建立電子文件探索保留Create an eDiscovery hold

您可以使用核心 eDiscovery 案例來建立保留,以保留可能與案例相關的內容。You can use a Core eDiscovery case to create holds to preserve content that might be relevant to the case. 您可以針對在案例中所調查之人員的商務客戶,保留 Exchange 信箱和 OneDrive。You can place a hold on the Exchange mailboxes and OneDrive for Business accounts of people you're investigating in the case. 您也可以在與 Microsoft 小組、Office 365 群組和 Yammer 群組相關聯的信箱和網站上放置保留。You can also place a hold on the mailboxes and sites that are associated with Microsoft Teams, Office 365 Groups, and Yammer Groups. 當您將內容位置置於保留狀態時,會保留內容,直到您從內容位置移除保留,或刪除保留為止。When you place content locations on hold, content is preserved until you remove the hold from the content location or until you delete the hold.

在您建立 eDiscovery 保留後,可能需要長達24小時,保留才會生效。After you create an eDiscovery hold, it may take up to 24 hours for the hold to take effect.

當您建立保留時,您可以使用下列選項來限定保留在指定內容位置的內容:When you create a hold, you have the following options to scope the content that is preserved in the specified content locations:

  • 您可以建立無限保留,其中指定位置的所有內容都會處於暫止狀態。You create an infinite hold where all content in the specified locations is placed on hold. 或者,您可以建立以查詢為基礎的保留,其中只有符合搜尋查詢之指定位置的內容處於暫止狀態。Alternatively, you can create a query-based hold where only the content in the specified locations that matches a search query is placed on hold.

  • 您可以指定日期範圍,只保留在該日期範圍內傳送、接收或建立的內容。You can specify a date range to preserve only the content that was sent, received, or created within that date range. 或者,您也可以保留指定位置的所有內容,不論它是在何時傳送、接收或建立。Alternatively, you can hold all content in specified locations regardless of when it was sent, received, or created.

如何建立電子檔保留How to create an eDiscovery hold

若要建立與核心 eDiscovery 案例相關聯的 eDiscovery 保留:To create an eDiscovery hold that's associated with a Core eDiscovery case:

  1. 移至 https://compliance.microsoft.com 並登入使用已獲指派適當 eDiscovery 許可權之使用者帳戶的認證。Go to https://compliance.microsoft.com and sign in using the credentials for user account that has been assigned the appropriate eDiscovery permissions.

  2. 在 Microsoft 365 規範中心的左功能窗格中,按一下 [ 全部顯示],然後按一下 [ eDiscovery > Core]。In the left navigation pane of the Microsoft 365 compliance center, click Show all, and then click eDiscovery > Core.

  3. 在 [ 核心電子 檔探索] 頁面上,選取您要在其中建立保留的案例,然後按一下 [ 開啟案例]。On the Core eDiscovery page, select the case that you want to create the hold in, and then click Open case.

  4. 在案例的 首頁 上,按一下 [ 保留 ] 索引標籤。On the Home page for the case, click the Holds tab.

  5. 在 [ 保留 ] 頁面上,按一下 [ 建立]。On the Holds page, click Create.

  6. 在 [ 命名您的保留 嚮導] 頁面上,提供 [保留名稱] 並新增選用描述,然後按 [下一步]On the Name your hold wizard page, give the hold a name and add an optional description, and then click Next. [保留] 的名稱在您的組織中必須是唯一的。The name of the hold must be unique in your organization.

  7. 在 [ 內容位置 ] 頁面上,選擇您要保留的內容位置。On the Content locations page, choose the content locations that you want to place on hold. 您可以將信箱、網站和公用資料夾放入暫止狀態。You can place mailboxes, sites, and public folders on hold.

    選擇要保留的內容位置

    1. 信箱位置 -按一下 [選擇使用者、群組或小組 ],然後按一下 [選擇使用者、群組或小組 ],以指定要置於保留狀態的信箱。Mailbox locations - Click Choose users, groups, or teams and then click Choose users, groups, or teams again to specify the mailboxes to place on hold. 使用 [搜尋] 方塊來尋找使用者信箱和通訊群組 (將保留在群組成員的信箱上) 進行暫止。Use the search box to find user mailboxes and distribution groups (to place a hold on the mailboxes of group members) to place on hold. 您也可以在 Microsoft 小組、Office 365 群組或 Yammer 群組的相關信箱上放置保留。You can also place a hold on the associated mailbox for a Microsoft Team, Office 365 Group, or Yammer Group. 選取 [使用者、群組、小組] 核取方塊,按一下 [選擇],然後按一下 [ 完成]。Select the user, group, team check box, click Choose, and then click Done.

    2. 網站位置 -按一下 [選擇網站 ],然後按一下 [選擇網站 ],以指定要保留的 SharePoint 和 OneDrive 帳戶。Site locations - Click Choose sites and then click Choose sites again to specify SharePoint and OneDrive accounts to place on hold. 輸入您要保留之每個網站的 URL。Type the URL for each site that you want to place on hold. 您也可以為 Microsoft 團隊、Office 365 群組或 Yammer 群組新增 SharePoint 網站的 URL。You can also add the URL for the SharePoint site for a Microsoft Team, Office 365 Group or a Yammer Group. 按一下 [選擇],然後按一下 [ 完成]。Click Choose, and then click Done.

    3. Exchange 公用資料夾。Exchange public folders. 將切換切換切換  控制項移 至 [ 全部 ] 位置,將 Exchange Online 組織中的所有公用資料夾保留。Move the toggle switch Toggle control to the All position to put all public folders in your Exchange Online organization on hold. 您無法選擇要保留的特定公用資料夾。You can't choose specific public folders to put on hold. 如果您不想要保留公用資料夾,請將切換參數設為 [ ]。Leave the toggle switch set to None if you don't want to put a hold on public folders.

    注意

    您必須將至少一個內容位置新增至保留。You must add at least one content location to the hold. 否則,eDiscovery 保留靜態會顯示沒有任何專案處於保留狀態。Otherwise, the eDiscovery hold statics will show that no items are on hold.

  8. 當您完成將內容位置新增至保留狀態時,按 [下一步]When you're done adding content locations to the hold, click Next.

  9. 若要建立查詢式保留與條件,請完成下列。To create a query-based hold with conditions, complete the following. 否則,若要保留指定內容位置中的所有內容,請按 [下一步]Otherwise, to preserve all content in the specified content locations, click Next.

    使用條件建立以查詢為基礎的保留

    1. 在 [ 關鍵字] 下方的方塊中,輸入搜尋查詢,只保留符合搜尋準則的內容。In the box under Keywords, type a search query so that only the content that meets the search criteria is preserved. 您可以指定關鍵字、電子郵件訊息屬性或檔案屬性,例如檔案名。You can specify keywords, email message properties, or document properties, such as file names. 您也可以使用更複雜的查詢,使用布林運算子,例如 ANDorNOTYou can also use more complex queries that use a Boolean operator, such as AND, OR, or NOT.

    2. 按一下 [ 新增條件 ] 以新增一或多個條件,以縮小保留的搜尋查詢。Click Add conditions to add one or more conditions to narrow the search query for the hold. 每個條件都會將子句新增至您建立保留時所建立並執行的 KQL 搜尋查詢。Each condition adds a clause to the KQL search query that is created and run when you create the hold. 例如,您可以指定日期範圍,讓在日期範圍內建立的電子郵件或網站檔處於暫止狀態。For example, you can specify a date range so that email or site documents that were created within the date ranged are placed on hold. 條件會以邏輯方式連線至 [ 關鍵字 ] 方塊中指定的關鍵字查詢 () 由 AND 運算子。A condition is logically connected to the keyword query (specified in the Keywords box) by the AND operator. 這表示專案必須同時滿足關鍵字查詢和要保留的條件。That means that items have to satisfy both the keyword query and the condition to be preserved.

    如需建立搜尋查詢和使用條件的詳細資訊,請參閱 內容搜尋的關鍵字查詢和搜尋條件For more information about creating a search query and using conditions, see Keyword queries and search conditions for Content Search.

  10. 設定查詢型保留後,請按 [下一步]After configuring a query-based hold, click Next.

  11. 請複查您的設定 (並在必要時進行編輯) ,然後按一下 [ 建立此保留]。Review your settings (and edit them if necessary), and then click Create this hold.

放在網站檔上的查詢式保留Query-based holds placed on site documents

當您為位於 SharePoint 網站中的檔放置以查詢為基礎的 eDiscovery 保留時,請記住下列事項:Keep the following things in mind when you place a query-based eDiscovery hold on documents located in SharePoint sites:

  • 以查詢為基礎的保留會在刪除網站時,一小段時間內保留所有檔。A query-based hold initially preserves all documents in a site for a short period of time after they are deleted. 這表示當檔遭到刪除時,它會移至 [保留] 存放庫,即使它不符合查詢型保留的準則也是一樣。That means when a document is deleted, it will be moved to the Preservation Hold library even if it doesn't match the criteria of the query-based hold. 不過,已刪除但不符合查詢型保留的檔,會被處理保留的保留庫的計時器工作移除。However, deleted documents that don't match a query-based hold will be removed by a timer job that processes the Preservation Hold library. 計時器工作會定期執行,並將 [保留保留] 文件庫中的所有檔與您查詢的 eDiscovery 保存在一起, (及其他類型的保留和保留原則) 。The timer job runs periodically and compares all documents in the Preservation Hold library to your query-based eDiscovery holds (and other types of holds and retention policies). 計時器工作會刪除不符合查詢型保留的檔,並保留所做的檔。The timer job deletes the documents that don't match a query-based hold and preserves the documents that do.

  • 查詢型保留不能用來執行目標保留,例如保留特定資料夾或網站中的檔,或使用其他以位置為基礎的保留準則。Query-based holds should not be used to perform targeted preservation, like preserving documents in a specific folder or site or by using other location-based hold criteria. 這樣做可能會產生非預期的結果。Doing so may have unintended results. 我們建議使用非位置的保留準則(如關鍵字、日期範圍或其他檔案屬性)來保留網站檔。We recommend using non-location based hold criteria such as keywords, date ranges, or other document properties to preserve site documents.

eDiscovery 保留統計資料eDiscovery hold statistics

在您建立 eDiscovery 暫止功能之後,有關新保留的資訊會顯示在所選保留的飛入頁面上。After you create an eDiscovery hold, information about the new hold is displayed on the flyout page for the selected hold. 此資訊包含保留的信箱和網站數量,以及有關保留之內容的統計資料,例如,保留的專案總數和大小,以及計算保留統計資料的最後時間。This information includes the number of mailboxes and sites on hold and statistics about the content that was placed on hold, such as the total number and size of items placed on hold and the last time the hold statistics were calculated. 這些保留統計資料可協助您識別要保留與案例相關的內容數量。These hold statistics help you identify the amount of content related to the case is being preserved.

保留統計資料

請記住有關 eDiscovery 保留統計資料的下列事項:Keep the following things in mind about eDiscovery hold statistics:

  • [保留中的專案總數] 表示來自保留之所有內容來源的專案數目。The total number of items on hold indicates the number of items from all content sources that are placed on hold. 如果您已建立以查詢為基礎的保留,則此統計資料會指出符合查詢的專案數。If you've created a query-based hold, this statistic indicates the number of items that match the query.

  • 保留專案數也包含在內容位置找到的未編制索引的專案。The number of items on hold also includes unindexed items found in the content locations. 如果您建立以查詢為基礎的保留,則內容位置中的所有未編制索引的專案都會處於保留狀態。If you create a query-based hold, all unindexed items in the content locations are placed on hold. 這包括未編制索引的專案,但不符合查詢型保留的搜尋準則,以及可能超出日期範圍條件的未編制索引項目目。This includes unindexed items that don't match the search criteria of a query-based hold and unindexed items that might fall outside of a date range condition. 這與執行搜尋時所發生的情形不同,在此搜尋中,搜尋結果中不會包含未符合搜尋查詢或由日期範圍條件排除的非索引項目目。This is different than what happens when you run a search, in which unindexed items that don't match the search query or are excluded by a date range condition aren't included in the search results. 如需未編制索引之專案的詳細資訊,請參閱 部分編制索引的專案For more information about unindexed items, see Partially indexed items.

  • 您可以按一下 [ 更新統計資料] 以重新執行搜尋預估,以計算目前保留的專案數,以取得最新的保留統計資料。You can get the latest hold statistics by clicking Update statistics to rerun a search estimate that calculates the current number of items on hold.

  • 保留的專案數是正常的,因為信箱或網站處於保留狀態的使用者通常是在 SharePoint 和 OneDrive 中傳送或接收新的電子郵件,並建立新的檔。It's normal for the number of items on hold to increase over time because users whose mailbox or site is on hold are typically sending or receiving new email message and creating new documents in SharePoint and OneDrive.

  • 如果 Exchange 信箱、SharePoint 網站或 OneDrive 帳戶移至多地理位置環境中的其他區域,該網站的統計資料將不會包含在 [保留統計資料] 中。If an Exchange mailbox, SharePoint site, or OneDrive account is moved to a different region in a multi-geo environment, the statistics for that site won't be included in the hold statistics. 但這些位置的內容仍會保留。But the content in those locations will still be preserved. 此外,如果信箱或網站移至不同的地區,保留中所顯示的 SMTP 位址或 URL 不會自動更新。Also, if a mailbox or site is moved to a different region, the SMTP address or URL that's displayed in the hold will not automatically be updated. 您必須編輯保留並更新 URL 或 SMTP 位址,以便內容位置再次包含在保留統計資料中You'll have to edit the hold and update the URL or SMTP address so the content locations are once again included in the hold statistics

EDiscovery 保留上的搜尋位置Search locations on eDiscovery hold

當您在核心 eDiscovery 案例中 搜尋內容 時,您可以快速設定搜尋,只搜尋與案例相關聯之保留的內容位置。When you search for content in a Core eDiscovery case, you can quickly configure the search to only search the content locations that have been placed on a hold associated with the case.

保留位置

選取 [ 保留的位置 ] 選項,可搜尋已設定保留狀態的所有內容位置。Select the Locations on hold option to search all the content locations that have been placed on hold. 若案例中包含多個 eDiscovery 保留,當您選取這個選項時,將會搜尋所有保留的內容位置。If the case contains multiple eDiscovery holds, the content locations from all holds will be searched when you select this option. 此外,如果內容位置是放在查詢型保留中,當您執行搜尋時,只會搜尋符合保留查詢的專案。Additionally, if a content location was placed on a query-based hold, only the items that match the hold query will be searched when you run the search. 換句話說,只有符合保留準則和搜尋準則的內容會隨搜尋結果一起傳回。In other words, only the content that matches both the hold criteria and the search criteria is returned with the search results. 例如,如果使用者已設定為以查詢為基礎的案例保留,可保留在特定日期之前已傳送或建立的專案,則只會搜尋這些專案。For example, if a user was placed on query-based case hold that preserves items that were sent or created before a specific date, only those items would be searched. 這是透過以 and 運算子連接案例保留查詢和搜尋查詢來完成。This is accomplished by connecting the case hold query and the search query by an AND operator.

以下是搜尋 eDiscovery 暫止位置時需要記住的一些其他事項:Here are some other things to keep in mind when searching locations on eDiscovery hold:

  • 在相同的情況下,如果內容位置是多個保留的一部分,當您使用 [全部案例內容] 選項來搜尋該內容位置時,保留查詢會由 OR 運算子組合。If a content location is part of multiple holds within the same case, the hold queries are combined by OR operators when you search that content location using the all case content option. 同樣地,如果內容位置是兩個不同保留的一部分,其中一個是以查詢為基礎的,另一個是不限保留的 (,其所有內容都會保留在) 上,則所有內容都會因無限期保留而進行搜尋。Similarly, if a content location is part of two different holds, where one is query-based and the other is an infinite hold (where all content is placed on hold), then all content is search because of the infinite hold.

  • 如果搜尋將其設定為保留搜尋位置,然後在 (案例中變更 eDiscovery 保留,只要新增或移除位置或變更保留查詢) ,就會以這些變更更新搜尋設定。If a search is configured it to search locations on hold and then you change an eDiscovery hold in the case (by adding or removing a location or changing a hold query), the search configuration is updated with those changes. 不過,您必須在變更保留以更新搜尋結果之後重新執行搜尋。However, you have to rerun the search after the hold is changed to update the search results.

  • 如果在 eDiscovery 案例中將多個 eDiscovery 保留置於單一位置,且您選擇搜尋保留的位置,則該搜尋查詢的關鍵字數目上限為500。If multiple eDiscovery holds are placed on a single location in an eDiscovery case and you select to search locations on hold, the maximum number of keywords for that search query is 500. 這是因為搜尋會結合使用 OR 運算子的所有查詢型保留。That's because the search combines all the query-based holds by using the OR operator. 如果合併保留查詢和搜尋查詢中的關鍵字超過500個,則會搜尋信箱中的所有內容,而不只是符合查詢架構案例的內容。If there are more than 500 keywords in the combined hold queries and the search query, then all content in the mailbox is searched, not just that content that matches the query-based case holds.

  • 如果 eDiscovery 保留狀態為 [ 開啟],則您仍然可以在保持開啟狀態時,搜尋保留的位置。If an eDiscovery hold has a status of Turning on, you can still search the locations on hold while the hold is being turned on.

保留 Microsoft 小組中的內容Preserve content in Microsoft Teams

屬於 Microsoft 團隊通道一部分的對話會儲存在與 Microsoft 小組相關聯的信箱中。Conversations that are part of a Microsoft Teams channel are stored in the mailbox that's associated with the Microsoft Team. 同樣地,團隊成員在頻道中共用的檔案會儲存在團隊的 SharePoint 網站上。Similarly, files that team members share in a channel are stored on the team's SharePoint site. 因此,您必須將「小組信箱」和「SharePoint 網站」置於 eDiscovery 暫止狀態,才能保留通道中的交談和檔案。Therefore, you have to place the Team mailbox and SharePoint site on eDiscovery hold to preserve conversations and files in a channel.

或者,屬於「 1:1 交談 」或「 1: N 群組聊天 」) 之 (小組中 [交談] 清單一部分的交談,都是儲存在參與聊天的使用者信箱中。Alternatively, conversations that are part of the Chat list in Teams (called 1:1 chats or 1:N group chats) are stored in the mailboxes of the users who participate in the chat. 與在聊天交談中的使用者共用的檔案,會儲存在共用該檔案之使用者的 OneDrive 帳戶中。And files that users share in chat conversations are stored in the OneDrive account of the user who shares the file. 因此,您必須將個別的使用者信箱和 OneDrive 帳戶新增至 eDiscovery 暫止,以保留聊天清單中的交談和檔案。Therefore, you have to add the individual user mailboxes and OneDrive accounts to an eDiscovery hold to preserve conversations and files in the chat list. 除了放置小組信箱和網站保留狀態之外,還建議您保留 Microsoft 小組成員的信箱。It's a good idea to place a hold on the mailboxes of members of a Microsoft Team in addition to placing the team mailbox and site on hold.

重要

在雲端式組織中,參與交談(屬於小組中的聊天室清單)的使用者必須具有 Exchange Online 信箱,才能在信箱置於 eDiscovery 暫止時保留聊天交談。In a cloud-based organization, users who participate in conversations that are part of the chat list in Teams must have an Exchange Online mailbox in order to retain chat conversations when the mailbox is placed on an eDiscovery hold. 這是因為 [聊天室] 清單中的交談是儲存在聊天參與者的雲端架構信箱中。That's because conversations that are part of the chat list are stored in the cloud-based mailboxes of the chat participants. 如果聊天參與者沒有 Exchange Online 信箱,您將無法保留這些聊天會話。If a chat participant doesn't have an Exchange Online mailbox, you won't be able to preserve those chat conversations. 例如,在 Exchange 混合式部署中,具有內部部署信箱的使用者,可能能夠加入屬於小組之聊天室清單一部分的交談。For example, in an Exchange hybrid deployment, users with an on-premises mailbox may be able to participate in conversations that are part of the chat list in Teams. 不過,在此情況下,無法保留這些交談的內容,因為這些使用者沒有可以保留的雲端式信箱。But in this case, content from these conversation can't be preserved because these users don't have a cloud-based mailboxes that can be placed on hold.

如需有關保留小組內容的詳細資訊,請參閱 將 Microsoft 團隊使用者或小組設為法定保留For more information about preserving Teams content, see Place a Microsoft Teams user or team on legal hold.

保留卡片內容Preserve card content

同樣地,小組頻道中的應用程式所產生的卡片內容,1:1 聊天和1: N 群組聊天會儲存在信箱中,而且會在信箱置於 eDiscovery 暫止時保留。Similarly, card content generated by apps in Teams channels, 1:1 chats, and 1:N group chats is stored in mailboxes and is preserved when a mailbox is placed on an eDiscovery hold. 卡片 是簡短內容片段的 UI 容器。A card is a UI container for short pieces of content. 名片可以有多個屬性和附件,也可以包含觸發卡片動作的按鈕。Cards can have multiple properties and attachments, and can include buttons that trigger card actions. 如需詳細資訊,請參閱 卡片For more information, see Cards. 與其他小組內容不同的是,智慧卡內容的儲存位置取決於使用卡的位置。Like other Teams content, where card content is stored is based on where the card was used. 小組通道中使用的卡片內容會儲存在小組群組信箱中。Content for cards used in a Teams channel is stored in the Teams group mailbox. 1:1 和1xN 聊天室的卡片內容會儲存在聊天參與者的信箱中。Card content for 1:1 and 1xN chats are stored in the mailboxes of the chat participants.

保留會議及電話資訊Preserve meeting and call information

「小組頻道」中會議和通話的摘要資訊也會儲存在撥打會議或通話的使用者信箱中。Summary information for meetings and calls in a Teams channel is also stored in the mailboxes of users who dialed into the meeting or call. 將 eDiscovery 保留放在使用者信箱時,也會保留此內容。This content is also preserved when an eDiscovery hold is placed on user mailboxes.

保留私人通道中的內容Preserve content in private channels

從2020年2月開始,我們也開啟了保留私人通道內容的能力。Starting in February 2020, we also turned on ability to preserve content in private channels. 因為私人通道聊天是儲存在聊天參與者的信箱中,所以在 eDiscovery 保留中放置使用者信箱將會保留私人通道聊天。Because private channel chats are stored in the mailboxes of the chat participants, placing a user mailbox on eDiscovery hold will preserve private channel chats. 此外,如果使用者信箱位於2月2020日前的 eDiscovery 暫止狀態,則保留現在會自動套用至該信箱中儲存的私人通道郵件。Also, if a user mailbox was placed on an eDiscovery hold prior to February 2020, the hold will now automatically apply to private channel messages stored in that mailbox. 也支援保留私人通道中共用的檔案。Preserving files shared in private channels is also supported.

保留 wiki 內容Preserve wiki content

每個小組或小組頻道也包含 Wiki 進行記事與共同作業。Every Team or team channel also contains a Wiki for note taking and collaboration. Wiki 的內容會自動儲存至 .mht 格式的檔案中。The Wiki content is automatically saved to a file with a .mht format. 此檔案會儲存在團隊 SharePoint 網站上的 Teams Wiki 資料文件庫中。This file is stored in the Teams Wiki Data document library on the team's SharePoint site. 您可以將小組的 SharePoint 網站新增至 eDiscovery 保留,以保留 wiki 內容。You can preserve the wiki content by adding the team's SharePoint site to an eDiscovery hold.

注意

當您將小組 SharePoint 網站保留) 發佈于2017年6月22日時,可保留該小組或小組頻道 (的 Wiki 內容的功能。The capability to preserve Wiki content for a Team or team channel (when you place the team's SharePoint site on hold) was released on June 22, 2017. 如果小組網站處於保留狀態,Wiki 內容將會從該日期開始保留。If a team site is on hold, the Wiki content will be retained starting on that date. 不過,如果小組網站處於保留狀態,且 Wiki 內容已在2017年6月22日之前刪除,則 Wiki 內容尚未保留。However, if a team site is on hold and the Wiki content was deleted before June 22, 2017, the Wiki content was not preserved.

Office 365 群組Office 365 Groups

小組是以 Office 365 群組為基礎。Teams is built on Office 365 Groups. 因此,將 Office 365 群組放在 eDiscovery 暫止的情況類似于讓小組內容保持保留狀態。Therefore, placing Office 365 Groups on eDiscovery hold is similar placing Teams content on hold.

將兩個小組和 Office 365 群組置於 eDiscovery 保留狀態時,請牢記下列事項:Keep the following things in mind when placing both Teams and Office 365 Groups on an eDiscovery hold:

  • 如先前所述,若要將位於小組和 Office 365 群組的內容保留,您必須指定與群組或小組相關聯的信箱和 SharePoint 網站。As previously explained, to place content located in Teams and Office 365 Groups on hold, you have to specify the mailbox and SharePoint site that associated with a group or team.

  • Exchange Online PowerShell中執行 set-unifiedgroup 指令程式,以查看小組和 Office 365 群組的屬性。Run the Get-UnifiedGroup cmdlet in Exchange Online PowerShell to view properties for Teams and Office 365 Groups. 若要取得與小組或 Office 365 群組相關聯之網站的 URL,這是一種很好的方式。This is a good way to get the URL for the site that's associated with a Team or Office 365 Group. 例如,下列命令會顯示名為「資深領導團隊」的 Office 365 群組的所選屬性:For example, the following command displays selected properties for an Office 365 Group named Senior Leadership Team:

    Get-UnifiedGroup "Senior Leadership Team" | FL DisplayName,Alias,PrimarySmtpAddress,SharePointSiteUrl
    
    DisplayName            : Senior Leadership Team
    Alias                  : seniorleadershipteam
    PrimarySmtpAddress     : seniorleadershipteam@contoso.onmicrosoft.com
    SharePointSiteUrl      : https://contoso.sharepoint.com/sites/seniorleadershipteam
    

    注意

    若要執行 Get-UnifiedGroup Cmdlet,您必須獲指派 Exchange Online 中的「僅檢視收件者」角色或者為獲指派「僅檢視收件者」角色之角色群組的成員。To run the Get-UnifiedGroup cmdlet, you have to be assigned the View-Only Recipients role in Exchange Online or be a member of a role group that's assigned the View-Only Recipients role.

  • 當使用者的信箱進行搜尋時,不會搜尋使用者所屬的任何小組或 Office 365 群組。When a user's mailbox is searched, any Team or Office 365 Group that the user is a member of won't be searched. 同樣地,當您在 eDiscovery 暫止時放置小組或 Office 365 群組時,只有群組信箱和群組網站處於保留狀態。Similarly, when you place a Team or Office 365 Group on eDiscovery hold, only the group mailbox and group site are placed on hold. 除非您明確地將其新增至 eDiscovery 保留,否則不會保留群組成員之商務網站的信箱和 OneDrive。The mailboxes and OneDrive for Business sites of group members aren't placed on hold unless you explicitly add them to the eDiscovery hold. 因此,如果您出於法律原因而必須將小組或 Office 365 群組保留,請考慮在相同的保留中加入小組成員或群組成員的信箱和 OneDrive 帳戶。So if you have to place a Team or Office 365 Group on hold for a legal reason, consider adding the mailboxes and OneDrive accounts of team or group members on the same hold.

  • 若要取得小組或 Office 365 群組的成員清單,您可以在 Microsoft 365 系統管理中心的 [ 群組 ] 頁面上查看屬性。To get a list of the members of a Team or Office 365 Group, you can view the properties on the Groups page in the Microsoft 365 admin center. 或者,您可以在 Exchange Online PowerShell 中執行下列命令:Alternatively, you can run the following command in Exchange Online PowerShell:

    Get-UnifiedGroupLinks <group or team name> -LinkType Members | FL DisplayName,PrimarySmtpAddress
    

    注意

    若要執行 Get-UnifiedGroupLinks Cmdlet,您必須獲指派 Exchange Online 中的「僅檢視收件者」角色或者為獲指派「僅檢視收件者」角色之角色群組的成員。To run the Get-UnifiedGroupLinks cmdlet, you have to be assigned the View-Only Recipients role in Exchange Online or be a member of a role group that's assigned the View-Only Recipients role.

保留 OneDrive 帳戶中的內容Preserve content in OneDrive accounts

若要收集組織中商務網站 OneDrive 的 URLs 清單,以便將其新增至與 eDiscovery 案例相關聯的保留或搜尋,請參閱 建立組織中所有 OneDrive 位置的清單To collect a list of the URLs for the OneDrive for Business sites in your organization so you can add them to a hold or search associated with an eDiscovery case, see Create a list of all OneDrive locations in your organization. 本文中的腳本會建立一個文字檔,其中包含組織中所有 OneDrive 網站的清單。The script in this article creates a text file that contains a list of all OneDrive sites in your organization. 若要執行此指令碼,您必須安裝並使用 SharePoint Online 管理命令介面。To run this script, you have to install and use the SharePoint Online Management Shell. 請務必將您組織 MySite 網域的 URL 附加至您要搜尋的每個 OneDrive 網站。Be sure to append the URL for your organization's MySite domain to each OneDrive site that you want to search. 這是包含您所有 OneDrive 的網域;例如,https://contoso-my.sharepoint.comThis is the domain that contains all your OneDrive; for example, https://contoso-my.sharepoint.com. 以下是使用者 OneDrive 網站的 URL 範例:https://contoso-my.sharepoint.com/personal/sarad_contoso_onmicrosoft.comHere's an example of a URL for a user's OneDrive site: https://contoso-my.sharepoint.com/personal/sarad_contoso_onmicrosoft.com.

重要

使用者 OneDrive 帳戶的 URL 包含使用者主要名稱 (UPN) (例如 https://alpinehouse-my.sharepoint.com/personal/sarad_alpinehouse_onmicrosoft_com) 。The URL for a user's OneDrive account includes their user principal name (UPN) (for example, https://alpinehouse-my.sharepoint.com/personal/sarad_alpinehouse_onmicrosoft_com). 在極少數的情況下,使用者的 UPN 變更時,其 OneDrive URL 也會變更,以加入新的 UPN。In the rare case that a person's UPN is changed, their OneDrive URL will also change to incorporate the new UPN. 如果使用者的 OneDrive 帳戶是 eDiscovery 保留的一部分,舊的,且其 UPN 已變更,您必須更新保留,而且必須更新保留,並新增使用者的新 OneDrive URL,並移除舊的。If a user's OneDrive account is part of an eDiscovery hold, old and their UPN is changed, you need to update the hold and you'll have to update the hold and add the user's new OneDrive URL and remove the old one. 如需詳細資訊,請參閱 UPN 變更將如何影響 OneDrive URL (英文)。For more information, see How UPN changes affect the OneDrive URL.

移除 eDiscovery 保留中的內容位置Removing content locations from an eDiscovery hold

將信箱、SharePoint 網站或 OneDrive 帳戶從 eDiscovery 保留中移除之後,會套用 延遲保留After a mailbox, SharePoint site, or OneDrive account is removed from an eDiscovery hold, a delay hold is applied. 這表示實際刪除保留的時間延遲30天,以防止資料被永久刪除 (從內容位置清除) 。This means that the actual removal of the hold is delayed for 30 days to prevent data from being permanently deleted (purged) from a content location. 這可讓系統管理員搜尋或復原在移除 eDiscovery 保留後將會清除的內容。This gives admins an opportunity to search for or recover content that will be purged after an eDiscovery hold is removed. 信箱和網站的延遲保留運作方式的詳細資料會有所不同。The details of how the delay hold works for mailboxes and sites are different.

  • 信箱: [延遲保留] 會在下次受管理的資料夾助理處理信箱及偵測移除 eDiscovery 暫止時,放在信箱上。Mailboxes: A delay hold is placed on a mailbox the next time the Managed Folder Assistant processes the mailbox and detects that an eDiscovery hold was removed. 具體說來,當受管理的資料夾助理將下列其中一個信箱屬性設定為 True 時,會將延遲保留套用至信箱:Specifically, a delay hold is applied to a mailbox when the Managed Folder Assistant sets one of the following mailbox properties to True:

    • DelayHoldApplied: 此屬性適用于使用 Outlook 的使用者所產生的電子郵件與 Outlook,以及儲存在使用者信箱中的 web) 上的 Outlook 所產生的內容 (。DelayHoldApplied: This property applies to email-related content (generated by people using Outlook and Outlook on the web) that's stored in a user's mailbox.

    • DelayReleaseHoldApplied: 此屬性適用于由非 Outlook 應用程式(如 Microsoft 團隊、Microsoft Forms 及 Microsoft Yammer) 所產生)所產生的雲端式內容 (,這些應用程式儲存在使用者的信箱中。DelayReleaseHoldApplied: This property applies to cloud-based content (generated by non-Outlook apps such as Microsoft Teams, Microsoft Forms, and Microsoft Yammer) that's stored in a user's mailbox. Microsoft app 所產生的雲端資料通常會儲存在使用者信箱中的隱藏資料夾中。Cloud data generated by a Microsoft app is typically stored in a hidden folder in a user's mailbox.

    當 [任何先前的屬性] 設定為 True 時,信箱 (上的 [延遲保留] 設定為) True 時,信箱仍會被視為無限期保留期間(如同信箱處於訴訟暫止狀態時)。When a delay hold is placed on the mailbox (when either of the previous properties is set to True), the mailbox is still considered to be on hold for an unlimited hold duration, as if the mailbox was on Litigation Hold. 30天后,延遲保留會到期,而且 Microsoft 365 會嘗試將 DelayHoldApplied 或 DelayReleaseHoldApplied 屬性設定為 False) ,以移除延遲保留 (,使保留成為移除。After 30 days, the delay hold expires, and Microsoft 365 will automatically attempt to remove the delay hold (by setting the DelayHoldApplied or DelayReleaseHoldApplied property to False) so that the hold is removed. 在上述任一屬性設定為 False 之後,在下一次受管理的資料夾助理處理信箱時,會清除標示為待移除的對應專案。After either of these properties are set to False, the corresponding items that are marked for removal are purged the next time the mailbox is processed by the Managed Folder Assistant.

    如需詳細資訊,請參閱管理延遲保留信箱For more information, see Managing mailboxes on delay hold.

  • SharePoint 和 OneDrive 網站: 從 eDiscovery 保留中移除網站後的30天延遲保留期間內,將不會刪除保留在保留文件庫中的任何 SharePoint 或 OneDrive 內容。SharePoint and OneDrive sites: Any SharePoint or OneDrive content that's being retained in the Preservation Hold library isn't deleted during the 30-day delay hold period after a site is removed from an eDiscovery hold. 這與從保留原則發行網站時會發生什麼情況。This is similar to what happens when a site is released from a retention policy. 此外,您無法在30天的延遲保留期間內,以手動方式刪除保留文件庫中的內容。Additionally, you can't manually delete this content in the Preservation Hold library during the 30-day delay hold period.

    如需詳細資訊,請參閱 解除保留原則For more information, see Releasing a policy for retention.

當您關閉核心 eDiscovery 案例時,延遲保留也會套用至保留狀態,因為關閉案例時會關閉保留。A delay hold is also applied to content locations on hold when you close a Core eDiscovery case because holds are turned off when a case is closed. 如需關閉案例的詳細資訊,請參閱 關閉、重新開啟和刪除核心 eDiscovery 案例For more information about closing a case, see Close, reopen, and delete a Core eDiscovery case.

eDiscovery 保留限制eDiscovery hold limits

下表列出 eDiscovery 案例及案例保留的限制。The following table lists the limits for eDiscovery cases and case holds.

限制的描述Description of limit 限制Limit
組織的案例數目上限Maximum number of cases for an organization
無限制No limit
組織的 eDiscovery 保留數目上限Maximum number of eDiscovery holds for an organization
10,00010,000
單一電子檔保留中的信箱數目上限Maximum number of mailboxes in a single eDiscovery hold
1,0001,000
單一 eDiscovery 保留中商務網站的 SharePoint 數目上限及 OneDriveMaximum number of SharePoint and OneDrive for Business sites in a single eDiscovery hold
100100
在 eDiscovery 首頁顯示的案例數目上限,以及在案例中的 [保留]、[搜尋] 和 [匯出] 索引標籤上顯示的專案數上限。Maximum number of cases displayed on the eDiscovery home page, and the maximum number of items displayed on the Holds, Searches, and Export tabs within a case. 11 1,0001,000

注意

1 若要查看超過1000案例、保留、搜尋或匯出的清單,您可以使用對應的 Office 365 安全性 & 合規性 PowerShell Cmdlet:1 To view a list of more than 1,000 cases, holds, searches, or exports, you can use the corresponding Office 365 Security & Compliance PowerShell cmdlet: