eDiscovery in Office 365

Electronic discovery, or eDiscovery, is the process of identifying and delivering electronic information that can be used as evidence in legal cases. You can use eDiscovery in Office 365 to search for content in Exchange Online mailboxes, Office 365 groups, SharePoint Online and sites, and Skype for Business conversations. If you only need to search mailboxes, you can use In-Place eDiscovery in the Exchange admin center (EAC). If you need to search mailboxes and sites in the same eDiscovery search, you can use Content Search in the Office 365 Security & Compliance Center. In both cases, you can identify, hold, and export content found in mailboxes and sites.

Office 365 provides the following eDiscovery tools:

Content Search in the Office 365 Security & Compliance Center

The following table contains links to topics that will help you use the Content Search tool in the Security & Compliance Center.

Topic

Description

Run a Content Search in the Office 365 Security & Compliance Center

Learn how to use the Content Search tool to search mailboxes, public folders, Office 365 groups, SharePoint Online sites, and One Drive for Business locations in your Office 365 organization in a single search.

Keyword queries and search conditions for Content Search

Learn about the email and file properties and search conditions you can use to search for content in mailboxes and sites in your Office 365 organization.

View keyword statistics for Content Search results

Learn how to use search statistics to display and compare the statistics for one or more content searches, and to configure new and existing searches to return statistics for each keyword in the search query.

Export search results from the Office 365 Security & Compliance Center

Learn how to export the results of a Content Search.

Export a Content Search report

Learn how to download the export report without having to export the actual search results.

Limits for Content Search in the Office 365 Security & Compliance Center

Learn about the limits of the Content Search tool, such as the maximum number of searches that you can run at one time.

Unindexed items in Content Search

Learn about unindexed items in Exchange and SharePoint that you can include in the estimated search result statistics when you run a search. You can also include unindexed items when you export search results.

Search for and delete email messages in your Office 365 organization

Learn how to use Content Search to search for and delete an email message from all mailboxes in your organization. This can help you find and remove potentially harmful or high-risk email.

Use Content Search to search the mailbox and OneDrive for Business site for a list of users

Learn how to use a script to search the mailbox and One Drive for Business site for a group of users. Use Step 2 in this topic to quickly generate a list of email addresses that you can use for the source content locations when you create and run the search in Step 3.

Create, report on, and delete multiple Content Searches

Learn how to use scripts to create multiple Content Searches, run reports to get the estimated results for each search, and then delete the searches. This can help you to quickly and efficiently identify and cull search data.

Clone a Content Search in the Office 365 Security & Compliance Center

Learn how to use the use the Windows PowerShell script in this article to quickly clone an existing Content Search. This can help you compare the results of different keyword search queries run on the same content locations or save time because you don't have to re-enter a large number of content locations when you create a new search.

Configure permissions filtering for Content Search

Learn how to use permissions filtering to let an eDiscovery manager search only a subset of mailboxes and sites in your Office 365 organization.

Use Content Search to search third-party data that was imported to Office 365

Learn how to use the kind and itemclass message properties to search third-party data that you imported to Office 365.

Return to top

eDiscovery Cases in the Office 365 Security & Compliance Center

The following table contains links to topics that will help you use eDiscovery cases in the Security & Compliance Center. Use cases to add members who can access the case, place a hold on content locations relevant to the case, associate multiple Content Searches with the case, and export the search results from the case.

Topic

Description

Manage eDiscovery cases in the Office 365 Security & Compliance Center

Learn how to create and manage eDiscovery cases in the Security & Compliance Center.

Video - play Here's a video that shows you how to assign permissions, create a case and add members, run a Content Search, and place content locations on hold.

Assign eDiscovery permissions in the Office‍ 365 Security & Compliance Center

Learn how to assign eDiscovery permissions in the Security & Compliance Center. You can assign permissions to let users create eDiscovery cases, create holds associated with an eDiscovery case, run Content Searches, preview search results, and export search results.

Return to top

In-Place eDiscovery in Exchange Online

The following table contains links to topics that will help you learn about and manage In-Place eDiscovery in your Exchange Online organization.

Topic

Description

In-place eDiscovery

Learn all about In-Place eDiscovery in Exchange Online.

Create an In-Place eDiscovery Search

Learn how to create an In-Place eDiscovery search. For details about estimating and previewing eDiscovery search results, see Estimate or preview search results.

Message properties and search operators for In-Place eDiscovery

Learn which email message properties can be searched using In-Place eDiscovery. The topic provides syntax examples for each property, information about search operators such as AND and OR, and information about other search query techniques such as using double quotation marks (" ") and prefix wildcards.

Search limits for In-Place eDiscovery in Exchange Online

Learn about the limits applied to In-Place eDiscovery searches in Exchange Online and Office 365. These limits help maintain the health and quality of services provided to organizations. The topic also provides suggested workarounds for some of the limits.

Search and delete messages

Learn how to use the Search-Mailbox cmdlet to search for and delete email messages.

Create a discovery mailbox

Learn how to use Remote PowerShell to create a discovery mailbox and assign access permissions.

Add a user to the Discovery Management role group

Learn how to give a user access to use In-Place eDiscovery in the EAC to search mailboxes. Adding a user to the Discovery Management role group also allows the person to use the eDiscovery Center in SharePoint Online to search Exchange mailboxes.

Export eDiscovery search results to a PST file

Learn how to export the results of an eDiscovery search to a PST file.

Copy eDiscovery search results to a discovery mailbox

Learn how to copy the results of an eDiscovery search to a discovery mailbox.

Start or stop an In-Place eDiscovery search

Learn how to start, stop, and restart eDiscovery searches.

Unsearchable items in Exchange eDiscovery

Learn about mailbox items that can’t be indexed by Exchange Search and are returned in eDiscovery search results as unsearchable items.

Remove an In-Place eDiscovery search

Learn how to delete an eDiscovery search.

Modify an In-Place eDiscovery search

Learn how to modify an existing eDiscovery search.

Using OAuth authentication to support eDiscovery in an Exchange hybrid deployment

Learn about the eDiscovery scenarios in an Exchange hybrid deployment that require you to configure OAuth authentication.

Create a custom management scope for In-Place eDiscovery searches

Learn how to use custom management scopes to limit the mailboxes that a discovery manager can search.

Delete and re-create the default discovery mailbox in Exchange

Learn how to delete the default discovery mailbox, re-create it, and then reassign permissions to it. Use this procedure if this mailbox has exceeded the 50 GB limit and you don’t need the search results.

Reduce the size of a discovery mailbox in Exchange

Use this process to reduce the size of a discovery mailbox that’s larger than 50 GB.

Return to top

The eDiscovery Center in SharePoint Online

The following table contains links to topics that will help you learn about and use the eDiscovery Center in SharePoint Online.

Topic

Description

Set up an eDiscovery Center in SharePoint Online

Learn how to set up an eDiscovery Center in SharePoint Online. This includes creating an eDiscovery Center, configuring it to search Exchange mailboxes, and assigning permissions to enable discovery managers to search SharePoint sites and Exchange mailboxes. After you set up an eDiscovery Center, users with the required permissions can create eDiscovery cases, place content on hold, run eDiscovery searches, and export search results.

Assign eDiscovery permissions to OneDrive for Business sites

Learn how to assign permissions to an administrator or compliance manager so they can use the eDiscovery Center to search OneDrive for Business sites in your organization.

Plan and manage eDiscovery cases

Learn how to create and use eDiscovery cases, which allow you to identify, hold, search, and export content from Exchange mailboxes and SharePoint sites.

Add content to an eDiscovery case and place sources on hold

Learn how to place a content source, such as a SharePoint site or an Exchange mailbox, on hold so that content relevant to a legal case is preserved.

Searching and using keywords in eDiscovery

Learn how to create keyword searches to narrow the scope of an eDiscovery search. After you place content on hold, you can further refine your search by using keywords, date ranges, author/recipients, domains, and proximity searches.

Search all mailboxes and sites using the eDiscovery Center

Learn how to search all Exchange mailboxes, SharePoint sites, and OneDrive for Business sites in your organization in a single search in the eDiscovery Center.

Create and run eDiscovery queries

Learn how to run search queries to extract exactly the content you need for an eDiscovery case.

Export eDiscovery content and create reports

Learn how to export content from an eDiscovery case when you are ready to deliver it to an authority or want to work on it with another legal program. You can also create reports to identify the contents that were exported and to identify any search indexing issues.

Default crawled file name extensions

Learn which file types in SharePoint Online are indexed for eDiscovery.

Return to top

Office 365 Advanced eDiscovery

The following table contains links to topics that will help you learn about and use the Advanced eDiscovery tool in Office 365.

Topic

Description

Office 365 Advanced eDiscovery

Learn how the Advanced eDiscovery tool can help you analyze data in Office 365, streamline document reviews, and make decisions for efficient eDiscovery.

Prepare search results for Office 365 Advanced eDiscovery

Learn how to prepare the results of a Content Search in the Security & Compliance Center so you or other reviewers can analyze those results with Advanced eDiscovery.

Quick setup for Advanced eDiscovery

Learn how to get started using Advanced eDiscovery.

Prepare search results for Office 365 Advanced eDiscovery

Learn prepare the results from a Content Search for analysis in Advanced eDiscovery.

Setting up users and cases in Office 365 Advanced eDiscovery

Learn how to configure user roles, create cases, and assign users to cases in Advanced eDiscovery.

Running the Process module and loading data

Learn the guidelines for preparing case files for analysis with Advanced eDiscovery.

Analyzing case data with Advanced eDiscovery

Get an overview of the Analyze process, which allows you to set parameters, run options, and view results in Advanced eDiscovery.

Managing Advanced eDiscovery Relevance setup

Read the recommendations for setting up Relevance training in Advanced eDiscovery to score files by their relevance and generate analytical results.

Using the Advanced eDiscovery Relevance module

Learn about the Relevance module in Advanced eDiscovery, including a workflow and guidelines and steps for training and file review.

Exporting case data with Advanced eDiscovery

Understand the guidelines for exporting eDiscovery case data and results for external review.

Return to top

Share Facebook Facebook Twitter Twitter Email Email

Was this information helpful?

Great! Any other feedback?

How can we improve it?

Thank you for your feedback!

×