Legal Holds & eDiscovery in Purview — Quick Start

Assign roles in the Microsoft Purview compliance portal to the right people.

• eDiscovery Manager: Can create and manage eDiscovery cases, add members, create holds, run searches, and export results.
• eDiscovery Administrator: A super-user who can access all cases and manage global eDiscovery settings.
• Assign users to these roles based on your organization's RACI chart for legal and compliance functions.

Use a new case for each legal matter or investigation.

• Navigate to Purview eDiscovery > Standard or Premium.
• Click "Create a case" and give it a descriptive name and number that aligns with your matter management system.
• Add legal team members, outside counsel, and IT personnel who need access to the case.

Preserve data in place without impacting users.

• In your case, go to the "Holds" tab.
• Create a new hold, giving it a name related to the preservation notice.
• Add custodians by searching for their mailboxes and OneDrive sites. You can also place holds on SharePoint sites and Teams channels.
• The hold is transparent to the user. Deleted and modified items are preserved in a secure, hidden location.

Find relevant data using powerful search tools.

• Go to the "Searches" tab within your case.
• Create a new search using keywords, date ranges, and other conditions.
• Target the custodians and locations you placed on hold.
• Preview search results to refine your query before committing to a large export.
• For eDiscovery Premium, you can add search results to a "Review Set" for culling, analysis, and tagging.

Package and download data for review or delivery.

• Once results are finalized, select an export action.
• Choose output options: PST files for email, native files for documents, and whether to include a load file.
• Download the results using the eDiscovery Export Tool.
• Maintain a chain of custody log for all export actions.