Manage legal investigations in Office 365
Organizations have many reasons to respond to a legal case involving certain executives or other employees in your organization. This might involve quickly finding and retaining for further investigation specific information in email, documents, instant messaging conversations, and other content locations used by people in their day-to-day work tasks. You can perform these and many other similar activities by using the eDiscovery case tools in the Office 365 Security & Compliance Center.
Want to know how Microsoft manages its eDiscovery investigations? Here's a technical white paper you can download that explains how we use the same Office 365 search and investigation tools to manage our internal eDiscovery workflow.
Manage legal investigations with eDiscovery cases
eDiscovery cases let you control who can create, access, and manage eDiscovery cases in your organization. Use cases to add members and control what types of actions they can perform, place a hold on content locations relevant to a legal case, and use the Content Search tool to search the locations on hold for content that might be responsive to your case. Then you can also export and download those results for further investigation by external reviewers. If your Office 365 organization has and E5 subscription, you can also prepare search results for analysis in Advanced eDiscovery.
Manage your eDiscovery workflow by creating and using eDiscovery cases for every legal investigation your organization has to undertake
Assign eDiscovery permissions to control who can create and manage eDiscovery cases in your organization
Set up compliance boundaries to control the user content locations that eDiscovery managers can search
Search for content in your organization
Prepare case content for Advanced eDiscovery so you can perform analysis using Advanced eDiscovery's powerful analytic tools, such as optical character recognition, email threading, and predictive coding
Use scripts for advanced scenarios
Like the previous section that listed scripts for content search scenarios, we've also created some Security & Compliance Center PowerShell scripts to help you manage eDiscovery cases.
Create a eDiscovery hold report that contains information about all holds associated with eDiscovery cases in your organization
Add mailboxes and OneDrive locations for a list of users to an eDiscovery hold
Analyze case data using Office 365 Advanced eDiscovery
Office 365 Advanced eDiscovery builds on the content search and eDiscovery capabilities described in the previous sections. After you create an eDiscovery case, place custodian locations on hold, and collect data that might be responsive to the case, you can then further analyze the data by using the text analytics, machine learning, and the predictive coding capabilities of Advanced eDiscovery. This can help your organization quickly process thousands of email messages, documents, and other kinds of data to find those items that are most likely relevant to a specific case. And, we've unified case management and Advanced eDiscovery so that you can seamlessly manage the same case within the Security & Compliance Center.
To analyze a user's data using Advanced eDiscovery, the user (the custodian of the data) must be assigned an Office 365 E5 license. Alternatively, users with an Office 365 E1 or E3 license can be assigned an Advanced eDiscovery standalone license. Administrators and compliance officers who are assigned to cases and use Advanced eDiscovery to analyze data don't need an E5 license.
The quickest way to get started with Advanced eDiscovery is to create a case and prepare search results in Security & Compliance Center, load those results in Advanced eDiscovery, and then run Express analysis to analyze that case data and then export the results for external review.
Get a quick overview of the Advanced eDiscovery workflow
Set up users and cases for Advanced eDiscovery by creating a case, assigning eDiscovery permissions, and adding case members, all by using the Security & Compliance Center
Prepare and load search data in to the case in Advanced eDiscovery
Load non-Office 365 data in to a case to analyze it in Advanced eDiscovery
Use Express analysis to quickly analyze the data in a case and then easily export the results
After search data is loaded into the case in Advanced eDiscovery, you'll use the Analyze module to start analyzing it. The first part of the analysis process consists of organizing files into groups of unique files, duplicates, and near-duplicates (also know as document similarity). Then you'll organize the data again into hierarchically structured groups of email threads and themes and, optionally, set ignore text filters to exclude certain text from analysis. Then you'll run the analysis and view the results.
Learn about document similarity to prepare you for analyzing data in Advanced eDiscovery
Set up the options for near-duplicates, themes, and email threading and then run the Analyze module
Set up Ignore Text filters to exclude text and text strings from being analyzed; these filters will also ignore text when you run Relevance analysis
View the results of the analysis process
Configure advanced settings for the analysis process
Set up Relevance training
Predictive coding (called Relevance) in Advanced eDiscovery lets you train the system on what you're looking for by letting you to make decisions (about whether something is relevant or not) on a small set of documents.
Learn about setting up Relevance training , tagging files that are relevant to a case, and defining case issues
Define case issues and assign each issue to a user who will train the files
Add imported files to current or new load that will be added to the Relevance training; a load is a new batch of files that are added to a case and then used for Relevance training
Define highlighted keywords that can be added to the Relevance training; this helps you better identify files that are relevant to a case
Run the Relevance module
After set up training, you're ready to run the Relevance module and assess the effectiveness of the training settings This results in a relevance ranking that helps you decide if you need to perform additional training or if you're ready to start tagging files as relevant to your case.
Learn about the Relevance process and the iterative process of assessment, tagging, tracking, and re-training based on sample set of files
Learn about assessment , where a expert familiar with the case reviews a set of case files and determines the effectiveness of the Relevance training
Assess case files to calculate the effectiveness (called richness ) of training settings, and then tag files as relevant or not relevant to your case; this helps you determine if the current training is sufficient or if you should adjust the training settings.
Perform the relevance training after assessment is complete, and then once again tag files as relevant or not relevant to the issues you've defined for the case
Track the Relevance analysis process to determine if Relevance training has achieved your assessment target (known as a stable training status ) or whether more training is needed; you can also view the Relevance results for each case issue
Make decisions based on Relevance analysis to determine the size of the resulting set of case files that can be exported for review
Test the quality of the Relevance analysis to validate the culling decisions made during the Relevance process
The final step in analyzing case data in Advanced eDiscovery is to export results of the analysis for external review.
Other Advanced eDiscovery tools
Advanced eDiscovery provides additional tools and capabilities beyond analyzing case data, relevance analysis, and exporting data.