Review and manage case content

10 minutes

Review sets are static sets of documents where you can analyze, query, view, tag, and export data in a case. They provide a centralized location to manage and review all relevant data, ensuring thoroughness and compliance in legal proceedings. Review sets allow you to organize your data efficiently, making it easier to locate and analyze specific information.

Create a review set

To start reviewing case content, you first need to create a review set:

Navigate to the eDiscovery (Premium) solution in the Microsoft Purview portal or the Microsoft Purview compliance portal.
Select the case you want to work with and go to the Review sets tab.
Select + Add review set.
Name your review set and select Save. The new review set is displayed in the list on the Review sets tab.

Adding data to a review set can be done in three ways:

Reviewing and analyzing data in a review set allows for efficient data management, ensuring that all relevant information is captured and evaluated. This step is crucial for identifying trends, verifying the relevance of documents, and preparing data for legal review and export.

Grouping documents

Grouping documents in a review set helps in organizing and navigating through the data:

Group by Group ID and Thread ID: This is recommended for new cases as it makes it easier to find and review related items.
Group by Family ID and Conversation ID: This method is used for existing cases with pre-March 15, 2023, settings.

Configure review set grouping settings for a case

To configure review set grouping settings for a case:

On the eDiscovery (Premium) page, select the case.
On the Settings tab, under Review sets, choose Select.
On the Review sets page, select the Enable group toggle to enable grouping review set items by Group ID and Thread ID.

Viewing documents

Viewing documents in various formats can provide different insights:

Source view: Displays the richest view of a document, similar to its native format.
Plain text view: Provides a simple text version, useful for quickly understanding content.
Annotate view: Allows for markup and redactions, crucial for sensitive information.
Metadata view: Displays metadata associated with the document, helping in detailed analysis.
Copilot activity view: Shows Microsoft Copilot for Microsoft 365 activity related to the item.

Query and filter content

Querying and filtering content in a review set is a critical part of the eDiscovery process. It allows you to focus on the most relevant documents and streamline the review process.

Advanced filters

Advanced filters provide flexibility and precision when searching through a review set. These filters allow you to build complex queries using various conditions and operators.

Quickly search for filter conditions.
Create complex filters using subgroups, AND, or OR conditions.
Easily change your queries with Undo filter query and Redo filter query controls.
Manage saved filters without having to navigate to another area.
Use Is empty and Is not empty conditions for each filter.

A review set displays a maximum of 1,000 items per page and up to 10 pages (for a total of 10,000 items displayed per review set). Use default or custom filters to adjust the displayed items as needed. Matched item counts are estimates.

Advanced filter controls

Use these controls to create custom filters for your review set:

AND/OR: Select the query condition that applies to specific filters and filter subgroups.
Select a filter: Choose filters for the specific data sources and location content.
Add filter: Add multiple filters to your query after defining at least one query filter.
Select an operator: Depending on the selected filter, choose operators such as Before, After, and Between.
Value: Set specific values for each filter.
Add subgroup: Add a subgroup to refine results further.
Remove a filter condition: Remove individual filters or subgroups.
Clear all: Clear all filters and subgroups.

Filter types

Freetext filters: Search text fields for specific terms.
- Example: Search the subject field for "Quarterly Report".
Date filters: Filter documents based on date fields.
- Example: Find documents modified after January 1, 2023.
Search options filters: Select from a list of possible values for specific fields.
- Example: Filter by specific email senders.
Keyword filters: Use KQL-like query language to build advanced search queries.
- Example: Search for emails containing "merger" NEAR "confidential".

Save and manage filter queries

After creating a filter combination, save it as a filter query for future use:

Select Save on the Save filter queries command bar and name it.
To run a saved filter query, select it from the Saved filter queries dropdown.
To edit or delete a saved filter query, expand its properties and select Edit or Delete.

Use query language support for KQL and keyword filters

When using the KQL or Keyword filters, you can use a KQL-like query language to build your review set search query. The query language supports standard Boolean operators such as AND, OR, NOT, and NEAR, as well as single-character wildcard (?) and multi-character wildcard (*).

Review filters only support wildcards (? or *) on a single term. Using wildcards in searches on phrases consisting of multiple terms isn't supported.

Example: Find documents of certain types, such as PDFs or emails:

Select the Native file extension filter.
Use the "Equals any of" operator.
Select the desired file types (for example, .pdf, .msg).
Apply the filter to display only the selected file types.

Filtering partially indexed items

If you selected the option to add partially indexed items from additional data sources when committing the collection estimate to a review set, you might want to identify and view those items:

Create and commit a collection without partially indexed items.
Commit a copied collection with partially indexed items.
In the review set, select Load sets and note the Load Id for the second collection.
Use the Load Id filter to display partially indexed items.

Tagging documents

Tagging is essential for organizing content and facilitating various workflows:

Single-select tags restrict reviewers to one tag within a group, preventing conflicting tags.
Multi-select tags allow multiple selections within a tag group, providing flexibility.
Use tag templates to standardize tags across all cases, ensuring consistency.
Apply tags through the tagging panel, configuring settings to tag selected items or all items in the list.

Exporting data

Exporting data from a review set involves copying items to a secure Azure Storage location and downloading them using Azure Storage Explorer. The export package includes data files, an export report, a summary report, and an error report. This step ensures that all relevant data is preserved and accessible for legal review.

Advanced review tools

Copilot for Security

Microsoft Copilot for Security can summarize items in a review set, providing quick insights:

Open a review set and select an item.
Select Summarize to get a contextual summary of the item.
Use suggested prompts or ask open-ended questions for detailed insights.

Using the dashboard

The eDiscovery (Premium) dashboard helps in analyzing your corpus quickly:

Create widgets to visualize data trends.
Apply conditions to create search queries based on widget data.
Save queries for future use, ensuring efficient data management.

Guest access

Enabling guest access allows external reviewers to participate in eDiscovery (Premium) cases. Configure guest access settings in Microsoft Entra ID and invite guests to specific cases. This feature is useful for involving external partners, vendors, or consultants in the review process.

Explore how to collect and review Microsoft Teams content

View a video version of the interactive guide (captions available in more languages).

Be sure to select the full screen option in the video player.

Explore how to export data