The case is the container
Everything in eDiscovery hangs off a case — a scoped workspace with its own members (so an investigation is visible only to its team), holds, searches and exports. Cases keep matters isolated and auditable; the eDiscovery Manager role is case-scoped for exactly this reason (see the RBAC concept).
Standard vs premium
| Capability | Standard | Premium |
|---|---|---|
| Legal holds (case-scoped preservation) | Yes | Yes |
| Content search across workloads | Yes | Yes |
| Export | Yes | Yes |
| Custodian management (people-centric, with hold notifications) | — | Yes |
| Review sets (collect into a working set, tag, redact, cull) | — | Yes |
| Analytics (near-duplicate detection, email threading, themes) | — | Yes |
| Advanced collections & data sources (incl. non-custodial) | — | Yes |
Standard is "search-and-hold"; premium is a defensible end-to-end workflow with a review surface. Premium is E5-class licensing (see the licensing concept).
Legal hold vs retention (the interaction that surprises)
A legal hold preserves a custodian's content for a matter, indefinitely, until released — and it follows the same "retention wins" principle: held content cannot be deleted by the user, by a deletion policy, or by end-of-retention, even though the user sees it as deleted. The preserved copy lives in the same workload stores (Recoverable Items, Preservation Hold library — see the per- workload concept) and is fully discoverable. The corresponding failure mode is a hold released prematurely: once released, ordinary retention/deletion resumes and evidence can age out — release is a decision with legal weight, not cleanup.
Custodian mapping — the discipline
A custodian is a person, but their data is scattered across mailbox, OneDrive, the Teams chats they're in, the SharePoint sites they use, and group mailboxes. The core discipline is mapping each custodian to all their data locations — premium's custodian management automates much of it, but the gaps (a departed employee's inactive mailbox, a shared site, a Teams channel) are where matters get challenged. Under-collection is a legal risk; over-collection is a cost and privacy risk.
What to watch (proofs)
- Case and hold inventory:
Get-ComplianceCasefor open cases;Get-CaseHoldPolicyandGet-CaseHoldRulefor what each hold preserves and where — the preservation map per matter. - Custodian coverage: for each custodian, confirm mailbox + OneDrive + Teams + relevant sites are on hold — the under-collection audit.
- Hold-beats-deletion proof: a held item the user "deleted" still returned inside the case search — preservation working against user action.
- Release discipline: hold creation/release events in
Search-UnifiedAuditLog— no premature releases, and every release traceable to a decision.