Thursday, September 30, 2021

Become a Microsoft 365 Advanced eDiscovery NINJA

Become a Microsoft 365 Advanced eDiscovery NINJA


In this blog post, we share the top resources for eDiscovery users to become masters of the Advanced eDiscovery solution in Microsoft 365! After each level, we offer you a knowledge check based on the training material you have just completed. The goal of the knowledge checks is to help ensure understanding of the key concepts that were covered. 


The training sessions are split into eight different sections in order to better align with the Electronic Discovery Reference Model:

  • Overview
  • Getting Started
  • Identification
  • Preservation
  • Collection & Processing
  • Review & Analysis
  • Production
  • Advanced


*This training will be updated on a quarterly basis to ensure you all have the latest and greatest material! 


Advanced eDiscovery in Microsoft 365

The Advanced eDiscovery solution provides customers with the ability to identify, preserve, collect, process, analyze, review, and produce content that is responsive to your organization's internal and external investigations. Discovering and managing data is challenging. To help solve these challenges, we provide customers with tools that enable them to do more in-place eDiscovery in Microsoft 365, thereby reducing risks associated with either creating multiple copies or exporting content outside of your security and compliance boundaries. Using Advanced eDiscovery, you can reduce the content and only export matter relevant content.




Advanced eDiscovery


Exchange Online


OneDrive (formerly OneDrive for Business)


SharePoint (formerly SharePoint Online)


Microsoft 365


Electronically Stored Information, as defined in the Federal Rules of Civil Procedure, refers to any type of information that is created, used, and stored in digital form and accessible by digital means.


The amount of time an organization maintains information, taking into consideration its business, legal, regulatory, fiscal, and risk requirements. In M365, retention is managed using retention labels and policies.


The process by which organizations retain relevant information when litigation is pending or reasonably anticipated. In M365, this is managed through hold policies.

Data Sources

These are the locations (EXO, SPO, OneDrive) of data that will be targeted for tasks in the eDiscovery case.

Legal Holds (in-place holds)

The process by which organizations preserve potentially relevant information when litigation is pending or reasonably anticipated.


A workflow that is comprised of a search that is executed within an Advanced eDiscovery case. Collections include user, keyword, data, etc.

Review Sets

A static set of documents that have been through processing tasks including embedded item extraction, additional indexing, and OCR Within a Review Set, users can analyze, query, view, tag, and export data.



The Overview will familiarize you with AeD and showcases some typical use case scenarios.

  1. eDiscovery in M365 Introduction
    1. Course: Describe the eDiscovery capabilities of Microsoft 365 - Learn, 33 min, 9 Units
  2. Overview of Advanced eDiscovery
    1. Interactive Guide: Identify Legally Relevant information with Advanced eDiscovery in O365
    2. Youtube Video: Efficiently respond to regulatory, legal, and internal obligations with Advanced eDiscovery, 16 min
    3. Blog: Microsoft Compliance - Paint By Numbers Series (Part 5) - Advanced eDiscovery
  3. Advanced eDiscovery workflow
    1. Youtube Video: Learn how Advanced eDiscovery helps to support the modern ways users are collaborating, 15 min
    2. Course: Discover and analyze content in place using Advanced eDiscovery - Learn, 2hr 2 min, 10 Units
    3. Document: Advanced eDiscovery Architecture


Getting Started

Getting Started will focus on considerations and tasks for a successful deployment and setup of Advanced eDiscovery, including user permissions, global & case settings, compliance boundaries, and case creation & management.

  1. Permissions
    1. Document: Set up Advanced eDiscovery - Assign eDiscovery permissions
    2. Document: Add or remove members from a case
  2. Settings
    1. Document: Set up Advanced eDiscovery - Global Settings
    2. Document: Configure search and analytics settings
    3. Document: Manage jobs in Advanced eDiscovery
  3. Compliance Boundaries
    1. Document: Set up compliance boundaries for eDiscovery investigations
  4. Case Creation & Management
    1. Course: Manage Advanced eDiscovery - Learn, 34 min, 8 Units
    2. Document: Large cases in Advanced eDiscovery (Preview)
    3. Document: Close or delete a case

Ready for the Getting Started Knowledge Check?



Identification is used to identify potential sources of relevant information. Learning the location of potentially discoverable data is necessary to issue an effective legal hold or conduct a thorough investigation.

In the Identification section, learn how to identify and manage custodial and non-custodial data sources, how to use the custodian audit activity to identify additional relevant data sources, and recommended management of Teams and Yammer data in eDiscovery.

  1. Data Sources
    1. Document: Work with custodians in Advanced eDiscovery
    2. Document: Add non-custodial data sources to an Advanced eDiscovery case
    3. Document: Import custodians in bulk
  2. Teams and Yammer workflow
    1. Document: Teams workflow in Advanced eDiscovery
    2. Webinar: eDiscovery for Teams, 59 min
    3. Document: Overview of eDiscovery in Yammer
  3. View custodian audit activity
    1. Document: View custodian audit activity
    2. Document: Advanced Audit in Microsoft 365
    3. Course: Track user and admin activity with Advanced Audit - Learn | Microsoft Docs, 1hr 5 min, 10 modules
    4. Blog: Harnessing Advanced Audit to power your forensic investigations in 5 steps (
    5. Youtube Video: Microsoft 365 Advanced Auditing for forensic and compliance investigations

Ready for the Identification Knowledge Check?



Preservation is triggered upon reasonable anticipation of litigation, requiring legal teams to promptly isolate and protect potentially relevant data in ways that are: legally defensible, reasonable, proportionate, efficient, auditable, broad but tailored, and mitigate risks.

In the Preservation section, learn how to manage in-place legal holds and send legal hold notifications using Communications.

  1. Legal Holds
    1. Document: Manage holds in Advanced eDiscovery - Custodial Holds
    2. Document: Manage holds in Advanced eDiscovery - Non-Custodial Holds
    3. Document: How to identify the type of hold placed on an Exchange Online mailbox
    4. Document: View hold statistics
  2. Legal Hold Notifications
    1. Document: Work with Communications in Advanced eDiscovery

Ready for the Preservation Knowledge Check?


Collection & Processing

Collection is the acquisition of potentially relevant electronically stored information (ESI) as defined in the identification phase of the electronic discovery process.

Processing is a set of automated actions on ESI to allow for metadata preservation, itemization, normalization of format, and data reduction. Typically, processing will create a copy of data to a new location (such as an Azure blob) while preserving the original data.

In the Collection/Processing section, learn the benefits of advanced indexing, error remediation, how to target and collect relevant content and reduce data volumes.

  1. Collections
    1. Document: Create a draft collection
    2. Document: Commit a draft collection to a review set
    3. Document: Collection statistics and reports
    4. Document: Build search queries in Advanced eDiscovery
    5. Document: Keyword queries and search conditions for eDiscovery
  2. Advanced Indexing
    1. Document: Advanced indexing of custodian data
    2. Document: Work with processing errors in Advanced eDiscovery
    3. Document: Error remediation when processing data
    4. Document:Partially indexed items in Content Search and other eDiscovery tools
    5. Document: Supported file types in Advanced eDiscovery

Ready for the Collection & Processing Knowledge Check?


Analysis & Review

Analysis is often part of early case assessment will involve using analysis tools to develop a better understanding of the data in question through the detection of patterns, trends, and similarities.

Review is used to identify relevant data for production and gain a greater understanding of the factual issues in a case and where legal strategies can emerge and begin to develop based on the type of information that is found in the documents.

In the Analysis & Review section, learn how to manage review sets, search, view, and tag documents, and use analytics tools to power your review.

  1. Review Sets Administration
    1. Document: Manage review sets in Advanced eDiscovery
    2. Document: Analyze data in a review set in Advanced eDiscovery
    3. Document: Load non-Microsoft 365 data into a review set
    4. Document: Add data from one review set to another review set
  2. Review Sets (Search, Review, Tag)
    1. Document: View documents in a review set in Advanced eDiscovery
    2. Document: Query the content in a review set
    3. Document: Tag documents in a review set
    4. Document: Review conversations in Advanced eDiscovery
    5. Document: Teams workflow in Advanced eDiscovery

Ready for the Analysis & Review Knowledge Check?


Production (Export)

Production is the process of preparing ESI in an efficient and usable format to reduce cost, risk, and errors in a format that meets agreed production specifications and timelines.

In the Production section, learn how to export data for production, or additional processing and review.

  1. Exports
    1. Document: Export case data in Advanced eDiscovery
    2. Document: Export documents from a review set
    3. Document: Export documents to your organization's Azure Storage account
    4. Document: Large cases in Advanced eDiscovery (Preview)

Ready for the Production Knowledge Check?



In the Advanced section, leverage additional features to enhance the Advanced eDiscovery features.

  1. Graph API (beta)
    1. Youtube Video: Automate and extend Advanced eDiscovery workflows with Graph API - YouTube - YouTube, 18 min
    2. Document: Use the Microsoft Graph eDiscovery API - Microsoft Graph beta | Microsoft Docs
  2. Predictive Coding/Continuous Active Learning (preview)
    1. Document: Predictive coding in Advanced eDiscovery - Quick start
  3.  Licensing
    1. Document: Advanced eDiscovery Subscriptions and Licensing

Ready for the Advanced Knowledge Check?


Additional Resources

  1. M365 Roadmap: Roadmap of upcoming features and changes Microsoft 365 Roadmap | Microsoft 365
  2. Message Center: Notifications and details of updated changes to M365 Message center - Microsoft 365 admin | Microsoft Docs – all solutions in the service
  3. Tech Community – Security and Compliance: Blogs, community forums, and more Security, Compliance, and Identity - Microsoft Tech Community – blogs
  4. Additional Webinars: Register for new webinars and view past webinars for all M365 compliance tools, including Advanced eDiscovery: Webinars - Compliance Customer Experience Engineering (CxE) (
  5. Deployment Acceleration Guide: Advanced eDiscovery and Advanced Audit - Compliance Customer Experience Engineering (CxE) (


Huge thanks to @Heather_Eckman and the entire eDiscovery CxE team for creating the AeD Ninja page! 

Posted at