First Step in eDiscovery (Premium) Workflow: Create a Case
Your organization uses Microsoft Purview eDiscovery (Premium) to manage a legal case. You need to place a hold on custodians' mailboxes and SharePoint sites to preserve relevant data. Which step must you first take in the eDiscovery workflow?
Quick Answer
The answer is to create a case, as this foundational step establishes the legal container for the entire eDiscovery Premium workflow before any custodial hold can be applied. In Microsoft Purview eDiscovery (Premium), you must first create a case to define the scope and permissions, then add custodians, and only after that can you place holds on their mailboxes and SharePoint sites to preserve relevant data. On the SC-900 exam, this tests your understanding of the sequential workflow stages, often appearing as a trap where options like “search content” or “export results” are listed before the correct first step. A common memory tip is to think of a case as a project folder—you cannot manage custodians or holds without opening that folder first. Remember the order: Case first, then Custodians, then Holds, then Search, then Review, then Export.
⚠ Common exam trap
Watch out — candidates often confuse the eDiscovery workflow with a simple search-and-export process, skipping the case creation step because they assume you can directly search or place holds without a container.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a case
In Microsoft Purview eDiscovery (Premium), the workflow begins with creating a case, which serves as the container for all subsequent actions, including holds, searches, and review sets. Without a case, you cannot place holds on custodians' mailboxes or SharePoint sites because the hold is scoped to the case. Therefore, creating a case is the mandatory first step before any preservation or search activities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Export results
Why it's wrong here
Export is a final step after review.
- ✓
Create a case
Why this is correct
You must create a case first to manage the legal matter.
- ✗
Create a review set
Why it's wrong here
Review sets are created after you have collected data.
- ✗
Search for content
Why it's wrong here
Searching is done after custodians are identified and holds are placed.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
eDiscovery
eDiscovery is the process of identifying, collecting, and producing electronic information for legal cases or investigations.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A legal team is handling a lawsuit and needs to gather all electronically stored information (ESI) related to a specific case from across Microsoft 365, including emails, Teams messages, and SharePoint documents. They need to place a hold on the custodians' data to prevent deletion or modification, and then collect, review, and export the data. Which Microsoft Purview solution should they use?
medium- ✓ A.Microsoft Purview eDiscovery (Premium)
- B.Microsoft Purview eDiscovery (Standard)
- C.Microsoft Purview Audit (Premium)
- D.Microsoft Purview Data Lifecycle Management
Why A: Microsoft Purview eDiscovery (Premium) is the correct solution because it provides end-to-end workflow for legal cases, including the ability to place legal holds on custodians' data across Exchange, Teams, SharePoint, and OneDrive to preserve ESI, and then collect, review, and export that data. The Premium tier adds advanced features like custodian management, review sets, and predictive coding, which are essential for complex litigation scenarios.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.