SharePoint Pals
 | Sign In
What you should know about eDiscovery in SharePoint Online
by Sriram Varadarajan 25 Jul 2016
Enterprise Architect
Today  :   1     Total  :    1817


  • eDiscovery: Process of identifying and delivering electronic information that can be used as an evidence
  • eDiscovery Center: New type of site collection that serves as a portal for managing eDiscovery cases
  • eDiscovery Cases: A collaboration site (sub site) that can be used to organize information related to eDiscovery requests (list items)
  • From this central location (eDiscovery Center) we can create cases to identify, hold, search and export content from SharePoint sites, Exchange mail boxes and searchable file shares
  • The hold ensures that a copy of the content is preserved, while still allowing users to work with their content (Preservation Hold Library)

Get Started

  • Microsoft recommends to create a security group that contains the legal team members
  • To discover Exchange mailboxes, authentication between Exchange and SharePoint needs to be configured (area that needs to be explored)
  • Grant legal users appropriate permissions for site collections (SCA) and exchange mail boxes that they must perform eDiscovery actions on.

Managing an eDiscovery case:

The two primary components of an eDiscovery case are
eDiscovery sets
  • To find and preserve content, create an eDiscovery set (SP List Item) and it contains the following,
    • Sources – Location to be searched (Exchange Mailbox, SPO or File Shares)
    • Filter – Search criteria (search terms, date range and authors name)
    • An option for In-Place hold
  • To find and export content, create an query (SP List Item) and it contains the following,
  • Sources – Location to be searched (Exchange Mailbox, SPO, eDiscovery sets or File Shares)
  • Filter – Search criteria, resembles a filter in an eDiscovery set, however in a query it can also use stemming
After running an query we can
  • See the statics about the items that were found
  • Preview the results
  • Filter the results by message type (Exchange) or by file type (SharePoint)
  • Export the results of query
  • The content that you export by using a query is formatted according to the Electronic Data Reference Model (EDRM) specification so that it can be imported into a review tool. An export can include the following:
    • Documents
    • Lists
    • Pages
    • Exchange objects
    • Crawl log errors

An XML manifest that provides an overview of the exported information

How eDiscovery works:

  • The Search Service Application is a key component of the search system in SPO
  • eDiscovery center can be associated with a SSA
  • Any content that’s indexed by the Search service application can be discovered from the eDiscovery Center
  • If SSA is configured to crawl file shares then eDiscovery center can discover content from file shares
  • If Exchange mail box is added as a result source to SSA, then Exchange mail boxes can be discovered from eDiscovery center and can be put on hold

In-Place Holds:

  • When an in-place hold is applied to a site (sub sites included), content in the site remains in its original location
  • Users can still work with the content, but a copy of the content as it was at the time that you initiated the hold is preserved
  • Any new content that’s created or added to the site after it was put on hold will be discoverable, and will be preserved if it’s deleted
  • By using in-place holds in SPO, users do not even have to know that their content is on hold
  • When a hold is placed on a SharePoint site, a preservation hold library is created, if one does not already exist
  • A user will receive an error if they try to delete a library, list, or site collection that’s on hold
  • The Information Management Retention timer job cleans up the preservation hold library


  • Once content sources or queries are added to an eDiscovery case, changing the regional settings for the site is not supported
  • Adding a large distribution group (of 100 names or larger) as a content source may time out or take a long time to process. Distribution groups of 1,500 or more users cannot be added. The workaround is to identify other ways to find the content involved with the distribution group’s mailbox, such as keywords or the author or sender of the item
  • In order for content to be discovered, it must be crawled by search

Lifecycle of an eDiscovery case:

  • Create the site to manage a case
  • Add sources
  • Place sources on hold
  • Create queries
  • Export case content
  • Close case

My Next article would talk about placing office 365 group in to Legal hold.

blog comments powered by Disqus

SharePoint Pals

SharePoint Pals, a community portal for SharePoint developers, Administrators and End Users. Let's join hands and share the point together.
Read this on mobile


Angular Js Training In Chennai
Advanced Angular Js training with real world developer scenarios
Angular Js, Web Api and Ionic for .Net Developers
All in one client side application development for .Net developers
Angular Js For SharePoint Developers
Get ready for the future. Its no more just C#

Get Connected

SharePoint Resources

SharePoint 2013 and 2010 Web Parts
Free Web Parts with Source Code for SharePoint Community

SharePoint 2013 Books and Tutorials
Collection of free SharePoint 2013 books and tutorials (eBooks, pdfs)

Supported By

Contribute your article and be eligible for a one month Free Subscription for Plural Sight. The Author of the most popular New Article (published in the previous month) will be awarded with a Free One month Plural Sight Subscription. Article can be sent to in a word document.

Related Resources

Recent Tweets

Twitter January 15, 00:25
How To Enable Target Value And Actual Value In #D3 Gauge Chart

Twitter January 15, 00:24
How To Open #SharePoint List Hyperlink Column In Modal #Popup Window

Twitter January 15, 00:24
Quick Introduction To #Asp.NetCore And It’s Features

Twitter January 15, 00:22
How To Configure #PerformancePoint Services To Use Secure Store In #SharePoint 2013

Twitter January 15, 00:21
How To Block Or Disable #Office365 Services

Follow us @SharePointPals
Note: For Customization and Configuration, CheckOutRecent Tweets Documentation