Week 8, Day 2 — eDiscovery

Day 1 review — from preservation to discovery

• Ask: "Yesterday you verified that Retention-Test.docx survived deletion and appeared in the Preservation Hold Library. What would you use to actually find and retrieve that file for a legal request?" — eDiscovery. Retention preserves; eDiscovery finds and exports.
• Ask: "The Lakeview Logistics legal team has been notified of a potential dispute involving Priya Nair's Finance activities over the past six months. Before litigation begins, what is the most important immediate action to protect relevant data?" — place Priya's mailbox and the Finance SharePoint site on a legal hold. A retention policy alone is not enough — a hold specifically prevents any automatic deletion, including by the retention policy's own expiry action.
• Frame the day: eDiscovery is the process of identifying, preserving, collecting, and producing electronically stored information (ESI) for legal proceedings. It is one of the most operationally sensitive tasks an IT admin performs — errors can expose the organisation to sanctions. Today covers the mechanics: creating a case, placing holds, running searches, and exporting results.

eDiscovery — cases, holds, searches, and exports

The eDiscovery workflow

• eDiscovery Standard vs Premium — Standard (included in E3/E5) provides: case management, query-based search across all M365 workloads, hold management, and export. Premium (requires E5 or add-on) adds: custodian management, advanced analytics (near-duplicate detection, email threading), predictive coding (AI-assisted relevance scoring), and review sets. Today's lab uses Standard — which is what most IT admins encounter in practice.
• Legal holds vs retention policies — a retention policy ensures content is kept for a defined period, then deleted. A legal hold (eDiscovery hold) suspends all deletion — including deletion that would normally occur when a retention policy expires. Hold overrides retention. A mailbox on a legal hold retains everything indefinitely until the hold is explicitly released. This is why placing a hold is the first action when litigation is anticipated.
• Query-based searches — KQL — eDiscovery searches use Keyword Query Language (KQL), the same query language used by SharePoint search and Exchange content search. Examples: subject:"invoice" AND from:priya.nair, received:2024-01-01..2024-06-30 AND "credit card", kind:email AND attachment:*.xlsx. Date ranges, senders, keywords, file types, and attachment names can all be combined.
• Export formats — eDiscovery exports produce: PST files (Outlook-compatible email archive for Exchange content), native format files (Word, Excel, PDF for SharePoint/OneDrive content), a manifest CSV (index of all exported items), and a results log. The export package is typically delivered to external legal counsel or a litigation support vendor for review in specialised review platforms.
• Permissions required — eDiscovery requires the eDiscovery Manager or eDiscovery Administrator role in the Purview compliance portal. Global Admins do not automatically have eDiscovery access — this is by design (separation of duties between IT operations and legal compliance). In this lab, the Global Admin account is assigned the eDiscovery Manager role before the lab begins.

Lab 8-B: eDiscovery case, legal hold, search, and export

Students assign the eDiscovery Manager role to their admin account, create a Standard eDiscovery case for the Lakeview Logistics Finance investigation, place Priya Nair's mailbox and the Finance SharePoint site on a legal hold, run a KQL search for Finance-related content, preview the results, and initiate an export.

• Step 1 — Assign the eDiscovery Manager role (5 min)
  Navigate to purview.microsoft.com → Roles & scopes → Role groups.
  Find eDiscovery Manager. Click → Edit → Add members → add your admin account. Save.
  This role is required to create cases, manage holds, run searches, and export content. Without it, the eDiscovery section is visible but all actions are blocked.
• Step 2 — Create the eDiscovery case (8 min)
  Navigate to purview.microsoft.com → eDiscovery → Standard → + Create a case.
  · Case name: LL-2024-Finance-Investigation
  · Case number: LL-001
  · Description: Investigation into Finance team data handling — Payroll-Q4 external share incident
  Save. Open the case. You will see four tabs: Overview, Holds, Searches, Exports.
• Step 3 — Place Priya Nair's mailbox on a legal hold (12 min)
  Inside the case, navigate to the Holds tab → + Create.
  · Hold name: Priya Nair — Finance Investigation Hold
  · Locations: Exchange mailboxes → Choose users → Priya Nair
  · Also add: SharePoint sites → Choose sites → Finance SharePoint site URL
  · Query-based hold: enter finance OR payroll OR invoice OR "credit card" — this means only content matching these keywords is held, not the entire mailbox
  Save. Confirm the hold status shows as On.
  Record the hold statistics — how many items are estimated to be in scope.
• Step 4 — Run a content search across Finance content (15 min)
  Navigate to the Searches tab → + New search.
  · Search name: Finance Content — Last 6 Months
  · Locations: Priya Nair's mailbox + Finance SharePoint site + Finance OneDrive
  · KQL query: (payroll OR invoice OR "credit card" OR finance) AND (date>=2024-01-01)
  Adjust the date to be approximately 6 months before today.
  Run the search. While it processes (1–5 minutes), review the search statistics tab when available. Once complete, click Review sample to preview matched items without downloading.
• Step 5 — Review search results and statistics (10 min)
  In the search results, explore:
  · Total items matched
  · Size of matched content (MB)
  · Breakdown by location (Exchange vs SharePoint)
  · Sample items — click individual results to preview content
  · Condition report — which query conditions matched most items
  Record all statistics. Then refine the search: add a keyword to narrow results — e.g. add AND Payroll-Q4 to isolate the specific file from the Week 7 incident.
• Step 6 — Initiate an export (10 min)
  From the search results, click Export → Export results.
  · Export name: Finance-Investigation-Export-01
  · Output options: All items, including ones with unrecognised format, are encrypted, or weren't indexed for other reasons → Selected
  · Export Exchange content as: One PST file for each mailbox
  · Include: De-duplicated versions of Exchange items
  Submit the export. Navigate to the Exports tab. The export will show as In Progress — it generates a download key when complete.
  Record the export key and note the estimated size. You do not need to actually download the export package for this lab — the goal is to understand the export workflow.
  Note: The eDiscovery Export Tool (a Windows application) is required to download the actual export. Record what the download process would involve.

⭐ Bonus: Advanced KQL queries and eDiscovery Premium concepts

Reflection & preview

• Ask: "The LL — Email Retention 3 Years policy deletes emails automatically after 3 years. Priya's mailbox is on a legal hold. After 3 years, her emails would normally be deleted. What actually happens?" — the hold overrides the retention expiry. Her emails are preserved indefinitely until the hold is released. Then the retention policy clock resumes from where it was.
• Ask: "Legal counsel needs the export package by tomorrow morning. You initiated the export — how do they get it?" — download using the eDiscovery Export Tool with the export key, then transfer securely. The export package is not emailed — it is a local download that must be transferred via a secure channel.
• Preview Day 3: eDiscovery finds content. The audit log tells you exactly who did what and when. Day 3 uses the unified audit log to reconstruct the complete timeline of the Week 7 incident — every file access, every sharing action, every DLP match — and then introduces Insider Risk Management, which watches for behavioural patterns that indicate an insider threat before it becomes an incident.