Jaa

Search for eDiscovery (preview) activities in the audit log

  • Artikkeli

Important

This article applies only to the classic eDiscovery experience. The classic eDiscovery experience will be retired in August 2025 and won't be available as an experience option in the Microsoft Purview portal after retirement.

We recommend that you start planning for this transition early and start using the new eDiscovery experience in the Microsoft Purview portal. To learn more about using the most current eDiscovery capabilities and features, see Learn about eDiscovery.

eDiscovery (preview) activities that are performed in Microsoft Purview portal or in PowerShell are logged in the audit log. Events are logged when administrators or eDiscovery managers (or any user assigned eDiscovery permissions) perform the following tasks:

  • Creating and managing cases.
  • Creating and editing searches in cases.
  • Performing search actions, such as generating statistics, sample, and exporting from search.
  • Creating, editing, and removing holds from cases.
  • Creating review sets and perform review activities in cases.

For more information about searching the audit log, the permissions that are required, and exporting search results, see Search the audit log.

Tip

If you're not an E5 customer, use the 90-day Microsoft Purview solutions trial to explore how additional Purview capabilities can help your organization manage data security and compliance needs. Start now at the Microsoft Purview trials hub. Learn details about signing up and trial terms.

How to search for and view eDiscovery activities

  1. Go to the Microsoft Purview portal and sign in using the credentials for a user account assigned eDiscovery permissions.

  2. Select the Audit solution card.

  3. On the Search page, complete the following:

    1. In the Activities - friendly names drop-down list, under eDiscovery activities, select one or more eDiscovery activities to search for. For a complete list of all eDiscovery activities, see Audit log activities.

    Note

    The Activities - friendly names drop-down list also includes a group of activities named eDiscovery cmdlet activities that returns records from the cmdlet audit log.

    1. Select a date and time range to display eDiscovery events that occurred within that period.

    2. In the Users box, select one or more users to display search results for. Leave this box blank to return entries for all users.

    3. Select Search to run the search using your search criteria.

After the search results are displayed, you can select Filter results to filter or sort the resulting activity records. To view details about an activity, select the activity record in the list of search results. A Details fly out page is displayed that contains the detailed properties from the event record.

To display additional details, select More information. You can export the audit log search results to a .csv file, and then use the Excel Power Query feature to format and filter these records. For more information, see Export, configure, and view audit log records.

A client IP Address field is available for all activities performed in eDiscovery. If the IP Address column is blank for an activity, the activity was performed in the classic eDiscovery experience. All eDiscovery activities performed in eDiscovery (preview) include an IP address in the IP Address column.

eDiscovery activities

For a complete listing of all eDiscovery detailed properties and activities included in the audit log, see Audit log activities.