Create and manage cases in eDiscovery (preview)

Makale
01/02/2025

After setting up Microsoft Purview eDiscovery (preview) and assigning permissions to eDiscovery managers in your organization that will manage cases, the next step is to create and manage a case for escalation activities or investigation requests.

Tip

Get started with Microsoft Security Copilot to explore new ways to work smarter and faster using the power of AI. Learn more about Microsoft Security Copilot in Microsoft Purview.

Cases dashboard

All eDiscovery cases in your organization are displayed on the Cases dashboard in the Microsoft Purview portal. The Cases dashboard allows you to quickly see the cases in your organization, the status of the case, and important information associated with each case.

Name: The name of the case. The case name must be unique in your organization.
Case status: The current status of the case.
Case type: The type of case.
Created on: The date and time in Coordinated Universal Time (UTC) when the case was created.
Last modified: The date and time in Coordinated Universal Time (UTC) when the case was last modified.
Last modified by: The name of the user that last modified the case.
Number: The optional docket number or other custom numeric identifier for the case.
Description: The description of the case entered when the case was created.

You can customize the displayed columns and the order of the columns in the Cases dashboard by selecting Customize columns. Choose the columns to display or drag and drop columns to reorder.

Filtering cases

To filter cases on the Cases dashboard, enter a keyword to filter by case names that contain the keyword or select Filter on the command bar. Select one or more of the following filters and select Apply to help you organize cases for review on the dashboard.

Case status options:

Active: The case is active.
Pending delete: The case likely has a hold in the pending deletion state. Check the hold policy and redistribute to resolve the error. Afterwards, cases without any holds should be deleted successfully.
Closing: The case is being closed. This status is seen only for case with active holds. Cases without holds are immediately closed.
Closed: The case is closed without errors and the case can be reopened.
Closed with errors: The case is closed, but there are errors. Errors are most likely associated with holds that weren't released during closing. To resolve, check policies with errors, resolve the errors, and redistribute the policies.

Case type options:

Premium: eDiscovery (Premium) cases.
Standard: eDiscovery (Standard) cases.
User data search: Legacy user data search cases.
Content search: Content searches from Microsoft Purview compliance portal.

Important

Case type is used only to map cases to the Microsoft Purview compliance portal during the preview of eDiscovery in the Microsoft Purview portal. This helps you to find cases in the compliance portal (if needed). All cases created in the Microsoft Purview portal are the Premium type, regardless of your license or subscription. Access to premium features isn't governed by the case settings toggle.

To clear Case dashboard filters, select Filter > Clear filters > Apply.

Grouping cases

To group cases on the Cases dashboard, select Group on the command bar. Select of the following groupings to help you organize cases for review on the dashboard.

None: Clears grouping for cases.
Status: Groups cases by the status of the case.
Last modified by: Groups cases by the user that last modified the case.
Case type: Groups cases by the case type.

Download a list of cases

To download a list of all cases displayed in the Cases dashboard, select Download list. A .csv file is generated that contains the case name and all of the Cases dashboard column properties for each case.

Create a case

Tip

Do you prefer an interactive configuration guide experience? Check out the Create and configure a case guide.

Complete the following steps to create a case and configure case settings. The user who creates the case is automatically added as a member. Members of the case can access the case in the Microsoft Purview portal and perform eDiscovery tasks.

Go to the Microsoft Purview portal and sign in using the credentials for a user account assigned eDiscovery permissions. Members of the Organization Management role group can also create eDiscovery cases.
Select the eDiscovery solution card and then select Cases (preview) in the left nav.
Select Create case.
On the Enter details to get started page, complete the following fields:
- Case name: give the case a name (required). The case name must be unique in your organization.
- Case description: Add an optional description to help others understand this case.
Select Create to create the new case and start your investigation.

Summarize a case with Copilot (preview)

Summarizing cases with Copilot enables you to quickly access a comprehensive summary of eDiscovery cases. Copilot consolidates case information into a single, easy-to-understand summary. Copilot analyzes content within the case and generates natural language summaries, giving you a clear, actionable overview of key details in real-time. It eliminates the need to navigate through multiple case tabs by consolidating status updates, completed actions, pending tasks, and ongoing jobs into a single, easy-to-read summary. To use Copilot to summarize a case, Security Copilot must be enabled and the user must be assigned the eDiscovery Administrator or eDiscovery Manager role.

Whenever you view a case, Copilot automatically reviews the case and displays summary information in the Copilot pane. You can also select Summarize this case to run Copilot and display or refresh this summary and pane. When Copilot completes the summary, it displays details about the case in the following areas:

Case information: A high level summary information about the case, including information about the case type, when the case was created, when the case was modified, who the last user was that modified the case, and more.
Data sources: A summary of data sources associated with the case.
Exports: A summary of search and review set exports associated with the case, including details about export items, file sizes, and item counts.
Holds: A summary of hold policies associated with the case, including hold policy, query, and location details.
Jobs: A summary of all the processes associated with the case.
Review sets: A summary of the review sets associated with the case, when they were created, modified, and who edited.
Searches: A summary of searches associated with the case, including query conditions, sources, options, and settings.
Settings: A summary of the case settings, such as OCR, near-duplicate detection, search, document processing, and review set settings.

If the case doesn't have activity for an area, the Copilot summary indicates that the area doesn't have any activities to summarize. For example, if the case doesn't have associated exports, the Copilot summary in Exports section confirms that the case doesn't have any exports.

You can also enter customized prompts directly in Copilot to further refine and narrow the scope to specific areas about the case.

To change the data source for the Copilot summary, select Microsoft Learn documentation at the end of the summary. This scopes the Copilot summary to support guidance that can help you learn more about working with cases and can provide step by step guidance or details about eDiscovery (preview) features and capabilities.

Mark a case as a favorite

You can mark an eDiscovery case as a favorite for quicker access to cases you want to prioritize. Cases marked as favorites can be accessed quickly via the Cases dashboard. You can mark a case as a favorite on the Cases dashboard by selecting the star icon to the left of a case in the case list.

Manage case settings

Case settings include case information, case license level control, access permissions, and settings that control search and analytics behavior for the case. You can access settings for a specific case by selecting Case settings after selecting a case. You can define specific parameters for feature capabilities based on eDiscovery licenses in your organization, which users, role groups, and guests have access and permissions for the case, and which additional locations are included during organization-wide searches for the case.

For more information about case settings, see:

Manage case status

You can also close or delete cases by selecting Actions for an individual case and choosing Close case or Delete case. If you close or delete a case, all holds are turned off. Any content that was on hold is released, which might result in data loss.

For more information about managing case actions, see:

Aracılığıyla paylaş