Close or delete an eDiscovery (Premium) case

Article
10/31/2024

Tip

eDiscovery (preview) is now available in the new Microsoft Purview portal. To learn more about using the new eDiscovery experience, see Learn about eDiscovery (preview).

When the legal case or investigation supported by a Microsoft Purview eDiscovery (Premium) case is completed, you can close or delete a case. You can also reopen a closed case.

Tip

If you're not an E5 customer, use the 90-day Microsoft Purview solutions trial to explore how additional Purview capabilities can help your organization manage data security and compliance needs. Start now at the Microsoft Purview trials hub. Learn details about signing up and trial terms.

Close a case

Here's what happens when you close an eDiscovery (Premium) case:

If the case contains any content locations on hold, these holds are turned off. After the hold is turned off, a 30-day grace period (called a delay hold) is applied to content locations that were on hold. This helps prevent content from being immediately deleted and gives admins an opportunity to search for or recover content that will be permanently deleted after the delay hold period expires. For more information, see Removing content locations from an eDiscovery hold.
Closing a case only turns off the holds that are associated with that case. If other holds are place on a content location (such as a Litigation Hold, Microsoft Purview eDiscovery (Standard) hold, or a hold from a different eDiscovery (Premium) case) those holds will still be maintained.
The case is still listed on the eDiscovery page in the Microsoft Purview compliance portal. The details, holds, searches, and members of a closed case are retained.
You can edit a case after it's closed. For example, you can add or removing members, create searches, export search results, and prepare search results for analysis in eDiscovery (Premium). The primary difference between active and closed cases is that holds are turned off when a case is closed.

To close a case:

Note

For a limited time, this classic eDiscovery experience is also available in the new Microsoft Purview portal. Enable Compliance portal classic eDiscovery experience in eDiscovery (preview) experience settings to display the classic experience in the new Microsoft Purview portal.

On the eDiscovery (Premium) page, select the case that you want to close.
On the Settings tab, under Case Information, choose Select.
At the bottom of the Case Information flyout page, select Actions, and then select Close case. It may take up to 60 minutes for the closing process to complete.

When closing a case, you'll see the status of the case changing as the case is processed for closing. The following table describes the case status messages that you'll see when closing a case:

Status	Description
Active	The case is active.
Closed	The case is closed without errors and the case can be reopened.
Closed with Errors	The case is closed, but there are errors. Errors are most likely associated with holds that were not released during closing. To resolve, check policies with errors, resolve the errors, and redistribute the policies.
Closing	The case is being closed. This status is usually seen only for case with active holds. Cases without holds are immediately closed.
Pending delete	The case likely has a hold in the pending deletion state. Check the hold policy and redistribute to resolve the error. Afterwards, cases without any holds should be deleted successfully.

Reopen a closed case

When you reopen an eDiscovery (Premium) case, any holds that were in place when the case was closed won't be automatically reinstated. After the case is reopened, you'll have to go to the Holds tab and turn on the previous holds. To turn on a hold, select it to display the flyout page, and then set the Status toggle to On.

To reopen a closed case:

Note

On the eDiscovery (Premium) page, select the case that you want to reopen.
On the Settings tab, under Case Information, select Select.
At the bottom of the Case Information flyout page, select Actions, and then select Reopen case.

It might take up to 60 minutes for the reopening process to complete.

Delete a case

You can delete both active and closed eDiscovery (Premium) cases. When you delete a case, all components associated with the case, such as the list of custodians, communications, searches, review sets, and export job are deleted. The case is removed from the list of cases on the eDiscovery (Premium) page in the Microsoft Purview compliance portal. You can't recover or reopen a deleted case.

Note

In data spillage scenarios, the only way to remove items in a review set is to delete the eDiscovery (Premium) case. Other "search and purge" methods don't remove items from a review set.

Before you can delete a case, you must first delete all holds listed on the holds page of the case. That includes deleting holds with a status of Off. Default hold policies can only be deleted when the hold is turned off. You must close an active case to turn off any default hold policies in the case. Once the holds are turned off for default hold policies, they can be deleted.

To delete holds associated with a case:

Note

Go the Holds tab in the eDiscovery (Premium) case that you want to delete.
Select the hold that you want to delete.
On the flyout page, select Delete. Ensure that the hold is turned off.

To delete a case:

Note

On the eDiscovery (Premium) page, select the case that you want to delete.
On the Settings tab, under Case Information, choose Select.
At the bottom of the Case Information flyout page, select Actions, and then select Delete case.

Share via

Close or delete an eDiscovery (Premium) case

Close a case

Reopen a closed case

Delete a case

Feedback

Additional resources