eDiscovery

Identify, preserve, collect, and review electronically stored information (ESI) for legal matters, investigations, and regulatory requests. eDiscovery provides a complete workflow from preservation through production.

Note: Core eDiscovery included with E3. eDiscovery (Premium) with advanced features requires Microsoft 365 E5 or E5 Compliance add-on.

eDiscovery Workflow

Identify — Determine custodians (people with relevant data) and data sources (mailboxes, sites, Teams) relevant to the matter.
Preserve — Place legal holds on identified data sources. Prevents modification or deletion even if users try to remove content.
Collect — Run searches to collect potentially relevant content. Use keywords, date ranges, and conditions to narrow results.
Process — (Premium) Extract text, metadata. Identify near-duplicates, email threads, and privilege content.
Review — (Premium) Attorneys review documents in review sets. Tag for relevance, privilege, responsiveness.
Export — Export for production. Native format, PDF, or load files for external review platforms.

Case Management

Core eDiscovery Cases

Basic case container for holds, searches, and exports. Suitable for internal investigations and simple legal matters.

Create holds on mailboxes and sites
Run content searches
Export search results
Basic case permissions

eDiscovery (Premium) Cases

Full-featured case management for complex litigation. Includes custodian management, review sets, and analytics.

Custodian management with notifications
Review sets for document review
Advanced analytics (themes, clustering)
Predictive coding and relevance

Custodian Management (Premium)

Add Custodians

Identify individuals relevant to the case. Automatically discover and add their mailbox, OneDrive, Teams, and Yammer data sources.

Hold Notifications

Send legal hold notices to custodians. Track acknowledgments. Send reminders automatically. Maintain defensible process.

Non-Custodial Data

Add data sources not tied to a person: shared mailboxes, team sites, public folders, or inactive mailboxes.

Review Sets (Premium)

Review sets are containers for collected content with advanced review tools:

Document Viewer — Native view of documents, text view with search hits, annotate and redact
Tagging — Custom tag panels, Responsive/Non-responsive, Privileged/Not privileged
Analytics — Near-duplicate detection, email threading, themes identification
Filtering — Date, custodian, file type, inclusive email (unique content), pivot (unique per family)

Export Options

Native Format — Export files in original format (PST for email, native for documents)
PDF Conversion — Convert all files to PDF. Includes burned-in redactions. Common for court productions.
Load Files — Generate load files (Concordance, Relativity) for import into external review platforms.
Export Report — Summary of exported items, errors, excluded items. Provides audit trail for defensibility.

Permissions

eDiscovery Manager — Can create and manage cases they’re a member of. Can’t access cases they don’t belong to.
eDiscovery Administrator — Can access all cases in the organization. Add/remove case members. Full administrative rights.
Reviewer — Can view and tag documents in review sets. Cannot run searches or modify holds.

Best Practices

Place holds early — Once litigation is anticipated, place holds immediately to preserve evidence
Document your process — Keep records of searches, holds, and decisions for defensibility
Use query-based holds — Narrow holds to relevant content to avoid over-preservation costs
Release holds when matter closes — Remove holds after legal obligation ends to allow normal deletion

API Reference

GET /api/compliance/ediscovery/cases — List all eDiscovery cases
POST /api/compliance/ediscovery/cases — Create new eDiscovery case
GET /api/compliance/ediscovery/cases/:id/holds — List holds in a case
POST /api/compliance/ediscovery/cases/:id/holds — Create legal hold
POST /api/compliance/ediscovery/cases/:id/export — Export case content