Share via

Learn about case settings in eDiscovery (preview)

  • Article

Case settings in eDiscovery (preview) allow you to view and update case information and to take action on specific cases in eDiscovery (preview).

The following information is displayed for the selected case:

  • Premium features: Displays the status of premium eDiscovery features enabled in the case. To use premium eDiscovery features for the selected case, enable the eDiscovery (Premium) toggle.
  • License: Displays the current licensing subscription for the case. Values are eDiscovery (Premium) or eDiscovery (Standard).
  • ID: Displays the case identification number. This can be reviewed, but can't be changed once the case is created.
  • Case name: Displays the case name. This field is required. To change the case name, enter the new case name and select Actions > Save.
  • Case number: Displays an optional docket number or other numeric identifier for the case. To change the case number, enter the new case number and select Actions > Save.
  • Case description: Displays an optional description to help others understand this case. To change the case description, enter the new case description and select Actions > Save.
  • Case status: Displays the current case status.
  • Case created: Displays the date and time when the case case was created.

Tip

Get started with Microsoft Security Copilot to explore new ways to work smarter and faster using the power of AI. Learn more about Microsoft Security Copilot in Microsoft Purview.

Close a case

When the legal case or investigation supported by eDiscovery (preview) is completed, you can close a case. Here's what happens when you close an eDiscovery case:

  • If the case contains any content locations on hold, these holds are turned off. After the hold is turned off, a 30-day grace period (called a delay hold) is applied to content locations that were on hold. This helps prevent content from being immediately deleted and gives admins an opportunity to search for or recover content that will be permanently deleted after the delay hold period expires.
  • Closing a case only turns off the holds that are associated with that case. If other holds are place on a content location (such as a Litigation Hold, eDiscovery hold, or a hold from a different eDiscovery case) those holds are still be maintained.
  • The case is still listed on the Cases page in the Microsoft Purview portal. The details, holds, searches, and members of a closed case are retained.
  • You can edit a closed case. For example, you can add or removing members, create searches, export search results, and prepare search results for analysis in eDiscovery. The primary difference between active and closed cases is that holds are turned off when a case is closed.

To close a case, complete the following steps:

  1. Go to the Microsoft Purview portal and sign in using the credentials for a user account assigned eDiscovery permissions.
  2. Select the eDiscovery solution card and then select Cases.
  3. Select a case, the select Case settings.
  4. On the Case settings page, select Actions, and then select Close case. It may take up to 60 minutes for the closing process to complete.

When closing a case, you'll see the status of the case changing as the case is processed for closing.

Reopen a closed case

When you reopen an eDiscovery case, any holds that were in place when the case was closed aren't automatically reinstated. After the case is reopened, you'll have to go to the Holds tab and turn on the previous holds. To turn on a hold, select it to display the flyout page, and then set the Status toggle to On.

To reopen a closed case, complete the following steps:

  1. Go to the Microsoft Purview portal and sign in using the credentials for a user account assigned eDiscovery permissions.
  2. Select the eDiscovery solution card and then select Cases (preview) in the left nav.
  3. Select a case, the select Case settings.
  4. On the Case settings page, select Actions, and then select Reopen case. It may take up to 60 minutes for the reopening process to complete.

Delete a case

You can delete both active and closed eDiscovery cases. When you delete a case, all components associated with the case, such as the list of communications, searches, review sets, and exports are deleted. You can't recover or reopen a deleted case.

Note

In data spillage scenarios, the only way to remove items in a review set is to delete the eDiscovery case. Other "search and purge" methods don't remove items from a review set.

Before you can delete a case, you must first delete all hold policies listed on the Hold policies tab of the case. That includes deleting holds with a status of Off. Default hold policies can only be deleted when the hold is turned off. You must close an active case to turn off any default hold policies in the case. Once the holds are turned off for default hold policies, they can be deleted.

To delete hold policies associated with a case, complete the following steps:

  1. Go the Hold policies tab in the eDiscovery case that you want to delete.
  2. Select the hold policy that you want to delete.
  3. On the hold policy page, select Policy actions > Delete policy.

To delete a case, complete the following steps:

  1. Go to the Microsoft Purview portal and sign in using the credentials for a user account assigned eDiscovery permissions.
  2. Select the eDiscovery solution card and then select Cases (preview) in the left nav.
  3. Select a case, the select Case settings.
  4. On the Case settings page, select Actions, and then select Delete case.