在高級 eDiscovery 中管理保留Manage holds in Advanced eDiscovery

您可以使用 Advanced eDiscovery 案例來建立保留,以保留可能與案例相關的內容。You can use an Advanced eDiscovery case to create holds to preserve content that might be relevant to your case. 使用「高級 eDiscovery 保留」功能,您可以將保留置於保管人及其資料來源。Using the Advanced eDiscovery hold capabilities, you can place holds on custodians and their data sources. 此外,您可以在信箱和 OneDrive 商務網站上放置非 custodial 保留。Additionally, you can place a non-custodial hold on mailboxes and OneDrive for Business sites. 您也可以針對 Microsoft 365 群組,在群組信箱、SharePoint 網站和商務用 OneDrive 上放置保留。You can also place a hold on the group mailbox, SharePoint site, and OneDrive for Business site for an Microsoft 365 Group. 同樣地,您可以在與 Microsoft 小組相關聯的信箱和網站上進行保留。Similarly, you can place a hold on the mailbox and site that are associated with Microsoft Teams. 當您將內容位置置於保留狀態時,會保留內容,直到您放開保管人、移除特定資料位置或徹底刪除保留原則為止。When you place content locations on hold, content is held until you release the custodian, remove a specific data location, or delete the hold policy entirely.

管理以保管人為基礎的封存Manage custodian-based holds

在某些情況下,您可能會已識別一組保管人,並決定在案例期間保留其資料。In some cases, you may have a set of custodians that you have identified and have decided to preserve their data during the case. 在 [Advanced eDiscovery] 中,當這些保管人保留時,使用者及其選取的資料來源都會自動新增至保管人保留原則。In Advanced eDiscovery, when these custodians are placed on hold, the user and their selected data sources are automatically added to a custodian hold policy.

若要查看保管人保留原則:To view the custodian hold policy:

  1. 在 [Microsoft 365 規範中心] 中,按一下 [ eDiscovery > Advanced以顯示您組織中的案例清單。In the Microsoft 365 compliance center, click eDiscovery > Advanced to display the list of cases in your organization.

  2. 移至 [來源] 索引標籤,以在您的案例中新增保管人。Go to the Sources tab to add custodians within your case. 若要瞭解如何在高級 eDiscovery 案例中新增及放置保管人,請參閱Add 保管人 to a caseTo learn how you can add and place custodians on hold within an Advanced eDiscovery case, see Add Custodians to a case. 如果您已新增保管人並將其置於保留狀態,請移至步驟3。If you have already added custodians and placed them on hold, go to step 3.

  3. 移至 [保留] 索引標籤,然後按一下 [ **CustodianHold <HoldId> **]。Go to the Holds tab and click CustodianHold<HoldId>.

  4. 在飛入頁面上,您可以看到原則的 [保留統計資料]。On the flyout page, you can see hold statistics for the policy. 您也可以執行將查詢套用至保管人型保留等動作。You can also perform actions like apply a query to your custodian-based hold. 如需建立保留查詢及使用條件的詳細資訊,請參閱內容搜尋的關鍵字查詢和搜尋條件For more information about creating a hold query and using conditions, see Keyword queries and search conditions for Content Search.

管理非 custodial 保留Manage non-custodial holds

當您建立保留時,您可以使用下列選項來限定保留在指定內容位置的內容:When you create a hold, you have the following options to scope the content that is held in the specified content locations:

  • 您可以在保留所有內容的位置建立無限保留。You create an infinite hold where all content is placed on hold. 或者,您也可以建立以查詢為基礎的保留,只保留符合搜尋查詢的內容。Alternatively, you can create a query-based hold where only content that matches a search query is placed on hold.

  • 您可以指定日期範圍,只保留在該日期範圍內傳送、接收或建立的內容。You can specify a date range to hold only the content that was sent, received, or created within that date range. 或者,您可以保留所有內容,不論它是在何時傳送、接收或建立。Alternatively, you can hold all content regardless of when it was sent, received, or created.

若要為高級 eDiscovery 案例建立非 custodial 保留:To create a non-custodial hold for an Advanced eDiscovery case:

  1. 在 [Microsoft 365 規範中心] 中,按一下 [ eDiscovery > Advanced以顯示您組織中的案例清單。In the Microsoft 365 compliance center, click eDiscovery > Advanced to display the list of cases in your organization.

  2. 按一下您要建立保留之案例旁邊的 [開啟]。Click Open next to the case that you want to create the holds in.

  3. 從案例的首頁,按一下 [保留] 索引標籤。From the home page for the case, click the Holds tab.

  4. 在 [保留] 索引標籤上,按一下 [建立]。On the Holds tab, click Create.

  5. 在 [命名您的保留] 頁面上,指定保留名稱。On the Name your hold page, give the hold a name. [保留] 的名稱在您的組織中必須是唯一的。The name of the hold must be unique in your organization.

  6. 選在 [描述] 方塊中,新增保留的描述。(Optional) In the Description box, add a description of the hold.

  7. 按一下 [下一步]Click Next.

  8. 選擇您要保留的內容位置。Choose the content locations that you want to place on hold. 您可以將信箱、網站和公用資料夾放入暫止狀態。You can place mailboxes, sites, and public folders on hold.

    1. Exchange 電子郵件-按一下 [選擇使用者、群組或小組],然後按一下 [選擇使用者、群組或小組],以指定要保留的信箱。Exchange email - Click Choose users, groups, or teams and then click Choose users, groups, or teams again to specify mailboxes to place on hold. 使用搜尋方塊來尋找使用者信箱和通訊群組(保留信箱的群組成員)以保留。Use the search box to find user mailboxes and distribution groups (to place a hold on the mailboxes of group members) to place on hold. 您也可以在 Microsoft 365 群組或 Microsoft 小組的相關信箱上放置保留。You can also place a hold on the associated mailbox for an Microsoft 365 Group or a Microsoft Team. 選取 [使用者、群組、小組] 核取方塊,按一下 [選擇],然後按一下 [完成]。Select the user, group, team check box, click Choose, and then click Done.

      注意

      當您按一下 [選擇使用者、群組或小組以指定要保留的信箱] 時,顯示的信箱選擇器會是空的。When you click Choose users, groups, or teams to specify mailboxes to place on hold, the mailbox picker that's displayed is empty. 這項設計的目的是提升效能。This is by design to enhance performance. 若要將人員新增至此清單,請在 [搜尋] 方塊中輸入名稱(至少3個字元)。To add people to this list, type a name (a minimum of 3 characters) in the search box.

    2. SharePoint 網站-按一下 [選擇網站],然後按一下 [選擇網站],以指定要保留之商務網站的 SharePoint 和 OneDrive。SharePoint Sites - Click Choose sites and then click Choose sites again to specify SharePoint and OneDrive for Business sites to place on hold. 輸入您要保留之每個網站的 URL。Type the URL for each site that you want to place on hold. 您也可以為 Microsoft 365 群組或 Microsoft 團隊新增 SharePoint 網站的 URL。You can also add the URL for the SharePoint site for an Microsoft 365 Group or a Microsoft Team. 按一下 [選擇],然後按一下 [完成]。Click Choose, and then click Done.

      請參閱FAQ一節,以取得放置 Microsoft 365 群組和 microsoft 團隊保留的秘訣。See the FAQ section for tips on putting Microsoft 365 Groups and Microsoft Teams on hold.

      注意

      使用者 OneDrive 帳戶的 URL 包含使用者主要名稱(UPN)(例如 https://alpinehouse-my.sharepoint.com/personal/sarad_alpinehouse_onmicrosoft_com )。The URL for a user's OneDrive account includes their user principal name (UPN) (for example, https://alpinehouse-my.sharepoint.com/personal/sarad_alpinehouse_onmicrosoft_com). 在極少數的情況下,使用者的 UPN 變更時,其 OneDrive URL 也會變更,以加入新的 UPN。In the rare case that a person's UPN is changed, their OneDrive URL will also change to incorporate the new UPN. 如果使用者的 OneDrive 帳戶是非 custodial 保留的一部分,且其 UPN 已變更,您必須更新 [保留] 並指向新的 OneDrive URL。If a user's OneDrive account is part of a non-custodial hold and their UPN is changed, you need to update the hold and point to the new OneDrive URL. 如需詳細資訊,請參閱 UPN 變更將如何影響 OneDrive URL (英文)。For more information, see How UPN changes affect the OneDrive URL.

    3. Exchange 公用資料夾-將切換開關移至 [全部] 位置,將 Exchange Online 組織中的所有公用資料夾保留。Exchange public folders - Move the toggle switch to the All position to put all public folders in your Exchange Online organization on hold. 請注意,您無法選擇要保留的特定公用資料夾。Note that you can't choose specific public folders to put on hold. 如果您不想要保留公用資料夾,請將切換參數設為 []。Leave the toggle switch set to None if you don't want to put a hold on public folders.

  9. 當您完成將內容位置新增至保留狀態時,按 [下一步]When you're done adding content locations to the hold, click Next.

  10. 若要建立查詢式保留與條件,請完成下列。To create a query-based hold with conditions, complete the following. 否則,只要按 [下一步]Otherwise, just click Next.

    • 在 [關鍵字] 底下的方塊中輸入搜尋查詢,以便只保留符合搜尋準則的內容。In the box under Keywords, type a search query in the box so that only the content that meets the search criteria is placed on hold. 您可以指定關鍵字、郵件屬性或檔案屬性,例如檔案名稱。You can specify keywords, message properties, or document properties, such as file names. 您也可以使用更複雜的查詢,使用布林運算子,例如 AND、OR 或 NOT。You can also use more complex queries that use a Boolean operator, such as AND, OR, or NOT. 如果 [關鍵字] 方塊是空白的,則位於指定內容位置的所有內容都會處於保留狀態。If you leave the keyword box empty, then all content located in the specified content locations will be placed on hold.

    • 按一下 [新增條件] 以新增一或多個條件,以縮小保留的搜尋查詢。Click Add conditions to add one or more conditions to narrow the search query for the hold. 每個條件都會將子句新增至您建立保留時所建立並執行的 KQL 搜尋查詢。Each condition adds a clause to the KQL search query that is created and run when you create the hold. 例如,您可以指定日期範圍,讓在日期範圍內建立的電子郵件或網站檔處於暫止狀態。For example you can specify a date range so that email or site documents that were created within the date ranged are placed on hold. 條件會以 AND 運算子的邏輯方式連接至關鍵字查詢 (在關鍵字方塊中指定)。A condition is logically connected to the keyword query (specified in the keyword box) by the AND operator. 這表示專案必須同時滿足關鍵字查詢和要置於保留狀態的條件。That means that items have to satisfy both the keyword query and the condition to be placed on hold.

    如需建立搜尋查詢和使用條件的詳細資訊,請參閱內容搜尋的關鍵字查詢和搜尋條件For more information about creating a search query and using conditions, see Keyword queries and search conditions for Content Search.

  11. 設定查詢型保留後,請按 [下一步]After configuring a query-based hold, click Next.

  12. 請複查您的設定,然後按一下 [建立此保留]。Review your settings, and then click Create this hold.

查看保留統計資料View hold statistics

經過一段時間後,就會在選取之保留標籤的 [保留] 索引標籤上的詳細資料窗格中顯示新保留的相關資訊。After some time, information about the new hold is displayed in the details pane on the Holds tab for the selected hold. 此資訊包含保留的信箱和網站數量,以及有關保留之內容的統計資料,例如,保留的專案總數和大小,以及計算保留統計資料的最後時間。This information includes the number of mailboxes and sites on hold and statistics about the content that was placed on hold, such as the total number and size of items placed on hold and the last time the hold statistics were calculated. 這些保留統計資料可協助您找出與 eDiscovery 案例相關的內容數量。These hold statistics help you identify how much content that's related to the eDiscovery case is being held.

請記住保留統計資料的下列事項:Keep the following things in mind about hold statistics:

  • [保留中的專案總數] 表示來自保留之所有內容來源的專案數目。The total number of items on hold indicates the number of items from all content sources that are placed on hold. 如果您已建立以查詢為基礎的保留,則此統計資料會指出符合查詢的專案數。If you've created a query-based hold, this statistic indicates the number of items that match the query.

  • 保留專案數也包含在內容位置找到的未編制索引的專案。The number of items on hold also includes unindexed items found in the content locations. 請注意,如果您建立以查詢為基礎的保留,則內容位置中的所有未編制索引的專案都會處於暫止狀態。Note that if you create a query-based hold, all unindexed items in the content locations are placed on hold. 這包括未編制索引的專案,但不符合查詢型保留的搜尋準則,以及可能超出日期範圍條件的未編制索引項目目。This includes unindexed items that don't match the search criteria of a query-based hold and unindexed items that might fall outside of a date range condition. 這與執行內容搜尋時所發生的情形不同,在這種情況下,在搜尋結果中不會包含未符合搜尋查詢的非索引項目目,或由日期範圍條件排除。This is different than what happens when you run a Content Search, in which unindexed items that don't match the search query or are excluded by a date range condition aren't included in the search results. 如需有關未編制索引之專案的詳細資訊,請參閱在 Office 365 的內容搜尋中部分索引的專案For more information about unindexed items, see Partially indexed items in Content Search in Office 365.

  • 您可以按一下 [更新統計資料] 以重新執行搜尋評估,以計算目前保留的專案數,以取得最新的保留統計資料。You can get the latest hold statistics by clicking Update statistics to re-run a search estimate that calculates the current number of items on hold.

  • 如有需要,按一下工具列中的 [重新整理],以在詳細資料窗格中更新 [保留統計資料]。If necessary, click Refresh in the toolbar to update the hold statistics in the details pane.

  • 保留的專案數一般會隨著時間增加,因為信箱或網站處於保留狀態的使用者通常會傳送或接收新的電子郵件,並為商務檔建立新的 SharePoint 和 OneDrive。It's normal for the number of items on hold to increase over time because users whose mailbox or site is on hold are typically sending or receiving new email message and creating new SharePoint and OneDrive for Business documents.

  • 如果 SharePoint 網站或 OneDrive 帳戶移至多地理位置環境中的其他區域,該網站的統計資料將不會包含在 [保留統計資料] 中。If a SharePoint site or OneDrive account is moved to a different region in a multi-geo environment, the statistics for that site won't be included in the hold statistics. 不過,網站中的內容仍會保留。However, the content in the site will still be on hold. 此外,如果網站移至不同的區域,保留中所顯示的 URL 將不會更新。Also, if a site is moved to a different region the URL that's displayed in the hold will not be updated. 您必須編輯保留並更新 URL。You'll have to edit the hold and update the URL.

在 Microsoft 團隊和 Office 365 群組上進行保留Place a hold on Microsoft Teams and Office 365 Groups

Microsoft 團隊是以 Office 365 群組為基礎。Microsoft Teams are built on Office 365 Groups. 因此,在「高級 eDiscovery」中放置它們是非常類似的。Therefore, placing them on hold in Advanced eDiscovery is very similar.

  • 如何將其他 Microsoft 365 群組或 Microsoft 小組網站對應至保管人?如何在 Microsoft 365 群組和 Microsoft 團隊上放置非 Custodial 保留?How do I map an additional Microsoft 365 Groups or Microsoft Teams site to a custodian? And what about placing a non-Custodial hold on Microsoft 365 Groups and Microsoft Teams? Microsoft 團隊是以 Microsoft 365 群組為基礎。Microsoft Teams are built on Microsoft 365 Groups. 因此,將其保留在 eDiscovery 案例中非常類似。Therefore, placing them on hold in an eDiscovery case is very similar. 將 Microsoft 365 群組和 Microsoft 小組置於暫止狀態時,請記住下列事項。Keep the following things in mind when placing Microsoft 365 Groups and Microsoft Teams on hold.

    • 若要將 Microsoft 365 群組和 Microsoft 小組中的內容設為暫止狀態,您必須指定與群組或小組相關聯的信箱和 SharePoint 網站。To place content located in Microsoft 365 Groups and Microsoft Teams on hold, you have to specify the mailbox and SharePoint site that associated with a group or team.

    • 在 Exchange Online 中執行set-unifiedgroup 指令程式,以查看 Microsoft 365 群組或 microsoft 小組的屬性。Run the Get-UnifiedGroup cmdlet in Exchange Online to view properties for an Microsoft 365 Group or Microsoft Team. 若要取得與 Microsoft 365 群組或 Microsoft 小組相關聯之網站的 URL,這是一種很好的方式。This is a good way to get the URL for the site that's associated with an Microsoft 365 Group or a Microsoft Team. 例如,下列命令會顯示名為「資深領導團隊」的 Microsoft 365 群組的所選屬性:For example, the following command displays selected properties for an Microsoft 365 Group named Senior Leadership Team:

      Get-UnifiedGroup "Senior Leadership Team" | FL DisplayName,Alias,PrimarySmtpAddress,SharePointSiteUrl
      DisplayName            : Senior Leadership Team
      Alias                  : seniorleadershipteam
      PrimarySmtpAddress     : seniorleadershipteam@contoso.onmicrosoft.com
      SharePointSiteUrl      : https://contoso.sharepoint.com/sites/seniorleadershipteam
      

      注意

      若要執行 Get-UnifiedGroup Cmdlet,您必須獲指派 Exchange Online 中的「僅檢視收件者」角色或者為獲指派「僅檢視收件者」角色之角色群組的成員。To run the Get-UnifiedGroup cmdlet, you have to be assigned the View-Only Recipients role in Exchange Online or be a member of a role group that's assigned the View-Only Recipients role.

  • 搜尋使用者的信箱時,不會搜尋使用者所屬的任何 Microsoft 365 群組或 Microsoft 團隊。When a user's mailbox is searched, any Microsoft 365 Group or Microsoft Team that the user is a member of won't be searched. 同樣地,當您放置 Microsoft 365 群組或 Microsoft 小組時,只有群組信箱和群組網站處於保留狀態;除非您明確地將其新增為保管人或將其資料來源保留,否則不會保留群組成員之商務網站的信箱和 OneDrive。Similarly, when you place an Microsoft 365 Group or Microsoft Team hold, only the group mailbox and group site are placed on hold; the mailboxes and OneDrive for Business sites of group members aren't placed on hold unless you explicitly add them as custodians or place their data sources hold. 因此,如果您需要將 Microsoft 365 群組或 Microsoft 團隊保留給特定的保管人,請考慮將群組網站和群組信箱對應至保管人(請參閱在高級 eDiscovery 中管理保管人)。Therefore, if you the need to place an Microsoft 365 Group or Microsoft Team on hold for a specific custodian, consider mapping the group site and group mailbox to the custodian (See Managing Custodians in Advanced eDiscovery). 如果 Microsoft 365 群組或 Microsoft 團隊不是由單一管理員所歸屬,請考慮將來源新增至非 custodial 保留。If the Microsoft 365 Group or Microsoft Team is not attributable to a single custodian, consider adding the source to a non-custodial hold.

  • 若要取得 Microsoft 365 群組或 Microsoft 小組成員的清單,您可以在 Microsoft 365 系統管理中心的 [家庭 > 群組] 頁面上,查看其屬性。To get a list of the members of a Microsoft 365 Group or Microsoft Team, you can view the properties on the Home > Groups page in the Microsoft 365 admin center. 或者,您可以在 Exchange Online PowerShell 中執行下列命令:Alternatively, you can run the following command in Exchange Online PowerShell:

    Get-UnifiedGroupLinks <group or team name> -LinkType Members | FL DisplayName,PrimarySmtpAddress
    

    注意

    若要執行 Get-UnifiedGroupLinks Cmdlet,您必須獲指派 Exchange Online 中的「僅檢視收件者」角色或者為獲指派「僅檢視收件者」角色之角色群組的成員。To run the Get-UnifiedGroupLinks cmdlet, you have to be assigned the View-Only Recipients role in Exchange Online or be a member of a role group that's assigned the View-Only Recipients role.

  • 屬於 Microsoft 團隊通道一部分的通道交談儲存在與小組相關聯的信箱中。Channel conversations that are part of a Microsoft Teams channel are stored in the mailbox that's associated with the Team. 同樣地,團隊成員在頻道中共用的檔案會儲存在團隊的 SharePoint 網站上。Similarly, files that team members share in a channel are stored on the team's SharePoint site. 因此,您必須將 Microsoft 小組信箱和 SharePoint 網站置於保留狀態,以在通道中保留交談和檔案。Therefore, you have to place the Microsoft Team mailbox and SharePoint site on hold to retain conversations and files in a channel.

  • 或者,在 Microsoft 小組中屬於聊天清單一部分的交談,會儲存在使用者參與聊天的信箱中。Alternatively, conversations that are part of the Chat list in Microsoft Teams are stored in the mailbox of the user's who participate in the chat. 使用者在聊天交談中共用的檔案會儲存在共用該檔案之使用者的 OneDrive 商務網站中。Files that a user shares in Chat conversations are stored in the OneDrive for Business site of the user who shares the file. 因此,您必須將個別的使用者信箱和 OneDrive 用於商務網站保留,以便在聊天清單中保留交談和檔案。Therefore, you have to place the individual user mailboxes and OneDrive for Business sites on hold to retain conversations and files in the Chat list.

  • 每個 Microsoft 團隊或小組管道都包含一個 Wiki 進行記事與共同作業。Every Microsoft Team or team channel contains a Wiki for note-taking and collaboration. Wiki 的內容會自動儲存至 .mht 格式的檔案中。The Wiki content is automatically saved to a file with a .mht format. 此檔案會儲存在團隊 SharePoint 網站上的 Teams Wiki 資料文件庫中。This file is stored in the Teams Wiki Data document library on the team's SharePoint site. 您可以將內容放入 Wiki 的保留狀態,方法是將該小組的 SharePoint 網站保留。You can place the content in the Wiki on hold by placing the team's SharePoint site on hold.

    注意

    可保留 Microsoft 小組或小組管道的 Wiki 內容(當您放置小組的 SharePoint 網站時)已于2017年6月22日發行。The capability to retain Wiki content for a Microsoft Team or team channel (when you place the team's SharePoint site on hold) was released on June 22, 2017. 如果小組網站處於保留狀態,Wiki 內容將會從該日期開始保留。If a team site is on hold, the Wiki content will be retained starting on that date. 不過,如果小組網站處於保留狀態,且 Wiki 內容已在2017年6月22日之前刪除,則 Wiki 內容尚未保留。However, if a team site is on hold and the Wiki content was deleted before June 22, 2017, the Wiki content was not retained.