Content Search. If the scenario requires placing a hold and managing a case, it's eDiscovery (Standard). If advanced analytics like predictive coding are needed, it's eDiscovery (Premium).

In a large enterprise with 50,000 employees, eDiscovery is used daily for litigation preparedness. For example, a company facing a lawsuit must produce all communications related to a specific contract. The legal team creates an eDiscovery (Standard) case, places a hold on the mailboxes of all employees involved in the contract, and runs a search for keywords like 'contract' and the contract number. They export the results to PST files and hand them over to external counsel. A common issue is that the search might miss data from Microsoft Teams chats if the search scope does not include Teams. The engineer must ensure that all relevant workloads are selected, including Exchange, SharePoint, OneDrive, and Teams. Performance considerations: large searches (over 1 million items) may take hours to complete, and export jobs can fail if they exceed the 5 TB limit. Best practice is to break large searches into smaller date ranges.

Another scenario: An internal investigation into a data leak. The security team uses eDiscovery (Premium) to search across all employee communications for specific file hashes or sensitive data patterns. They place holds on the suspect's accounts and add results to a review set. Using analytics, they identify key emails and documents, then use predictive coding to quickly find all related content. They export the evidence with tags and metadata for HR proceedings. A misconfiguration could occur if the legal hold is not applied quickly enough; users might delete evidence before the hold takes effect. The engineer must apply holds immediately upon suspicion.

A third scenario: Regulatory compliance with GDPR. A user requests deletion of their data (right to erasure), but the company must also preserve data for ongoing litigation. eDiscovery holds take precedence over deletion policies, so the engineer must carefully manage holds to avoid violating data subject rights. They may need to use a targeted hold that only preserves specific items rather than the entire mailbox.