Create and manage cases in eDiscovery (preview)

Article
11/22/2024

After setting up Microsoft Purview eDiscovery (preview) and assigning permissions to eDiscovery managers in your organization that will manage cases, the next step is to create and manage a case for escalation activities or investigation requests.

Tip

Get started with Microsoft Security Copilot to explore new ways to work smarter and faster using the power of AI. Learn more about Microsoft Security Copilot in Microsoft Purview.

Cases dashboard

All eDiscovery cases in your organization are displayed on the Cases dashboard in the Microsoft Purview portal. The Cases dashboard allows you to quickly see the cases in your organization, the status of the case, and important information associated with each case.

Name: The name of the case. The case name must be unique in your organization.
Case status: The current status of the case.
Case type: The type of case.
Created on: The date and time in Coordinated Universal Time (UTC) when the case was created.
Last modified: The date and time in Coordinated Universal Time (UTC) when the case was last modified.
Last modified by: The name of the user that last modified the case.
Number: The optional docket number or other custom numeric identifier for the case.
Description: The description of the case entered when the case was created.

You can customize the displayed columns and the order of the columns in the Cases dashboard by selecting Customize columns. Choose the columns to display or drag and drop columns to reorder.

Filtering cases

To filter cases on the Cases dashboard, enter a keyword to filter by case names that contain the keyword or select Filter on the command bar. Select one or more of the following filters and select Apply to help you organize cases for review on the dashboard.

Case status options:

Active: The case is active.
Pending delete: The case likely has a hold in the pending deletion state. Check the hold policy and redistribute to resolve the error. Afterwards, cases without any holds should be deleted successfully.
Closing: The case is being closed. This status is seen only for case with active holds. Cases without holds are immediately closed.
Closed: The case is closed without errors and the case can be reopened.
Closed with errors: The case is closed, but there are errors. Errors are most likely associated with holds that weren't released during closing. To resolve, check policies with errors, resolve the errors, and redistribute the policies.

Case type options:

Premium: eDiscovery (Premium) cases.
Standard: eDiscovery (Standard) cases.
User data search: Legacy user data search cases.
Content search: Content searches from Microsoft Purview compliance portal.

Important

Case type is used only to map cases to the Microsoft Purview compliance portal during the preview of eDiscovery in the Microsoft Purview portal. This helps you to find cases in the compliance portal (if needed). All cases created in the Microsoft Purview portal are the Premium type, regardless of your license or subscription. Access to premium features isn't governed by the case settings toggle.

To clear Case dashboard filters, select Filter > Clear filters > Apply.

Grouping cases

To group cases on the Cases dashboard, select Group on the command bar. Select of the following groupings to help you organize cases for review on the dashboard.

None: Clears grouping for cases.
Status: Groups cases by the status of the case.
Last modified by: Groups cases by the user that last modified the case.
Case type: Groups cases by the case type.

Download a list of cases

To download a list of all cases displayed in the Cases dashboard, select Download list. A .csv file is generated that contains the case name and all of the Cases dashboard column properties for each case.

Create a case

Tip

Do you prefer an interactive configuration guide experience? Check out the Create and configure a case guide.

Complete the following steps to create a case and configure case settings. The user who creates the case is automatically added as a member. Members of the case can access the case in the Microsoft Purview portal and perform eDiscovery tasks.

Go to the Microsoft Purview portal and sign in using the credentials for a user account assigned eDiscovery permissions. Members of the Organization Management role group can also create eDiscovery cases.
Select the eDiscovery solution card and then select Cases (preview) in the left nav.
Select Create case.
On the Enter details to get started page, complete the following fields:
- Case name: give the case a name (required). The case name must be unique in your organization.
- Case description: Add an optional description to help others understand this case.
Select Create to create the new case and start your investigation.

Work with cases

After creating a case, use the Searches, Hold policies, Review sets, and Exports tabs to manage different areas included in a case:

Create a search
Create a hold policy
Create a review set
Export data from a search query or review set

Mark a case as a favorite

You can mark an eDiscovery case as a favorite for quicker access to cases you want to prioritize. Cases marked as favorites can be accessed quickly via the Cases dashboard. You can mark a case as a favorite on the Cases dashboard by selecting the star icon to the left of a case in the case list.

Manage case settings

Case settings include case information, case license level control, access permissions, and settings that control search and analytics behavior for the case. You can access settings for a specific case by selecting Case settings after selecting a case. You can define specific parameters for feature capabilities based on eDiscovery licenses in your organization, which users, role groups, and guests have access and permissions for the case, and which additional locations are included during organization-wide searches for the case.

For more information about case settings, see:

Manage case status

You can also close or delete cases by selecting Actions for an individual case and choosing Close case or Delete case. If you close or delete a case, all holds are turned off. Any content that was on hold is released, which might result in data loss.

For more information about managing case actions, see:

Share via