Manage legal investigations in Office 365

Organizations have many reasons to respond to a legal case involving certain executives or other employees in your organization. This might involve quickly finding and retaining for further investigation specific information in email, documents, instant messaging conversations, and other content locations used by people in their day-to-day work tasks. You can perform these and many other similar activities by using the eDiscovery case tools in the Security & Compliance Center.

Manage legal investigations with eDiscovery cases

Analyze case data using Office 365 Advanced eDiscovery

Want to know how Microsoft manages its eDiscovery investigations? Here's a technical white paper you can download that explains how we use the same Office 365 search and investigation tools to manage our internal eDiscovery workflow.

eDiscovery cases let you control who can create, access, and manage eDiscovery cases in your organization. Use cases to add members and control what types of actions they can perform, place a hold on content locations relevant to a legal case, and use the Content Search tool to search the locations on hold for content that might be responsive to your case. Then you can also export and download those results for further investigation by external reviewers. If your Office 365 organization has an E5 subscription, you can also prepare search results for analysis in Advanced eDiscovery.

Use scripts for advanced scenarios

Like the previous section that listed scripts for content search scenarios, we've also created some Security & Compliance Center PowerShell scripts to help you manage eDiscovery cases.

Analyze case data using Office 365 Advanced eDiscovery

Office 365 Advanced eDiscovery builds on the content search and eDiscovery capabilities described in the previous sections. After you create an eDiscovery case, place custodian locations on hold, and collect data that might be responsive to the case, you can then further analyze the data by using the text analytics, machine learning, and the predictive coding capabilities of Advanced eDiscovery. This can help your organization quickly process thousands of email messages, documents, and other kinds of data to find those items that are most likely relevant to a specific case. And, we've unified case management and Advanced eDiscovery so that you can seamlessly manage the same case within the Security & Compliance Center.


To analyze a user's data using Advanced eDiscovery, the user (the custodian of the data) must be assigned an Office 365 E5 license. Alternatively, users with an Office 365 E1 or E3 license can be assigned an Advanced eDiscovery standalone license. Administrators and compliance officers who are assigned to cases and use Advanced eDiscovery to analyze data don't need an E5 license.

Get started

The quickest way to get started with Advanced eDiscovery is to create a case and prepare search results in Security & Compliance Center, load those results in Advanced eDiscovery, and then run Express analysis to analyze that case data and then export the results for external review.

Analyze data

After search data is loaded into the case in Advanced eDiscovery, you'll use the Analyze module to start analyzing it. The first part of the analysis process consists of organizing files into groups of unique files, duplicates, and near-duplicates (also know as document similarity). Then you'll organize the data again into hierarchically structured groups of email threads and themes and, optionally, set ignore text filters to exclude certain text from analysis. Then you'll run the analysis and view the results.

Set up Relevance training

Predictive coding (called Relevance) in Advanced eDiscovery lets you train the system on what you're looking for by letting you to make decisions (about whether something is relevant or not) on a small set of documents.

Run the Relevance module

After set up training, you're ready to run the Relevance module and assess the effectiveness of the training settings This results in a relevance ranking that helps you decide if you need to perform additional training or if you're ready to start tagging files as relevant to your case.

  • Learn about the Relevance process and the iterative process of assessment, tagging, tracking, and re-training based on sample set of files

  • Learn about assessment , where a expert familiar with the case reviews a set of case files and determines the effectiveness of the Relevance training

  • Assess case files to calculate the effectiveness (called richness ) of training settings, and then tag files as relevant or not relevant to your case; this helps you determine if the current training is sufficient or if you should adjust the training settings.

  • Perform the relevance training after assessment is complete, and then once again tag files as relevant or not relevant to the issues you've defined for the case

  • Track the Relevance analysis process to determine if Relevance training has achieved your assessment target (known as a stable training status ) or whether more training is needed; you can also view the Relevance results for each case issue

  • Make decisions based on Relevance analysis to determine the size of the resulting set of case files that can be exported for review

  • Test the quality of the Relevance analysis to validate the culling decisions made during the Relevance process

Export results

The final step in analyzing case data in Advanced eDiscovery is to export results of the analysis for external review.

Other Advanced eDiscovery tools

Advanced eDiscovery provides additional tools and capabilities beyond analyzing case data, relevance analysis, and exporting data.