创建电子数据展示保留Create an eDiscovery hold

可以使用核心电子数据展示案例创建保留,以保留与案例相关的内容。You can use a Core eDiscovery case to create holds to preserve content that might be relevant to the case. 你可以将正在调查的用户的 Exchange 邮箱和 OneDrive for Business 帐户置于保留状态。You can place a hold on the Exchange mailboxes and OneDrive for Business accounts of people you're investigating in the case. 还可以将与 Microsoft Teams、Office 365 组和 Yammer 组关联的邮箱和网站置于保留状态。You can also place a hold on the mailboxes and sites that are associated with Microsoft Teams, Office 365 Groups, and Yammer Groups. 当您将内容位置放在保留状态时,内容将一直保留,直到您从内容位置删除保留,或者一直保留到您删除保留。When you place content locations on hold, content is preserved until you remove the hold from the content location or until you delete the hold.

创建电子数据展示保留后,保留最多可能需要 24 小时才能生效。After you create an eDiscovery hold, it may take up to 24 hours for the hold to take effect.

创建保留时,有以下选项可确定指定内容位置中保留的内容的范围:When you create a hold, you have the following options to scope the content that is preserved in the specified content locations:

  • 创建一个无限保留,其中指定位置中所有内容都置于保留状态。You create an infinite hold where all content in the specified locations is placed on hold. 或者,您可以创建基于查询的保留,其中仅将指定位置中与搜索查询匹配的内容置于保留状态。Alternatively, you can create a query-based hold where only the content in the specified locations that matches a search query is placed on hold.

  • 可以指定一个日期范围,以仅保留该日期范围内发送、接收或创建的内容。You can specify a date range to preserve only the content that was sent, received, or created within that date range. 或者,您可以将所有内容保留于指定位置,而不管内容何时发送、接收或创建。Alternatively, you can hold all content in specified locations regardless of when it was sent, received, or created.

如何创建电子数据展示保留How to create an eDiscovery hold

创建与核心电子数据展示案例关联的电子数据展示保留:To create an eDiscovery hold that's associated with a Core eDiscovery case:

  1. 转到 https://compliance.microsoft.com ,然后使用已分配有相应电子数据展示权限的用户帐户的凭据登录。Go to https://compliance.microsoft.com and sign in using the credentials for user account that has been assigned the appropriate eDiscovery permissions.

  2. 在 Microsoft 365 合规中心的左侧导航窗格中,单击"全部显示",然后单击"电子数据展示>核心"。In the left navigation pane of the Microsoft 365 compliance center, click Show all, and then click eDiscovery > Core.

  3. "核心电子数据展示"页上,选择要创建保留的案例,然后单击"打开 案例"。On the Core eDiscovery page, select the case that you want to create the hold in, and then click Open case.

  4. 在案例 的主页 上,单击"保留 项" 选项卡。On the Home page for the case, click the Holds tab.

  5. 在保留 页上单击创建On the Holds page, click Create.

  6. 在"命名保留向导"页上,为保留命名并添加可选说明,然后单击"下一步 "。On the Name your hold wizard page, give the hold a name and add an optional description, and then click Next. 保留名称在你的组织中必须保持唯一。The name of the hold must be unique in your organization.

  7. "内容位置" 页上,选择要保留的内容位置。On the Content locations page, choose the content locations that you want to place on hold. 可以将邮箱、网站和公用文件夹置于保留状态。You can place mailboxes, sites, and public folders on hold.

    选择将其置于保留状态的内容位置

    1. 邮箱位置- 单击"选择用户、组 或团队",然后再次单击"选择用户、组或团队"以指定要置于保留中的邮箱。Mailbox locations - Click Choose users, groups, or teams and then click Choose users, groups, or teams again to specify the mailboxes to place on hold. 使用搜索框查找用户邮箱和通讯 (将要置于保留状态) 的组成员的邮箱置于保留状态。Use the search box to find user mailboxes and distribution groups (to place a hold on the mailboxes of group members) to place on hold. 还可以将 Microsoft 团队、Office 365 组或 Yammer 组的关联邮箱置于保留状态。You can also place a hold on the associated mailbox for a Microsoft Team, Office 365 Group, or Yammer Group. 选中用户、组、团队复选框,单击 "选择",然后单击"完成 "。Select the user, group, team check box, click Choose, and then click Done.

    2. 网站位置- 单击 "选择网站",然后单击"再次选择网站"以指定要保留的 SharePoint 和 OneDrive 帐户。 Site locations - Click Choose sites and then click Choose sites again to specify SharePoint and OneDrive accounts to place on hold. 键入要保留的每个网站的 URL。Type the URL for each site that you want to place on hold. 您还可以为 Microsoft 团队、Office 365 组或 Yammer 组添加 SharePoint 网站的 URL。You can also add the URL for the SharePoint site for a Microsoft Team, Office 365 Group or a Yammer Group. 单击 "选择",然后单击"完成 "。Click Choose, and then click Done.

    3. Exchange 公用文件夹。Exchange public folders. 将切换开关  切换控件 移动到 "所有 "位置,将 Exchange Online 组织的所有公用文件夹置于保留状态。Move the toggle switch Toggle control to the All position to put all public folders in your Exchange Online organization on hold. 你无法选择要置于保留状态的特定公用文件夹。You can't choose specific public folders to put on hold. 如果不想将 公用文件夹置于 保留状态,将切换开关设置为"无"。Leave the toggle switch set to None if you don't want to put a hold on public folders.

    备注

    必须至少向保留项添加一个内容位置。You must add at least one content location to the hold. 否则,电子数据展示保留静态将显示没有项目被保留。Otherwise, the eDiscovery hold statics will show that no items are on hold.

  8. 完成向保留添加内容位置后,单击"下一 步"。When you're done adding content locations to the hold, click Next.

  9. 若要创建具有条件的基于查询的保留,请完成以下操作。To create a query-based hold with conditions, complete the following. 否则,若要保留指定内容位置中所有的内容,请单击"下一 步"。Otherwise, to preserve all content in the specified content locations, click Next.

    创建具有条件的基于查询的保留

    1. 在" 关键字" 下的框中,键入搜索查询,以便仅保留满足搜索条件的内容。In the box under Keywords, type a search query so that only the content that meets the search criteria is preserved. 可以指定关键字、电子邮件属性或文档属性,如文件名。You can specify keywords, email message properties, or document properties, such as file names. 您还可以使用更复杂的查询,这些查询使用布尔运算符,如 AND 、ORNOTYou can also use more complex queries that use a Boolean operator, such as AND, OR, or NOT.

    2. 单击 "添加 条件"添加一个或多个条件以缩小保留的搜索查询范围。Click Add conditions to add one or more conditions to narrow the search query for the hold. 每个条件向创建保留时创建和运行的 KQL 搜索查询添加一个子句。Each condition adds a clause to the KQL search query that is created and run when you create the hold. 例如,可以指定日期范围,以便保留在日期范围内创建的电子邮件或网站文档。For example, you can specify a date range so that email or site documents that were created within the date ranged are placed on hold. 条件在逻辑上连接到关键字查询 (AND 运算符) 关键字 框中指定的查询A condition is logically connected to the keyword query (specified in the Keywords box) by the AND operator. 这意味着项目必须满足关键字查询和要保留的条件。That means that items have to satisfy both the keyword query and the condition to be preserved.

    有关创建搜索查询和使用条件的信息,请参阅内容搜索的关键字查询和 搜索条件For more information about creating a search query and using conditions, see Keyword queries and search conditions for Content Search.

  10. 配置基于查询的保留后,单击"下一 步"。After configuring a query-based hold, click Next.

  11. 查看设置 (必要时编辑它们) ,然后单击"创建 此保留"。Review your settings (and edit them if necessary), and then click Create this hold.

对网站文档设置基于查询的保留Query-based holds placed on site documents

在将基于查询的电子数据展示保留 SharePoint 网站中的文档时,请记住以下事项:Keep the following things in mind when you place a query-based eDiscovery hold on documents located in SharePoint sites:

  • 基于查询的保留最初会保留网站中所有文档删除后的一小段时间。A query-based hold initially preserves all documents in a site for a short period of time after they are deleted. 这意味着在删除文档时,即使文档与基于查询的保留条件不匹配,文档也将移动到保留库。That means when a document is deleted, it will be moved to the Preservation Hold library even if it doesn't match the criteria of the query-based hold. 但是,处理保留库的计时器作业将删除与基于查询的保留不匹配的已删除文档。However, deleted documents that don't match a query-based hold will be removed by a timer job that processes the Preservation Hold library. 计时器作业会定期运行,并将保留库中的所有文档与基于查询电子数据展示保留项 (其他类型的保留和保留策略) 。The timer job runs periodically and compares all documents in the Preservation Hold library to your query-based eDiscovery holds (and other types of holds and retention policies). 计时器作业将删除与基于查询的保留不匹配的文档,并保留执行这些操作的文档。The timer job deletes the documents that don't match a query-based hold and preserves the documents that do.

  • 基于查询的保留不应用于执行目标保留,例如保留特定文件夹或网站中的文档,或通过使用其他基于位置的保留条件。Query-based holds should not be used to perform targeted preservation, like preserving documents in a specific folder or site or by using other location-based hold criteria. 这样做可能会产生意外结果。Doing so may have unintended results. 建议使用非基于位置的保留条件(如关键字、日期范围或其他文档属性)来保留网站文档。We recommend using non-location based hold criteria such as keywords, date ranges, or other document properties to preserve site documents.

电子数据展示保留统计信息eDiscovery hold statistics

创建电子数据展示保留后,有关新保留的信息将显示在所选保留的飞出页面上。After you create an eDiscovery hold, information about the new hold is displayed on the flyout page for the selected hold. 此信息包括邮箱数和处于保留状态的网站数,以及有关置于保留状态的内容的统计信息,例如置于保留状态的项目总数和大小以及上次计算保留统计信息的时间。This information includes the number of mailboxes and sites on hold and statistics about the content that was placed on hold, such as the total number and size of items placed on hold and the last time the hold statistics were calculated. 这些保留统计信息可帮助您确定要保留的与案例相关的内容量。These hold statistics help you identify the amount of content related to the case is being preserved.

保留统计信息

请牢记以下有关电子数据展示保留统计信息的事项:Keep the following things in mind about eDiscovery hold statistics:

  • 保留项总数指示置于保留状态的所有内容源中的项目数。The total number of items on hold indicates the number of items from all content sources that are placed on hold. 如果已创建基于查询的保留,则此统计信息指示与查询匹配的项目数。If you've created a query-based hold, this statistic indicates the number of items that match the query.

  • 保留的项目数还包括在内容位置找到的未索引项目。The number of items on hold also includes unindexed items found in the content locations. 如果创建基于查询的保留,内容位置中所有未建立索引的项目将置于保留状态。If you create a query-based hold, all unindexed items in the content locations are placed on hold. 这包括不匹配基于查询的保留的搜索条件的未索引项和可能超出日期范围条件的未索引项。This includes unindexed items that don't match the search criteria of a query-based hold and unindexed items that might fall outside of a date range condition. 这不同于运行搜索时发生的情况,即搜索结果中不包含与搜索查询不匹配或按日期范围条件排除的未索引项目。This is different than what happens when you run a search, in which unindexed items that don't match the search query or are excluded by a date range condition aren't included in the search results. 有关未编制索引的项目详细信息,请参阅 部分索引项For more information about unindexed items, see Partially indexed items.

  • 可以通过单击"更新统计信息"重新运行计算当前保留项目数的搜索估计,获取最新的保留统计信息。You can get the latest hold statistics by clicking Update statistics to rerun a search estimate that calculates the current number of items on hold.

  • 保留项目数会随着时间的推移而增加,这是正常的,因为其邮箱或网站置于保留状态的用户通常会在 SharePoint 和 OneDrive 中发送或接收新电子邮件并创建新文档。It's normal for the number of items on hold to increase over time because users whose mailbox or site is on hold are typically sending or receiving new email message and creating new documents in SharePoint and OneDrive.

  • 如果将 Exchange 邮箱、SharePoint 站点或 OneDrive 帐户移动到多地理位置环境中的不同区域,则保留统计信息中不会包含该网站的统计信息。If an Exchange mailbox, SharePoint site, or OneDrive account is moved to a different region in a multi-geo environment, the statistics for that site won't be included in the hold statistics. 但仍保留这些位置中的内容。But the content in those locations will still be preserved. 此外,如果邮箱或网站移动到不同的区域,则保留项中显示的 SMTP 地址或 URL 将不会自动更新。Also, if a mailbox or site is moved to a different region, the SMTP address or URL that's displayed in the hold will not automatically be updated. 您必须编辑保留项并更新 URL 或 SMTP 地址,以便再次将内容位置包含在保留统计信息中You'll have to edit the hold and update the URL or SMTP address so the content locations are once again included in the hold statistics

电子数据展示保留上的搜索位置Search locations on eDiscovery hold

核心电子 数据展示案例中搜索内容时,可以快速将搜索配置为仅搜索已置于与该案例关联的保留的内容位置。When you search for content in a Core eDiscovery case, you can quickly configure the search to only search the content locations that have been placed on a hold associated with the case.

保留位置

选择 "置于保留状态 的位置"选项以搜索已置于保留状态的所有内容位置。Select the Locations on hold option to search all the content locations that have been placed on hold. 如果案例包含多个电子数据展示保留,则选择此选项时将搜索所有保留的内容位置。If the case contains multiple eDiscovery holds, the content locations from all holds will be searched when you select this option. 此外,如果内容位置被置于基于查询的保留中,则在您运行搜索时将仅搜索与保留查询匹配的项目。Additionally, if a content location was placed on a query-based hold, only the items that match the hold query will be searched when you run the search. 换句话说,只有与保留条件与搜索条件匹配的内容与搜索结果一起返回。In other words, only the content that matches both the hold criteria and the search criteria is returned with the search results. 例如,如果用户被置于基于查询的保留案例,并保留了特定日期之前发送或创建的项,则只会搜索这些项目。For example, if a user was placed on query-based case hold that preserves items that were sent or created before a specific date, only those items would be searched. 这是通过 AND 运算符连接案例保留查询和搜索 查询完成的。This is accomplished by connecting the case hold query and the search query by an AND operator.

以下是在搜索电子数据展示保留上的位置时需要记住的其他一些内容:Here are some other things to keep in mind when searching locations on eDiscovery hold:

  • 如果内容位置是同一情况下多个保留项的一部分,则当您使用"所有案例内容"选项搜索该内容位置时,保留查询由 OR 运算符组合使用。If a content location is part of multiple holds within the same case, the hold queries are combined by OR operators when you search that content location using the all case content option. 同样,如果内容位置是两个不同的保留项的一部分,其中一个基于查询,另一个是一个无限保留 (其中所有内容都置于保留状态) ,则由于无限保留,所有内容都是搜索。Similarly, if a content location is part of two different holds, where one is query-based and the other is an infinite hold (where all content is placed on hold), then all content is search because of the infinite hold.

  • 如果将搜索配置为搜索保留位置,然后在 (中通过添加或删除位置或更改保留查询) 更改电子数据展示保留,则搜索配置将随这些更改一起更新。If a search is configured it to search locations on hold and then you change an eDiscovery hold in the case (by adding or removing a location or changing a hold query), the search configuration is updated with those changes. 但是,您必须在保留更改后重新运行搜索以更新搜索结果。However, you have to rerun the search after the hold is changed to update the search results.

  • 如果电子数据展示案例的单个位置上放置了多个电子数据展示保留,并且您选择搜索处于保留状态的位置,则该搜索查询的最大关键字数为 500。If multiple eDiscovery holds are placed on a single location in an eDiscovery case and you select to search locations on hold, the maximum number of keywords for that search query is 500. 这是因为搜索使用 OR 运算符将所有基于查询的保留组合在一起。That's because the search combines all the query-based holds by using the OR operator. 如果组合保留查询和搜索查询中关键字超过 500 个,则搜索邮箱中所有内容,而不只是搜索与基于查询的大小写匹配的内容。If there are more than 500 keywords in the combined hold queries and the search query, then all content in the mailbox is searched, not just that content that matches the query-based case holds.

  • 如果电子数据展示保留的状态为"打开",则仍可在打开保留时搜索处于保留状态的位置。If an eDiscovery hold has a status of Turning on, you can still search the locations on hold while the hold is being turned on.

保留 Microsoft Teams 中的内容Preserve content in Microsoft Teams

属于 Microsoft Teams 频道的对话存储在与 Microsoft 团队关联的邮箱中。Conversations that are part of a Microsoft Teams channel are stored in the mailbox that's associated with the Microsoft Team. 同样,团队成员在渠道中共享的文件将存储在团队的 SharePoint 网站上。Similarly, files that team members share in a channel are stored on the team's SharePoint site. 因此,您必须将团队邮箱和 SharePoint 网站置于电子数据展示保留状态,才能在频道中保留对话和文件。Therefore, you have to place the Team mailbox and SharePoint site on eDiscovery hold to preserve conversations and files in a channel.

或者,属于 Teams (中聊天列表(称为一对一聊天或 一对 N 群聊) )的对话将存储在参与聊天的用户的邮箱中。Alternatively, conversations that are part of the Chat list in Teams (called 1:1 chats or 1:N group chats) are stored in the mailboxes of the users who participate in the chat. 用户在聊天对话中共享的文件存储在共享文件的用户的 OneDrive 帐户中。And files that users share in chat conversations are stored in the OneDrive account of the user who shares the file. 因此,您必须将单个用户邮箱和 OneDrive 帐户添加到电子数据展示保留,以保留聊天列表中的对话和文件。Therefore, you have to add the individual user mailboxes and OneDrive accounts to an eDiscovery hold to preserve conversations and files in the chat list. 除了将团队邮箱和网站置于保留状态之外,还建议将 Microsoft Team 成员的邮箱置于保留状态。It's a good idea to place a hold on the mailboxes of members of a Microsoft Team in addition to placing the team mailbox and site on hold.

备注

如果你的组织具有 Exchange 混合部署 (或者你的组织将本地 Exchange 组织与 Office 365) 同步,并且已启用 Microsoft Teams,本地用户可以使用 Teams 聊天应用程序并参与一对一聊天和一对 N 群聊。If your organization has an Exchange hybrid deployment (or your organization synchronizes an on-premises Exchange organization with Office 365) and has enabled Microsoft Teams, on-premises users can use the Teams chat application and participate in 1:1 chats and 1:N group chats. 这些对话存储在与本地用户关联的基于云的存储中。These conversations are stored in cloud-based storage that's associated with an on-premises user. 如果将本地用户置于电子数据展示保留状态,将保留基于云的存储中的 Teams 聊天内容。If an on-premises user is placed on an eDiscovery hold, the Teams chat content in the cloud-based storage will be preserved. 有关详细信息,请参阅 搜索本地用户的 Teams 聊天数据For more information, see Search for Teams chat data for on-premises users.

有关保留 Teams 内容的信息,请参阅将Microsoft Teams 用户或团队合法保留。For more information about preserving Teams content, see Place a Microsoft Teams user or team on legal hold.

保留卡片内容Preserve card content

同样,Teams 频道、1:1 聊天和 1:N 群聊中的应用生成的卡片内容存储在邮箱中,在将邮箱置于电子数据展示保留时将保留。Similarly, card content generated by apps in Teams channels, 1:1 chats, and 1:N group chats is stored in mailboxes and is preserved when a mailbox is placed on an eDiscovery hold. 卡片 是一个 UI 容器,用于存放内容短片。A card is a UI container for short pieces of content. 卡片可以有多个属性和附件,还可以包括触发卡片操作按钮。Cards can have multiple properties and attachments, and can include buttons that trigger card actions. 有关详细信息,请参阅 卡片For more information, see Cards. 和其他 Teams 内容一样,卡片内容的存储位置由卡片用在何处来确定。Like other Teams content, where card content is stored is based on where the card was used. 用于 Teams 频道中的卡片内容存储在 Teams 组邮箱中。Content for cards used in a Teams channel is stored in the Teams group mailbox. 一对一和一对多聊天的卡片内容存储在聊天参与者的邮箱中。Card content for 1:1 and 1xN chats are stored in the mailboxes of the chat participants.

保留会议信息和呼叫信息Preserve meeting and call information

Teams 频道中的会议和呼叫摘要信息也存储在拨入会议或呼叫的用户的邮箱中。Summary information for meetings and calls in a Teams channel is also stored in the mailboxes of users who dialed into the meeting or call. 在用户邮箱上设置电子数据展示保留时,也会保留此内容。This content is also preserved when an eDiscovery hold is placed on user mailboxes.

保留私人频道中的内容Preserve content in private channels

从 2020 年 2 月开始,我们还启用在私人频道中保留内容的能力。Starting in February 2020, we also turned on the ability to preserve content in private channels. 由于私人频道聊天存储在聊天参与者的邮箱中,因此将用户邮箱置于电子数据展示保留将保留私人频道聊天。Because private channel chats are stored in the mailboxes of the chat participants, placing a user mailbox on eDiscovery hold will preserve private channel chats. 此外,如果在 2020 年 2 月之前将用户邮箱置于电子数据展示保留状态,则此保留现在将自动应用于存储在该邮箱中的私人频道邮件。Also, if a user mailbox was placed on an eDiscovery hold prior to February 2020, the hold will now automatically apply to private channel messages stored in that mailbox. 还支持保留在私人频道中共享的文件。Preserving files shared in private channels is also supported.

保留 Wiki 内容Preserve wiki content

每个团队或团队频道还包含用于做笔记和进行协作的 Wiki。Every Team or team channel also contains a Wiki for note taking and collaboration. Wiki 内容将会自动保存至采用 .mht 格式的文件。The Wiki content is automatically saved to a file with a .mht format. 此文件存储在团队 SharePoint 网站的 Teams Wiki 数据文档库中。This file is stored in the Teams Wiki Data document library on the team's SharePoint site. 您可以通过将团队的 SharePoint 网站添加到电子数据展示保留来保留 Wiki 内容。You can preserve the wiki content by adding the team's SharePoint site to an eDiscovery hold.

备注

在 2017 年 6 月 22 日 (将团队的 SharePoint 网站保留时,可以保留团队或团队频道) Wiki 内容。The capability to preserve Wiki content for a Team or team channel (when you place the team's SharePoint site on hold) was released on June 22, 2017. 如果团队网站保留,Wiki 内容将自该日期开始保留。If a team site is on hold, the Wiki content will be retained starting on that date. 但是,如果团队网站在 2017 年 6 月 22 日之前被保留,且 Wiki 内容已删除,则 Wiki 内容不会保留。However, if a team site is on hold and the Wiki content was deleted before June 22, 2017, the Wiki content was not preserved.

Office 365 组Office 365 Groups

Teams 基于 Office 365 组构建。Teams is built on Office 365 Groups. 因此,将 Office 365 组置于电子数据展示保留状态与将 Teams 内容置于保留状态类似。Therefore, placing Office 365 Groups on eDiscovery hold is similar placing Teams content on hold.

将 Teams 和 Office 365 组置于电子数据展示保留时,请记住以下事项:Keep the following things in mind when placing both Teams and Office 365 Groups on an eDiscovery hold:

  • 如前所述,若要将 Teams 和 Office 365 组的内容置于保留状态,必须指定与组或团队关联的邮箱和 SharePoint 网站。As previously explained, to place content located in Teams and Office 365 Groups on hold, you have to specify the mailbox and SharePoint site that associated with a group or team.

  • Exchange Online PowerShell中运行 Get-UnifiedGroup cmdlet 以查看 Teams 和 Office 365 组的属性。Run the Get-UnifiedGroup cmdlet in Exchange Online PowerShell to view properties for Teams and Office 365 Groups. 这是获取与团队或 Office 365 组关联的网站的 URL 的一个好方法。This is a good way to get the URL for the site that's associated with a Team or Office 365 Group. 例如,以下命令显示名为高层领导团队的 Office 365 组的选定属性:For example, the following command displays selected properties for an Office 365 Group named Senior Leadership Team:

    Get-UnifiedGroup "Senior Leadership Team" | FL DisplayName,Alias,PrimarySmtpAddress,SharePointSiteUrl
    
    DisplayName            : Senior Leadership Team
    Alias                  : seniorleadershipteam
    PrimarySmtpAddress     : seniorleadershipteam@contoso.onmicrosoft.com
    SharePointSiteUrl      : https://contoso.sharepoint.com/sites/seniorleadershipteam
    

    备注

    若要运行 Get-UnifiedGroup cmdlet,则你必须在 Exchange Online 中分配有仅查看收件人角色或者是分配有仅查看收件人角色的角色组的成员。To run the Get-UnifiedGroup cmdlet, you have to be assigned the View-Only Recipients role in Exchange Online or be a member of a role group that's assigned the View-Only Recipients role.

  • 搜索用户的邮箱时,将不会搜索该用户是其中成员的任何团队或 Office 365 组。When a user's mailbox is searched, any Team or Office 365 Group that the user is a member of won't be searched. 同样,当您将团队或 Office 365 组置于电子数据展示保留中时,只会将组邮箱和组网站置于保留状态。Similarly, when you place a Team or Office 365 Group on eDiscovery hold, only the group mailbox and group site are placed on hold. 除非将组成员的邮箱和 OneDrive for Business 网站显式添加到电子数据展示保留中,否则不会将其置于保留状态。The mailboxes and OneDrive for Business sites of group members aren't placed on hold unless you explicitly add them to the eDiscovery hold. 因此,如果出于法律原因必须保留团队或 Office 365 组,请考虑将团队或团队成员的邮箱和 OneDrive 帐户添加到同一保留状态。So if you have to place a Team or Office 365 Group on hold for a legal reason, consider adding the mailboxes and OneDrive accounts of team or group members on the same hold.

  • 若要获取团队或 Office 365 组的成员列表,可以在 Microsoft 365管理中心查看组页面上的属性。To get a list of the members of a Team or Office 365 Group, you can view the properties on the Groups page in the Microsoft 365 admin center. 或者,可以在 Exchange Online PowerShell 中运行以下命令:Alternatively, you can run the following command in Exchange Online PowerShell:

    Get-UnifiedGroupLinks <group or team name> -LinkType Members | FL DisplayName,PrimarySmtpAddress
    

    备注

    若要运行 Get-UnifiedGroupLinks cmdlet,则你必须在 Exchange Online 中分配有仅查看收件人角色或者是分配有仅查看收件人角色的角色组的成员。To run the Get-UnifiedGroupLinks cmdlet, you have to be assigned the View-Only Recipients role in Exchange Online or be a member of a role group that's assigned the View-Only Recipients role.

在 OneDrive 帐户内保留内容Preserve content in OneDrive accounts

若要收集组织中 OneDrive for Business 网站的 URL 列表,以便可以将其添加到与电子数据展示案例关联的保留或搜索中,请参阅创建组织中所有 OneDrive位置的列表。To collect a list of the URLs for the OneDrive for Business sites in your organization so you can add them to a hold or search associated with an eDiscovery case, see Create a list of all OneDrive locations in your organization. 本文中的脚本将创建一个文本文件,其中包含组织中所有 OneDrive 网站的列表。The script in this article creates a text file that contains a list of all OneDrive sites in your organization. 若要运行此脚本,必须安装并使用 SharePoint Online Management Shell。To run this script, you have to install and use the SharePoint Online Management Shell. 请务必将你组织的 MySite 域的 URL 附加到你想要搜索的每个 OneDrive 网站。Be sure to append the URL for your organization's MySite domain to each OneDrive site that you want to search. 这是包含你所有的 OneDrive 的域;例如,https://contoso-my.sharepoint.comThis is the domain that contains all your OneDrive; for example, https://contoso-my.sharepoint.com. 下面是用户的 OneDrive 网站的 URL 示例:https://contoso-my.sharepoint.com/personal/sarad_contoso_onmicrosoft.comHere's an example of a URL for a user's OneDrive site: https://contoso-my.sharepoint.com/personal/sarad_contoso_onmicrosoft.com.

重要

用户的 OneDrive 帐户的 URL 包括其用户主体名称 (UPN) (例如 https://alpinehouse-my.sharepoint.com/personal/sarad_alpinehouse_onmicrosoft_com ,) 。The URL for a user's OneDrive account includes their user principal name (UPN) (for example, https://alpinehouse-my.sharepoint.com/personal/sarad_alpinehouse_onmicrosoft_com). 在极少数情况下,更改了某个人的 UPN,其 OneDrive URL 也将更改以合并新的 UPN。In the rare case that a person's UPN is changed, their OneDrive URL will also change to incorporate the new UPN. 如果用户的 OneDrive 帐户是电子数据展示保留的一部分,旧帐户和 UPN 已更改,则需要更新保留,并且必须更新保留并添加用户的新 OneDrive URL 并删除旧 URL。If a user's OneDrive account is part of an eDiscovery hold, old and their UPN is changed, you need to update the hold and you'll have to update the hold and add the user's new OneDrive URL and remove the old one. 有关详细信息,请参阅 UPN 更改如何影响 OneDrive URLFor more information, see How UPN changes affect the OneDrive URL.

从电子数据展示保留中删除内容位置Removing content locations from an eDiscovery hold

从电子数据展示保留中删除邮箱、SharePoint 站点或 OneDrive 帐户后,将 应用延迟 保留。After a mailbox, SharePoint site, or OneDrive account is removed from an eDiscovery hold, a delay hold is applied. 这意味着保留的实际删除延迟 30 天,以防止数据被永久删除 (从内容) 清除。This means that the actual removal of the hold is delayed for 30 days to prevent data from being permanently deleted (purged) from a content location. 这使管理员有机会搜索或恢复将在删除电子数据展示保留后清除的内容。This gives admins an opportunity to search for or recover content that will be purged after an eDiscovery hold is removed. 延迟保留对邮箱和网站的工作方式的详细信息有所不同。The details of how the delay hold works for mailboxes and sites are different.

  • 邮箱: 下次托管文件夹助理处理邮箱并检测已删除电子数据展示保留时,邮箱将设置延迟保留。Mailboxes: A delay hold is placed on a mailbox the next time the Managed Folder Assistant processes the mailbox and detects that an eDiscovery hold was removed. 具体来说,当托管文件夹助理将下列邮箱属性之一设置为 True 时,将延迟保留应用于 邮箱Specifically, a delay hold is applied to a mailbox when the Managed Folder Assistant sets one of the following mailbox properties to True:

    • DelayHoldApplied: 此属性适用于用户邮箱 (Outlook 和 Outlook 网页) 生成的电子邮件相关内容。DelayHoldApplied: This property applies to email-related content (generated by people using Outlook and Outlook on the web) that's stored in a user's mailbox.

    • DelayReleaseHoldApplied: 此属性适用于非 Outlook ((如存储在用户邮箱中的 Microsoft Teams、Microsoft Forms 和 Microsoft Yammer) )生成的基于云的内容。DelayReleaseHoldApplied: This property applies to cloud-based content (generated by non-Outlook apps such as Microsoft Teams, Microsoft Forms, and Microsoft Yammer) that's stored in a user's mailbox. 由 Microsoft 应用生成的云数据通常存储在用户邮箱的隐藏文件夹中。Cloud data generated by a Microsoft app is typically stored in a hidden folder in a user's mailbox.

    如果对邮箱 (设置了延迟保留,则当以前的任一属性设置为 True) 时,该邮箱仍被视为处于无限期保留状态,就像邮箱处于诉讼保留一样。When a delay hold is placed on the mailbox (when either of the previous properties is set to True), the mailbox is still considered to be on hold for an unlimited hold duration, as if the mailbox was on Litigation Hold. 30 天后,延迟保留过期,Microsoft 365 将自动尝试删除延迟保留 (,将 DelayHoldApplied 或 DelayReleaseHoldApplied 属性设置为 False) 以便删除该保留。After 30 days, the delay hold expires, and Microsoft 365 will automatically attempt to remove the delay hold (by setting the DelayHoldApplied or DelayReleaseHoldApplied property to False) so that the hold is removed. 在将其中任一属性设置为 False 后,将在托管文件夹助理下次处理邮箱时清除标记为删除的相应项目。After either of these properties are set to False, the corresponding items that are marked for removal are purged the next time the mailbox is processed by the Managed Folder Assistant.

    有关详细信息,请参阅管理延迟保留的邮箱For more information, see Managing mailboxes on delay hold.

  • SharePoint 和 OneDrive 网站: 从电子数据展示保留中删除网站后,保留库内保留的任何 SharePoint 或 OneDrive 内容不会在 30 天延迟保留期内删除。SharePoint and OneDrive sites: Any SharePoint or OneDrive content that's being retained in the Preservation Hold library isn't deleted during the 30-day delay hold period after a site is removed from an eDiscovery hold. 这类似于从保留策略中释放网站时发生的情况。This is similar to what happens when a site is released from a retention policy. 此外,在 30 天延迟保留期间,无法手动删除保留库中的此内容。Additionally, you can't manually delete this content in the Preservation Hold library during the 30-day delay hold period.

    有关详细信息,请参阅 发布保留策略For more information, see Releasing a policy for retention.

关闭核心电子数据展示案例时,延迟保留也会应用于保留的内容位置,因为关闭案例时将关闭保留。A delay hold is also applied to content locations on hold when you close a Core eDiscovery case because holds are turned off when a case is closed. 有关关闭案例的信息,请参阅关闭、 重新打开和删除核心电子数据展示案例For more information about closing a case, see Close, reopen, and delete a Core eDiscovery case.

电子数据展示保留限制eDiscovery hold limits

下表列出了电子数据展示事例和事例保留的限制。The following table lists the limits for eDiscovery cases and case holds.

限制说明Description of limit 限制Limit
组织的最大事例数。Maximum number of cases for an organization.
无限制No limit
组织的最大电子数据展示保留数。Maximum number of eDiscovery holds for an organization.
10,00010,000
单个电子数据展示保留中的最大邮箱数。Maximum number of mailboxes in a single eDiscovery hold. 此限制包括用户邮箱总数,以及与 Microsoft 365 组、Microsoft Teams 和 Yammer 组关联的邮箱总数。This limit includes the combined total of user mailboxes, and the mailboxes associated with Microsoft 365 Groups, Microsoft Teams, and Yammer Groups.
1,0001,000
单个电子数据展示保留中的最大网站数。Maximum number of sites in a single eDiscovery hold. 此限制包括 OneDrive for Business 网站、SharePoint 网站以及与 Microsoft 365 组、Microsoft Teams 和 Yammer 组关联的网站总数。This limit includes the combined total of OneDrive for Business sites, SharePoint sites, and the sites associated with Microsoft 365 Groups, Microsoft Teams, and Yammer Groups.
100100
电子数据展示主页上显示的最大事例数,以及事例中"保留项、搜索"和"导出"选项卡上显示的最大项目数。Maximum number of cases displayed on the eDiscovery home page, and the maximum number of items displayed on the Holds, Searches, and Export tabs within a case. 11 1,0001,000

备注

1 若要查看超过 1,000 个事例、保留、搜索或导出的列表,可以使用相应的 Office 365 安全&合规性 PowerShell cmdlet:1 To view a list of more than 1,000 cases, holds, searches, or exports, you can use the corresponding Office 365 Security & Compliance PowerShell cmdlet: