Implement Microsoft Purview eDiscovery (Premium)
Microsoft Purview eDiscovery (Premium) provides an end-to-end workflow to manage data for internal and external investigations. While deployment requires no additional setup, some prerequisite tasks are necessary.
Step 1: Verify and assign appropriate licenses
Licensing for eDiscovery (Premium) requires the following organization subscription and per-user licensing:
- Organization subscription: Microsoft 365 E5, Office 365 E5, Microsoft 365 E3 with E5 Compliance add-on, or Microsoft 365 Education A5.
- Per-user licensing: Users must be assigned an E5, A5, or appropriate add-on license.
Additional reading. For more information about licensing, download and see the "eDiscovery and auditing" section in the Microsoft 365 Comparison table.
Note
Users only need an E5 or A5 license to be added as custodians. IT admins, managers, and others who manage cases do not need these licenses.
Step 2: Assign eDiscovery permissions
Users must be assigned to the eDiscovery Manager role group. Members of this role group can:
- Create and manage eDiscovery (Premium) cases.
- Add and remove members.
- Place custodians and content locations on hold.
- Manage legal hold notifications.
- Create and edit searches associated in a case.
- Add search results to a review set.
- Analyze data in a review set.
- Export and download search results from an eDiscovery (Premium) case.
Complete these steps to add users to the eDiscovery Manager role group:
Navigate to modify the eDiscovery Manage role group in either the Microsoft Purview portal or the Microsoft Purview compliance portal:
- In the Microsoft Purview portal: Select the Settings card > Roles and scopes > Role groups.
- In the Microsoft Purview compliance portal: Roles & scopes > Permissions > Microsoft Purview solutions > Roles.
Select the eDiscovery Manager role group > Edit.
Select Choose users to add users to the role group.
Select Save to add the users to the role group, and then select Close to complete the process.
Role group details
There are two subgroups in the eDiscovery Manager role group. The difference between these subgroups is based on scope.
eDiscovery Manager: Manages and views their own cases.
eDiscovery Administrator: Manages and views all cases in the organization
Important
Because of the broad scope of access, an organization should only have a few administrators who are members of the eDiscovery Administrators subgroup.
Step 3: Configure global settings for eDiscovery (Premium)
Before users can create and use cases, configure global settings. The only global setting currently is attorney-client privilege detection. This model uses machine learning to identify legal content and compares document participants with a submitted attorney list.
Additional reading. For more information about setting up and using the attorney-client privilege detection model, see Set up attorney-client privilege detection in eDiscovery (Premium).
Note
This step is optional and can be performed at any time. Not implementing the attorney-client privilege detection model doesn't prevent an organization from creating and using eDiscovery (Premium) cases.
Manage the workflow
- Add custodians and data sources: Add custodians and non-custodial data sources to the case. Custodians are individuals with administrative control of relevant documents, while non-custodial data sources are relevant data not associated with specific users. Data in the custodian's Exchange mailbox, OneDrive account, and Microsoft Teams or Viva Engage groups can be marked as custodial data. Custodian and non-custodial data is reindexed through advanced indexing. You can place a hold on data to preserve it during the investigation and use the communications workflow to send legal hold notifications.
- Collect relevant content: Use the collections tool to search data sources for relevant content. Build search queries with keywords, properties, and conditions to find the most pertinent data. View collection statistics, preview a sample, and revise queries as needed.
- Commit to a review set: Add search results to a review set, copying items to a secure Azure Storage location. Data is reindexed for thorough and fast searches during review. You can also add non-Office 365 data into a review set, and use conversation review sets for threaded conversations.
- Review and analyze data: Use various tools to view and analyze case data, reducing it to what is most relevant. Group and view documents, create search queries and filters, apply tags, annotate and redact documents, and run analytics to optimize data review.
- Export and download data: Export data from the review set to an Azure Storage location, then download it to a local computer using Azure Storage Explorer. The export package includes data files, an export report, a summary report, and an error report.
Explore how to establish permissions and create a case
View a video version of the interactive guide.
Be sure to select the full screen option in the video player.
Knowledge check
Choose the best response for the following question.