Manage custodians and non-custodial data sources

  • 8 minutes

Managing custodian and non-custodial data sources is essential for handling legal cases and investigations. Microsoft Purview eDiscovery (Premium) simplifies the process of tracking and distributing legal hold notifications, managing custodians, and automating the legal hold process.

When an organization responds to a legal investigation, the workflow includes identifying, preserving, and collecting potentially relevant content. This process is based on the individuals in the organization who are custodians of relevant data. In eDiscovery, these individuals are called data custodians. They're defined as persons having administrative control of a document or electronic file. For example, the custodian of an email message is the owner of the mailbox that contains the relevant message.

While there might be content located in mailboxes and sites that aren't associated with a custodian, it might still be relevant to the case. These content locations, where custodians don't have administrative control but might be owners of relevant data, are known as non-custodial data sources.

A legal hold preserves content that might be relevant to a legal case. Holds can be placed on custodians and their data sources or on non-custodial data sources. When content locations are placed on hold, the content is preserved until the hold is released. Holds ensure that relevant data isn't deleted or altered during an investigation.

Types of holds

  • Custodian holds: Applied to data sources associated with specific custodians, such as their Exchange mailboxes, OneDrive accounts, SharePoint sites, and Teams.
  • Non-custodial holds: Applied to data sources not directly associated with specific custodians, such as group mailboxes, SharePoint sites, and Teams.

A legal hold notification is a communication sent to employees or custodians of data that might be relevant to a legal investigation. These notifications instruct custodians to preserve electronically stored information and any content that might be relevant to an active or impending legal matter. Legal teams must ensure that each custodian received, read, understood, and agreed to comply with the given instructions.

  1. Issuance notice: A legal hold notice is issued to custodians with relevant information, instructing them to preserve necessary information.
  2. Re-issuance notice: Update and reissue hold notices as the scope of preservation changes.
  3. Release notice: Notify custodians when they're no longer required to preserve content.
  4. Reminders and escalations: Schedule reminders and escalations to follow up with unresponsive custodians.

Custodian management

Use the built-in custodian management tool in Microsoft Purview eDiscovery (Premium) to manage custodians and identify relevant data sources associated with a case. The system can automatically identify and place a hold on custodians' Exchange mailboxes and OneDrive accounts. Additional data sources, such as mailboxes, sites, or Teams, can also be associated with a custodian.

Steps to add and manage custodians

1. Identify custodians:

  1. Go to the Microsoft Purview portal or the Microsoft Purview compliance portal with an account that has eDiscovery permissions.
  2. Navigate to eDiscovery > eDiscovery (Premium) > Cases tab.
  3. Select the case, then go to the Data sources tab and select Add data source > Add new custodians.
  4. Add users as custodians by typing their names or aliases.

2. Choose custodian data location:

  • The system includes the primary mailbox and OneDrive account for each custodian.

  • Associate other data locations such as SharePoint sites or Teams with the custodian. Expand the custodian details to adjust data locations.

    Screenshot of the Select custodian screen with the Clear option highlighted for the user's Exchange mailbox and OneDrive account.

3. Configure hold settings:

  1. Place custodians on hold to preserve content in associated data locations until the hold is removed. Select the checkbox next to each custodian on the Hold settings page.
  2. Verify the custodian hold selections and then select Next.

4. Review the custodians and complete the process:

  1. Verify the list of custodians, their data locations, and hold settings.
  2. Select Submit to add custodians and their data locations to the case and apply hold settings.

Managing custodians and data sources

  • View custodian details: The Data sources tab lists all custodians added to the case. Select a custodian to view detailed information.

    Screenshot showing the custodians added in the Data sources tab.

  • Edit a custodian: Update the data sources associated with a custodian as needed. Select the custodian and choose Edit source. Adjust data locations and hold settings, then submit the changes.

  • Reindex custodian data: Indexing is the process of organizing data so it can be quickly searched and retrieved. In the context of eDiscovery, indexing ensures that all relevant content is searchable and can be efficiently located during an investigation. Sometimes, items might be partially indexed due to large file sizes or data corruption, making it difficult to retrieve all relevant data accurately.

    To reindex custodian data and ensure comprehensive and accurate search results:

    1. Go to eDiscovery > eDiscovery (Premium) and open the case.
    2. Select the Data sources tab.
    3. Select the custodian whose data needs to be reindexed.
    4. On the flyout page, select Update index. Confirm the index update by selecting Yes.

    Reindexing is a long-running process. You can track the progress on the Jobs tab or the Custodians tab by monitoring the status in the Indexing job status column.

    Reindexing ensures that all relevant data is included and accurately represented in search results, which is crucial for thorough legal investigations.

  • Release a custodian: When a case is closed or a custodian is no longer relevant, select the custodian and choose Release to remove holds and update the custodian's status.

Retry hold action

If the hold status isn't correctly applied, select the custodians and select Retry hold action.

Managing custodian and non-custodial data sources in Microsoft Purview eDiscovery (Premium) ensures thorough and compliant handling of legal investigations, simplifying the preservation, collection, and review of relevant data.