Managing standard eDiscovery cases in Microsoft 365 is a fundamental part of the MS-203 Microsoft 365 Messaging exam. eDiscovery, or electronic discovery, is an essential part of the modern legal process. It provides the ability to search, locate, and secure electronic data for use as evidence in a legal case.
Microsoft 365 provides an eDiscovery tool that helps identify, preserve, analyze, and export content that’s relevant to legal cases or investigations. As an IT professional or corporate investigator, there are several aspects of standard eDiscovery case management to consider.
I. Creating a Standard eDiscovery Case
To create a standard eDiscovery case in the Microsoft 365 compliance center, follow these steps:
- Go to https://compliance.microsoft.com.
- Navigate to “Show All” > “Solutions” > ”eDiscovery”.
- Click on “+ Create a case” button.
- In the “eDiscovery Case Wizard”, enter the relevant name and description for the case.
- Click “Next”, and when the permissions screen opens up, add members that should be able to access the case.
- Click “Finish” to create the case.
II. Adding Hold to the Case
Once your eDiscovery case is created, you can place a “Hold” on the content. This will preserve information that could be important to a legal case. Here’s how to do it:
- In your eDiscovery case, click “+ Add Hold”.
- Choose “Custodial Hold” or “Query-based Hold” according to the data type.
- Enter relevant information and save the hold.
III. Searching the Case
You can conduct searches in your eDiscovery case. It assists in finding, isolating, and organizing potentially relevant data.
Example:
- In the eDiscovery case, go to the “Search” tab.
- Click “+ New Search”.
- Enter the keywords you are looking for and choose the locations you want to search.
- Finally, hit the “Save & Run” button.
IV. Exporting Case Data
Once you’ve concluded your searches and holds, you may need to export this data.
Here’s how to perform an export:
- In your eDiscovery case, select the “Search” tab, and choose the search you want to export.
- Then click “More” > ”Export results”.
- Fill in the necessary information, select any advanced settings needed, and click “Export”.
V. Closing the Case
After all investigations, searches, and exports are done, you might need to close the case. To close the case:
- In your eDiscovery dashboard, select the case you want to close.
- Click “More” > ”Close Case”.
These are the basic steps involved in managing a Standard eDiscovery case in Microsoft 365. Please note that this does not include the features available in Premium eDiscovery such as artificial intelligence tools, predictive coding, and machine learning.
By being proficient in these steps, prospective test-takers for the MS-203 Microsoft 365 Messaging exam will better their chances at passing this exam, and in turn, improving their competencies in managing standard eDiscovery cases in a professional business setting.
Practice Test
True/False: In standard eDiscovery in Microsoft 365, hold policies can only be applied to mailboxes, but not to SharePoint sites or OneDrive accounts.
- Answer: False
Explanation: In standard eDiscovery, you can place holds on mailboxes, SharePoint sites, and OneDrive accounts.
Multiple Select: In the standard eDiscovery in Microsoft 365, which of the following actions can you take?
- a) Create a case
- b) Place content locations on hold
- c) Export search results
- d) Delete a case
- e) None of the above
Answer: a) Create a case, b) Place content locations on hold, c) Export search results, d) Delete a case
Explanation: All these actions are functionalities of standard eDiscovery in Microsoft
Single select: Who can access the eDiscovery cases and data in the eDiscovery center?
- a) Only members of the eDiscovery managers security group
- b) Only the case owners
- c) Any user with a valid credential
- d) Any user with read and edit permissions
Answer: a) Only members of the eDiscovery managers security group
Explanation: The eDiscovery cases and data can only be accessed by members in the eDiscovery Managers security group.
True/False: Standard eDiscovery in Microsoft M365 enables you to search, hold and export Teams data including conversations, calendar meetings, and files.
- Answer: True
Explanation: The eDiscovery process in Microsoft 365 includes the ability to search, hold, and export Teams data.
Multiple Select: Which of the following steps are included in the eDiscovery process?
- a) Setting up case permissions
- b) Placing content on hold
- c) Running a search
- d) Exporting case data
- e) Deleting case data
Answer: a) Setting up case permissions, b) Placing content on hold, c) Running a search, d) Exporting case data
Explanation: All these steps are a part of a standard eDiscovery process.
True/False: You can delete content directly from a case in eDiscovery.
- Answer: False
Explanation: In a standard eDiscovery case, you cannot delete content directly from a case. You can only place holds, perform searches, and export data.
Single Select: What is the maximum number of mailboxes you can put on In-Place Hold or Litigation Hold in Microsoft 365?
- a) 1000
- b) Unlimited
- c) 5000
- d) 10000
Answer: b) Unlimited
Explanation: You can place an unlimited number of mailboxes on In-Place Hold or Litigation Hold in Microsoft
True/False: You cannot use standard eDiscovery in Microsoft 365 to search and export third-party data.
- Answer: True
Explanation: Standard eDiscovery is primarily for the content within Microsoft 365, it doesn’t support third-party data.
Multiple Select: What type of data can be included in a standard eDiscovery search in Microsoft 365?
- a) Emails
- b) Documents
- c) Teams Conversations
- d) Social media posts
Answer: a) Emails, b) Documents, c) Teams Conversations
Explanation: Standard eDiscovery can include data from emails, documents, and Teams Conversations within Microsoft 365, not from social media.
True/False: You can run an unlimited number of searches in a single eDiscovery case in Microsoft
- Answer: True
Explanation: There are no limits to the number of searches you can perform in a single eDiscovery case.
Interview Questions
What is eDiscovery in the context of Microsoft 365?
eDiscovery is a feature in Microsoft 365 that allows administrators and other personnel to identify, hold, search, and export content found in mailboxes and on sites for legal and public records obligations.
For what purposes can eDiscovery be used in MS 365?
eDiscovery can be used for various purposes such as finding and preserving text and email messages, documents, spreadsheets, and other digital content that might be relevant to a lawsuit or an internal investigation.
What permissions are needed to use eDiscovery features in Microsoft 365?
Microsoft 365 assigns eDiscovery permissions through role groups. The eDiscovery Manager role group has permissions to access and manage eDiscovery cases in the security and compliance center.
What are the various steps in managing standard eDiscovery cases in Microsoft 365?
The steps involve creating an eDiscovery case, adding members to the case, placing content locations on hold, searching for content, exporting content and then closing the case.
What is a Search and Content Hold in standard eDiscovery in Microsoft 365?
A Search is executing a query to find specific content within the eDiscovery case. Content Hold is a way to preserve content that might be relevant to the case, thereby preventing it from being deleted.
What content locations can be searched in a standard eDiscovery case?
You can search mailboxes, sites, and public folders in a standard eDiscovery case.
What is the role of a Compliance Administrator in eDiscovery in Microsoft 365?
A Compliance Administrator can manage eDiscovery cases, place holds on mailboxes, and export mailbox data.
What happens if an item that was put on Content Hold is edited or deleted?
If an item on Content Hold is edited, the original version of the item is preserved. If the item is deleted by a user, the item is retained in the Recoverable Items folder.
What is the role of the Compliance Search management role in Microsoft 365 eDiscovery?
The Compliance Search management role allows members to perform searches on eDiscovery cases.
How can one export search results in a Standard eDiscovery case in Microsoft 365?
After running a search, one can export the search results to a local computer. The exported results can be analyzed using advanced eDiscovery tools or third-party review applications.
How can one close an eDiscovery case in Microsoft 365?
An eDiscovery case can be closed by navigating to the eDiscovery page, selecting the case to be closed, and then selecting Close Case from the More drop-down list.
Which role group has the permission to access PowerShell in eDiscovery?
The eDiscovery Administrator role group has permission to access PowerShell in eDiscovery.
Can a closed eDiscovery case be reopened in Microsoft 365?
Yes, a closed eDiscovery case could be reopened if required.
Can a user perform an eDiscovery search across all content locations in an organization?
Yes, if the user is a member of the eDiscovery Manager role group with the appropriate permissions, they can perform an eDiscovery search across all content locations within an organization.
Can we set a time frame for Content Hold in Standard eDiscovery in Microsoft 365?
Yes, a time frame specifying the start and end dates of Content Hold in Standard eDiscovery can be set in Microsoft 365.
extutorials.com