Now do more with Advanced eDiscovery – custodian communications, working sets, and review

Published 01-29-2019 09:00 AM 24.1K Views

Today, we are excited to announce new capabilities in Advanced eDiscovery that directly respond to customer feedback on how they need to be able to do more with the built-in discovery tools in Microsoft 365. We have heard that organizations require expanded capabilities to complete more of common investigation and discovery workflows right within Microsoft 365.


Now we are starting to rollout a new version of Advanced eDiscovery that includes a new look and feel, additional functionality such as hold notifications and acknowledgment tracking, and a concept of a static set of content for performant searches as well as an integrated review and redact experience.

With these new updates we hope to more directly meet customer requirements for an efficient and effective way to preserve, collect and review content related to investigations or litigation.


Microsoft’s director of discovery, EJ Bastien has stated that even as “data from the average custodian has increased 20x over the last ten years, our team has reduced the cost per custodian of completing this eDiscovery work by 85%. While also maintaining high security standards of keeping data in place within the Microsoft cloud.” The capabilities integrated into Microsoft 365 have enabled Microsoft discovery to change the playing field on meeting legal and investigation requirements. 



Read on below for more on the new features and check out the Mechanics video where we show and tell a bit about how the capabilities work.


Manage custodians and notifications

Customers have told us they need to be able to manage custodians, or employees in their organization related to a particular case or investigation, from both the perspective of the content the custodian controls and manages in their email inbox and cloud storage, but also from the perspective of the shared locations that those employees interact with as part of their daily job such as team sites, groups, and channels. In addition to retention and discovery, we have also heard that organizations require a way to communicate to those custodians that are legal hold within their organization. Not only communicate with custodians, but track the fact that the custodians have been notified. Now you can manage complete that entire process right within your Advanced eDiscovery experience.


Search to add custodians and their custodial content locations, add sites and teams that they are members of from the shared locations picker, and place their content on hold for retention and discovery purposes. With the new custodial picker experience, you have a quick look up from Azure Active Directory in your organization to quickly find and identify individuals by name or organization identification alias.



Use templates to build out commonly used communications, escalate with reminders and or manager notifications. And the end user gets a clean experience showing them all of their active legal holds or other case related notifications.


Manage case content with consistency and performance using working sets

We have also heard that search and content processing needs to be higher performing, more predictable and transparent. Customers have told us that any variability in search results erodes confidence and ability to effectively complete the requirements of some eDiscovery processes. In addition, defensibility of the results is weakened, and it is just harder to get things done quickly and efficiently.


In order to help address this challenge and others, now you can isolate the set of results from a search and add it to a working set for further analysis, processing and refinement. Once this content is included in a working set you have a number of ways that you can interact with that content, all of which help you define and address the most responsive and relevant content in your case or investigation.


Customers are continuing to derive value form the advanced analytics capabilities already included in Advanced eDiscovery as the core vehicle to reduce and refine content. This reduction helps to drive down redundant, duplicative or highly related content and reduce the costs of eDiscovery.


Integrated review and redact experience

Now organizations can review and take action on the content within their case right within Microsoft 365. A new integrated review experience offers the ability to view a wide variety of file types, including jpgs, all office files, mp4s and more, and to take action on that content. Either tag and further refine content based on its responsiveness, or annotate, mark-up and redact content that might be sensitive and should not be shared with outside parties.


The new review experience includes a native, text and annotate view to provide options to support the various ways your team assess content. In addition, a customizable coding panel helps make sure that you are able to effectively tag and triage and organize the content under review. Further insights such as document history, other contributors to the document and views like difference detection in near duplicates will help speed the process to identify and curate the most responsive content.


Watch the short video and read more about this new review and redact experience here.




Data Investigations preview

Also today, we are announcing a new preview for a Data Investigations capability that helps IT and security operations search and take action on specific data in their organizations. Many organizations need to address scenarios like leaked confidential information, or investigating data breaches with this type of data remediation workflow. These scenarios are important as the risk to data security and privacy expectations continue to evolve. IT and privacy officers now have the tools to respond to any kinds of risk to personal, sensitive or business confidential information effectively and efficiently with this new solution.


The new capability, starting to roll out to preview today, includes the ability to execute targeted searches for specific content based on a variety of conditions, then investigate user activity around relevant content, and contain and ultimately remediate the leaked content at the source. Read more about the early look at this new capability here


Ready to get started?


Make sure you have Office 365 E5, Advanced Compliance, or Microsoft 365 Information Protection and Compliance to get started today with these new features.


Read more about Advanced eDiscovery in Microsoft 365, see our broader updates and webcast on privacy and compliance in the modern era of privacy expectations and engage with us in our Tech Community .

  • Iram Arras, Sr Program Manager, Advanced eDiscovery Microsoft 365
Occasional Contributor

@Iram Arras Is the early look information on the Data Investigations preview available for general access? I get a 503 error when trying to access it.


"The new capability, starting to roll out to preview today, includes the ability to execute targeted searches for specific content based on a variety of conditions, then investigate user activity around relevant content, and contain and ultimately remediate the leaked content at the source. Read more about the early look at this new capability here."

Occasional Contributor

"Watch the short video and read more about this new review and redact experience here."


@Iram Arras Is there a link available for this one?

Occasional Contributor

@Iram Arras Can jobs and sub jobs be assigned to one of the members of the case, for task allocation and tracking?


@Michael Sampson We started rolling out the new features into production tenants starting this week.  The rollout will probably take a few weeks to reach all tenants so you should see the new features soon.  Regarding review and redaction video, there is an embedded video in the blog.  Link here: .  Regarding jobs assignment, this is something we're currently considering.  Thanks for the suggestion!

Occasional Contributor

Thanks @Iram Arras. Appreciate the insight. I watched the review and redaction video above, but your sentence makes it sound like there is a Microsoft Docs article as well to read. Perhaps I misinterpreted the line " ... and read more about this new review and redact experience here" - but there's no link on the "here." 

Occasional Contributor

@Iram Arras I'm unclear about who the new Advanced Discovery offering is for, and wondered if you could clarify please. There's already an Advanced Discovery offering in Office 365 E5, and I assumed this was an update to that current offering. However, the wider announcements Microsoft made last week for compliance and security stressed the new capabilities were for Microsoft 365 subscribers, not just Office 365 only. 


So ... is that an update to Advanced Discovery in Office 365 E5, or a new separate offering just for Microsoft 365 subscribers? Thanks.


Hi @Michael Sampson thanks for your feedback and comments. I can see how this might be confusing, this is an update to the existing Advanced eDiscovery that is included in Office 365 and Microsoft 365 advanced compliance plans. The existing Advanced eDiscovery experience will continue to run side by side with the new experience for the foreseeable future given the long running nature of some cases for our customers, but overtime the new Advanced eDiscovery experience will converge with existing. This new experience is available to you if you own Office 365 E5, Advanced Compliance add-on or Microsoft 365 E5, or Information Protection and Compliance add-on. Hope that helps. 

Senior Member

@Iram Arras I have several clients waiting to test/use the advanced eDiscovery features. It's been almost 1 month since the announcement. Any update on the rollout? Can this be pushed to MSFT demo tenants?


@Larry-M we're still in the process of flighting tenants.  It should reach world wide by end of March.  I'll contact you directly to discuss a plan for our mutual customers.

Occasional Contributor

As I look into this, particularly in other supporting documentation such as

I am confused as to the difference between eDiscovery (in E3), and Advanced eDiscovery (E5). This article implies you do everything from Advanced eDiscovery. I always thought you started determining custodians, starting legal hold, and initial queries in eDiscovery, then if you had an E5, you could refine quires, dedup, etc, and then export.


Also, previous attempts to export on Mac didn't work because export seemed to have a reliance on Edge browser? Is this still the case? Is Edge necessary, because export did not work on Windows with Chrome browser either.



Michael Cherry


Hello @Michael Cherry, the previous notion of Core eDiscovery and Advanced eDiscovery is changing.  In this new release, all of the workflow is called Advanced eDiscovery (custodian management, holds, hold notices, search, review and export).  Also, there is no longer a browser specific utility required for exports.  We integrated several new featured throughout the process so please let us know what you think!


Version history
Last update:
‎May 11 2021 03:44 PM
Updated by: