Become a Microsoft 365 Advanced eDiscovery NINJA

In this blog post, we share the top resources for eDiscovery users to become masters of the Advanced eDiscovery solution in Microsoft 365! After each level, we offer you a knowledge check based on the training material you have just completed. The goal of the knowledge checks is to help ensure understanding of the key concepts that were covered.

The training sessions are split into eight different sections in order to better align with the Electronic Discovery Reference Model:

Overview
Getting Started
Identification
Preservation
Collection & Processing
Review & Analysis
Production
Advanced

*This training will be updated on a quarterly basis to ensure you all have the latest and greatest material!

Advanced eDiscovery in Microsoft 365

The Advanced eDiscovery solution provides customers with the ability to identify, preserve, collect, process, analyze, review, and produce content that is responsive to your organization's internal and external investigations. Discovering and managing data is challenging. To help solve these challenges, we provide customers with tools that enable them to do more in-place eDiscovery in Microsoft 365, thereby reducing risks associated with either creating multiple copies or exporting content outside of your security and compliance boundaries. Using Advanced eDiscovery, you can reduce the content and only export matter relevant content.

Glossary/Abbreviations

AeD	Advanced eDiscovery
EXO	Exchange Online
ODB/OD4B	OneDrive (formerly OneDrive for Business)
SPO	SharePoint (formerly SharePoint Online)
M365	Microsoft 365
ESI	Electronically Stored Information, as defined in the Federal Rules of Civil Procedure, refers to any type of information that is created, used, and stored in digital form and accessible by digital means.
Retention	The amount of time an organization maintains information, taking into consideration its business, legal, regulatory, fiscal, and risk requirements. In M365, retention is managed using retention labels and policies.
Preservation	The process by which organizations retain relevant information when litigation is pending or reasonably anticipated. In M365, this is managed through hold policies.
Data Sources	These are the locations (EXO, SPO, OneDrive) of data that will be targeted for tasks in the eDiscovery case.
Legal Holds (in-place holds)	The process by which organizations preserve potentially relevant information when litigation is pending or reasonably anticipated.
Collections	A workflow that is comprised of a search that is executed within an Advanced eDiscovery case. Collections include user, keyword, data, etc.
Review Sets	A static set of documents that have been through processing tasks including embedded item extraction, additional indexing, and OCR Within a Review Set, users can analyze, query, view, tag, and export data.

Overview

The Overview will familiarize you with AeD and showcases some typical use case scenarios.

eDiscovery in M365 Introduction
1. Course: Describe the eDiscovery capabilities of Microsoft 365 - Learn, 33 min, 9 Units
Overview of Advanced eDiscovery
1. Interactive Guide: Identify Legally Relevant information with Advanced eDiscovery in O365
2. Youtube Video: Efficiently respond to regulatory, legal, and internal obligations with Advanced eDiscovery, 16 min
3. Blog: Microsoft Compliance - Paint By Numbers Series (Part 5) - Advanced eDiscovery
Advanced eDiscovery workflow
1. Youtube Video: Learn how Advanced eDiscovery helps to support the modern ways users are collaborating, 15 min
2. Course: Discover and analyze content in place using Advanced eDiscovery - Learn, 2hr 2 min, 10 Units
3. Document: Advanced eDiscovery Architecture

Getting Started

Getting Started will focus on considerations and tasks for a successful deployment and setup of Advanced eDiscovery, including user permissions, global & case settings, compliance boundaries, and case creation & management.

Permissions
1. Document: Set up Advanced eDiscovery - Assign eDiscovery permissions
2. Document: Add or remove members from a case
Settings
1. Document: Set up Advanced eDiscovery - Global Settings
2. Document: Configure search and analytics settings
3. Document: Manage jobs in Advanced eDiscovery
Compliance Boundaries
1. Document: Set up compliance boundaries for eDiscovery investigations
Case Creation & Management
1. Course: Manage Advanced eDiscovery - Learn, 34 min, 8 Units
2. Document: Large cases in Advanced eDiscovery (Preview)
3. Document: Close or delete a case

Ready for the Getting Started Knowledge Check?

Identification

Identification is used to identify potential sources of relevant information. Learning the location of potentially discoverable data is necessary to issue an effective legal hold or conduct a thorough investigation.

In the Identification section, learn how to identify and manage custodial and non-custodial data sources, how to use the custodian audit activity to identify additional relevant data sources, and recommended management of Teams and Yammer data in eDiscovery.

Data Sources
1. Document: Work with custodians in Advanced eDiscovery
2. Document: Add non-custodial data sources to an Advanced eDiscovery case
3. Document: Import custodians in bulk
Teams and Yammer workflow
1. Document: Teams workflow in Advanced eDiscovery
2. Webinar: eDiscovery for Teams, 59 min
3. Document: Overview of eDiscovery in Yammer
View custodian audit activity
1. Document: View custodian audit activity
2. Document: Advanced Audit in Microsoft 365
3. Course: Track user and admin activity with Advanced Audit - Learn | Microsoft Docs, 1hr 5 min, 10 modules
4. Blog: Harnessing Advanced Audit to power your forensic investigations in 5 steps (microsoft.com)
5. Youtube Video: Microsoft 365 Advanced Auditing for forensic and compliance investigations

Ready for the Identification Knowledge Check?

Preservation

Preservation is triggered upon reasonable anticipation of litigation, requiring legal teams to promptly isolate and protect potentially relevant data in ways that are: legally defensible, reasonable, proportionate, efficient, auditable, broad but tailored, and mitigate risks.

In the Preservation section, learn how to manage in-place legal holds and send legal hold notifications using Communications.

Legal Holds
1. Document: Manage holds in Advanced eDiscovery - Custodial Holds
2. Document: Manage holds in Advanced eDiscovery - Non-Custodial Holds
3. Document: How to identify the type of hold placed on an Exchange Online mailbox
4. Document: View hold statistics
Legal Hold Notifications
1. Document: Work with Communications in Advanced eDiscovery

Ready for the Preservation Knowledge Check?

Collection & Processing

Collection is the acquisition of potentially relevant electronically stored information (ESI) as defined in the identification phase of the electronic discovery process.

Processing is a set of automated actions on ESI to allow for metadata preservation, itemization, normalization of format, and data reduction. Typically, processing will create a copy of data to a new location (such as an Azure blob) while preserving the original data.

In the Collection/Processing section, learn the benefits of advanced indexing, error remediation, how to target and collect relevant content and reduce data volumes.

Collections
1. Document: Create a draft collection
2. Document: Commit a draft collection to a review set
3. Document: Collection statistics and reports
4. Document: Build search queries in Advanced eDiscovery
5. Document: Keyword queries and search conditions for eDiscovery
Advanced Indexing
1. Document: Advanced indexing of custodian data
2. Document: Work with processing errors in Advanced eDiscovery
3. Document: Error remediation when processing data
4. Document:Partially indexed items in Content Search and other eDiscovery tools
5. Document: Supported file types in Advanced eDiscovery

Ready for the Collection & Processing Knowledge Check?

Analysis & Review

Analysis is often part of early case assessment will involve using analysis tools to develop a better understanding of the data in question through the detection of patterns, trends, and similarities.

Review is used to identify relevant data for production and gain a greater understanding of the factual issues in a case and where legal strategies can emerge and begin to develop based on the type of information that is found in the documents.

In the Analysis & Review section, learn how to manage review sets, search, view, and tag documents, and use analytics tools to power your review.

Review Sets Administration
1. Document: Manage review sets in Advanced eDiscovery
2. Document: Analyze data in a review set in Advanced eDiscovery
3. Document: Load non-Microsoft 365 data into a review set
4. Document: Add data from one review set to another review set
Review Sets (Search, Review, Tag)
1. Document: View documents in a review set in Advanced eDiscovery
2. Document: Query the content in a review set
3. Document: Tag documents in a review set
4. Document: Review conversations in Advanced eDiscovery
5. Document: Teams workflow in Advanced eDiscovery

Ready for the Analysis & Review Knowledge Check?

Production (Export)

Production is the process of preparing ESI in an efficient and usable format to reduce cost, risk, and errors in a format that meets agreed production specifications and timelines.

In the Production section, learn how to export data for production, or additional processing and review.