Become a Microsoft Purview eDiscovery Ninja
In this blog post, we share the top resources for eDiscovery users to become masters of the Microsoft Purview eDiscovery Premium solution! After each level, we offer you a knowledge check based on the training material you have just completed. The goal of the knowledge checks is to help ensure understanding of the key concepts that were covered.
The training sessions are split into eight different sections in order to better align with the Electronic Discovery Reference Model:
- Overview
- Getting Started
- Identification
- Preservation
- Collection & Processing
- Review & Analysis
- Production
- Advanced
Advanced eDiscovery in Microsoft 365 is now Microsoft Purview eDiscovery Premium!
Consistent with our One Microsoft philosophy, Microsoft Purview offers a comprehensive set of solutions across information protection, data governance, risk management, and compliance to help organizations govern and protect data across their multicloud, multi-platform data environment, while helping them meet their compliance requirements.
Previously, customers used Azure Purview for unified data governance and Microsoft 365 Compliance solutions to help protect their data and manage risks across their organization. We believe governance and compliance are inherently interrelated data management and business imperatives that should be treated in a unified fashion. That is why we are extending the Purview name and rebranding the combined data governance and compliance platforms to Microsoft Purview.
*This training will be updated on a quarterly basis to ensure you all have the latest and greatest material!
Microsoft Purview eDiscovery (Premium)
The Microsoft Purview eDiscovery (Premium) solution provides customers with the ability to identify, preserve, collect, process, analyze, review, and produce content that is responsive to your organization's internal and external investigations. Discovering and managing data is challenging. To help solve these challenges, we provide customers with tools that enable them to do more in-place eDiscovery in Microsoft 365, thereby reducing risks associated with either creating multiple copies or exporting content outside of your security and compliance boundaries. Using Microsoft Purview eDiscovery Premium, you can reduce the content and only export matter relevant content.
Glossary/Abbreviations
|
eDP |
eDiscovery Premium (formerly Advanced eDiscovery) |
|
eDS |
eDiscovery Standard (formerly Core eDiscovery) |
|
AeD |
Advanced eDiscovery |
|
EXO |
Exchange Online |
|
ODB/OD4B |
OneDrive (formerly OneDrive for Business) |
|
SPO |
SharePoint (formerly SharePoint Online) |
|
M365 |
Microsoft 365 |
|
ESI |
Electronically Stored Information, as defined in the Federal Rules of Civil Procedure, refers to any type of information that is created, used, and stored in digital form and accessible by digital means. |
|
Retention |
The amount of time an organization maintains information, taking into consideration its business, legal, regulatory, fiscal, and risk requirements. In M365, retention is managed using retention labels and policies. |
|
Preservation |
The process by which organizations retain relevant information when litigation is pending or reasonably anticipated. In M365, this is managed through hold policies. |
|
Data Sources |
These are the locations (EXO, SPO, OneDrive) of data that will be targeted for tasks in the eDiscovery case. |
|
Legal Holds (in-place holds) |
The process by which organizations preserve potentially relevant information when litigation is pending or reasonably anticipated. |
|
Collections |
A workflow that is comprised of a search that is executed within an Advanced eDiscovery case. Collections include user, keyword, data, etc. |
|
Review Sets |
A static set of documents that have been through processing tasks including embedded item extraction, additional indexing, and OCR Within a Review Set, users can analyze, query, view, tag, and export data. |
Overview
The Overview will familiarize you with eDiscovery (Premium) and showcases some typical use case scenarios.
- eDiscovery in M365 Introduction
- Course: Describe the eDiscovery capabilities of Microsoft 365 - Learn, 33 min, 9 Units
- Overview of eDiscovery (Premium)
- Advanced eDiscovery workflow
- Youtube Video: Learn how Advanced eDiscovery helps to support the modern ways users are collaborating, 15 min
- Course: Discover and analyze content in place using Advanced eDiscovery - Learn, 2hr 2 min, 10 Units
- Document: eDiscovery premium architecture
Getting Started
Getting Started will focus on considerations and tasks for a successful deployment and setup of Advanced eDiscovery, including user permissions, global & case settings, compliance boundaries, and case creation & management.
- Permissions
- Document: Assign eDiscovery permissions
- Document: Add or remove members from a case
- Settings
- Document: Configure global settings for eDiscovery (Premium)
- Document: Configure search and analytics settings
- Document: Manage jobs in eDiscovery (Premium)
- Compliance Boundaries
- Case Creation & Management
- Course: Manage Advanced eDiscovery - Learn, 34 min, 8 Units
- Document: Use the new case format in eDiscovery (Premium)
- Document: Close or delete a case
Ready for the Getting Started Knowledge Check?
Identification
Identification is used to identify potential sources of relevant information. Learning the location of potentially discoverable data is necessary to issue an effective legal hold or conduct a thorough investigation.
In the Identification section, learn how to identify and manage custodial and non-custodial data sources, how to use the custodian audit activity to identify additional relevant data sources, and recommended management of Teams and Yammer data in eDiscovery.
- Data Sources
- Document: Work with custodians and non-custodial data sources in eDiscovery (Premium)
- Document: Add custodians to an eDiscovery (Premium) case
- Document: Add non-custodial data sources to an eDiscovery (Premium) case
- Document: Import custodians in bulk
- Document: Manage custodians in an eDiscovery (Premium) case
- Teams and Yammer workflow
- Document: eDiscovery (Premium) workflow for content in Microsoft Teams
- Webinar: eDiscovery for Teams, 59 min
- Document: Overview of eDiscovery in Yammer
- View custodian audit activity
- Document: View custodian audit activity
- Document: Microsoft Purview Audit (Premium)
- Course: Track user and admin activity with Advanced Audit - Learn | Microsoft Docs, 1hr 5 min, 10 modules
- Blog: Harnessing Advanced Audit to power your forensic investigations in 5 steps (microsoft.com)
- Youtube Video: Microsoft 365 Advanced Auditing for forensic and compliance investigations
Ready for the Identification Knowledge Check?
Preservation
Preservation is triggered upon reasonable anticipation of litigation, requiring legal teams to promptly isolate and protect potentially relevant data in ways that are: legally defensible, reasonable, proportionate, efficient, auditable, broad but tailored, and mitigate risks.
In the Preservation section, learn how to manage in-place legal holds and send legal hold notifications using Communications.
- Legal Holds
- Legal Hold Notifications
Ready for the Preservation Knowledge Check?
Collection & Processing
Collection is the acquisition of potentially relevant electronically stored information (ESI) as defined in the identification phase of the electronic discovery process.
Processing is a set of automated actions on ESI to allow for metadata preservation, itemization, normalization of format, and data reduction. Typically, processing will create a copy of data to a new location (such as an Azure blob) while preserving the original data.
In the Collection/Processing section, learn the benefits of advanced indexing, error remediation, how to target and collect relevant content and reduce data volumes.
- Collections
- Document: Create a draft collection
- Document: Commit a draft collection to a review set
- Document: Collection statistics and reports
- Document: Build search queries in eDiscovery (Premium)
- Document: Keyword queries and search conditions for eDiscovery
- Advanced Indexing
Ready for the Collection & Processing Knowledge Check?
Analysis & Review
Analysis is often part of early case assessment will involve using analysis tools to develop a better understanding of the data in question through the detection of patterns, trends, and similarities.
Review is used to identify relevant data for production and gain a greater understanding of the factual issues in a case and where legal strategies can emerge and begin to develop based on the type of information that is found in the documents.
In the Analysis & Review section, learn how to manage review sets, search, view, and tag documents, and use analytics tools to power your review.
- Review Sets Administration
- Review Sets (Search, Review, Tag)
- Document: View documents in a review set in eDiscovery (Premium)
- Document: Query the content in a review set
- Document: Tag documents in a review set
- Document: Review conversations in eDiscovery (Premium)
- Document: Teams workflow in eDiscovery(Premium)
Ready for the Analysis & Review Knowledge Check?
Production (Export)
Production is the process of preparing ESI in an efficient and usable format to reduce cost, risk, and errors in a format that meets agreed production specifications and timelines.
In the Production section, learn how to export data for production, or additional processing and review.
- Exports
- Document: Export case data in eDiscovery (Premium)
- Document: Export documents from a review set
- Document: Export documents to your organization's Azure Storage account
- Document: Large cases in eDiscovery (Premium) (Preview)
Ready for the Production Knowledge Check?
Advanced
In the Advanced section, leverage additional features to enhance the eDiscovery (Premium) features.
- Graph API (beta)
- Predictive Coding/Continuous Active Learning (preview)
- Licensing
Ready for the Advanced Knowledge Check?
Additional Resources
- M365 Roadmap: Roadmap of upcoming features and changes Microsoft 365 Roadmap | Microsoft 365
- Message Center: Notifications and details of updated changes to M365 Message center - Microsoft 365 admin | Microsoft Docs – all solutions in the service
- Tech Community – Security and Compliance: Blogs, community forums, and more Security, Compliance, and Identity - Microsoft Tech Community – blogs
- NEW! Purview eDiscovery Playbook - Get step-by-step guidance and tips to maximize your eDiscovery investment with Microsoft in the eDiscovery Playbook from Epiq—the 2023 Microsoft Compliance Partner of the Year. https://aka.ms/eDiscovery/Playbook
- Meeting Modern eDiscovery Challenge White Paper
- Interactive User Guide: Get started with Microsoft Purview eDiscovery (Premium)
- IDC MarketScape: Worldwide eDiscovery Early Case Assessment 2022 Vendor Assessment: Read the excerpt.
- Additional Webinars: Register for new webinars and view past webinars for all M365 compliance tools, including eDiscovery: Webinars - Compliance Customer Experience Engineering (CxE)
Huge thanks to @Heather_Eckman and the entire eDiscovery CxE team for creating the eDiscovery Ninja page!