Microsoft Purview eDiscovery Short Course

Course Guarantee

Be equipped with the skills and knowledge to effectively conduct thorough investigations, manage legal holds, and optimize search capabilities within your Microsoft 365 environment.

What you will achieve after going on the course

Conduct Thorough Investigations: You will be able to carry out detailed investigations across Microsoft 365 data for various purposes such as Information Requests, Data Subject Access Requests (DSARs), and Freedom of Information (FOI) requests. This includes using eDiscovery (Premium) to preserve, collect, analyse, review, and export content efficiently.
Manage Legal Holds and Case Reports: You will gain the skills to send hold notifications, manage case reports, and export case results. This ensures that all relevant data is preserved and managed properly during legal proceedings.
Optimize Search Capabilities: You will learn to use advanced search tools within Microsoft 365, such as Content Search and eDiscovery (Standard and Premium), to find information stored across SharePoint, Teams, Exchange, and Viva Engage. This enhances the ability to locate and retrieve important data quickly and accurately.

More about this course

Course Dates & Prices

Is this course right for me?

The problems that customers are facing

Problem 1

Problem: Organizations often struggle to identify and address potential risks and vulnerabilities within their Microsoft 365 environment. This can lead to undetected security threats and compliance issues.

Solution: Implementing comprehensive audits within the Microsoft 365 environment can help organizations identify and address potential risks and vulnerabilities. This involves using tools like Microsoft Defender for Cloud Apps to uncover shadow IT, assess risks, enforce policies, investigate activities, and stop threats. By conducting regular audits, organizations can ensure that their security measures are up-to-date and effective, thereby reducing the risk of undetected security threats and compliance issues.

Problem 2

Problem: Inefficient management of legal holds and case reports can result in data loss and non-compliance with legal requirements. Organizations may find it challenging to preserve and manage relevant data during legal proceedings.

Solution: Efficiently managing legal holds and case reports involves using Advanced eDiscovery tools to preserve, collect, review, analyse, and export content that is responsive to internal and external investigations. This includes managing the entire legal hold notification workflow to communicate with custodians involved in a case, ensuring that all relevant data is preserved and managed properly during legal proceedings. By improving the management of legal holds and case reports, organizations can ensure compliance with legal requirements and reduce the risk of data loss.

Problem 3

Problem: Inefficient search capabilities can make it difficult for organizations to locate and retrieve important information quickly. This can lead to delays in decision-making and hinder the ability to respond to legal and compliance requests promptly.

Solution: Optimizing search capabilities involves using advanced search tools within Microsoft 365, such as Content Search and eDiscovery (Standard and Premium), to find information stored across SharePoint, Teams, Exchange, and Viva Engage. These tools enable organizations to locate and retrieve important data quickly and accurately, enhancing their ability to respond to legal and compliance requests promptly. By improving search capabilities, organizations can reduce delays in decision-making and ensure that critical information is readily accessible.

Book now

Choose your course type

Virtual, Instructor-Led Course

Led by a live instructor, learn virtually (via Microsoft Teams) alongside a small group of other students. Find and book a scheduled course date below.

Duration

2 days (3 hours each day)

Certification

Certificate of Completion

Book Now

Online eLearning Course

Learn online in your own time, and at your own pace via our eLearning platform.

Please Note

This course is not currently offered in an eLearning format. Please register your interest if you are interested in eLearning for this course.

Private & Tailored In-House Training

Need to educate a full team or group of people? Looking for something more bespoke? Want your training to be delivered on-site or face-to-face?

Contact us now via the Live Chat in the bottom right hand corner of your screen, or leave us a message here and we’ll get back to you.

Virtual, Instructor-Led Course

Find dates & book now

Want to talk with someone?

Contact us now via the Live Chat in the bottom right hand corner of your screen, or leave us a message here and we’ll get back to you.

About this course

Overview

This instructor led course will teach you how-to use Microsoft Purview eDiscovery tools in detail.

Learn how to carry out investigations across Microsoft 365 data for Information Requests, DSARS, FOI requests and other purposes.

Microsoft 365 includes 4 different search tools:

Content Search
eDiscovery (Standard)
eDiscovery (premium)

All of which can be used to find information stored across SharePoint, Teams, Exchange and Viva Engage.

This short course will teach you how to use these tools with special focus on use cases to support your investigation requirements.

eDiscovery (Premium) provides an end-to-end workflow to preserve, collect, analyse, review, and export content in response to your organisation's internal and external investigations. It also includes features to manage the entire legal hold notification workflow, to communicate with custodians involved in a case.

By collecting data from the source with the eDiscovery tools, you can search the live Microsoft 365 platform to quickly find what you need. Intelligent, machine learning capabilities such as deep indexing, email threading, and near duplicate detection also help you reduce large volumes of data to a relevant data set.

This short course covers the entire process end-to-end including:

Search setup
Results refinement
Content hold
Export and communication.

Agenda

Welcome, Introductions & Context

Why organisations need eDiscovery 
Legislative drivers (privacy, Public Records Act NZ, GDPR, FOIA, litigation support) 
Difference between eDiscovery Standard vs Premium 
End-to-end workflow at a glance 
Activity: Participants share a current organisational challenge (investigation, complaint, information request, audit).

M365 Data Storage & Architecture – The Foundation

How Microsoft 365 stores information across: 
SharePoint Online 
OneDrive 
Exchange 
Teams (chat + channel) 
Viva Engage, Groups, Planner, Loop 
The M365 Search Index & how it matters to eDiscovery 
File versions & metadata 
Retention, deletion, labels & legal holds 
What can and cannot be discovered 
Mini-Exercise: 
- Identify where a document, chat file, and email would physically live in M365 
- Discuss how retention + deletion affects discoverability

Navigating Microsoft Purview & Setting Up eDiscovery Premium

Access requirements (roles, permissions, eDiscovery Administrator vs Manager) 
Navigating Purview 
Overview of eDiscovery Case features 
Hands-On Exercise 1: 
- Access Purview 
- Open eDiscovery Premium 
- Create a new Case and name it

Creating a Case & Adding Members

Why cases exist 
Role-based access 
Case status and lifecycle 
Auditing case activity 
Hands-On Exercise 2: 
- Create a case 
- Add participants to the role group 
- Review auditing dashboard

Identifying Custodians & Data Sources

Custodian vs non-custodian data 
Adding mailboxes, OneDrives, SharePoint sites, Teams & Groups 
Collecting chat data & channel messages 
Auto mapping of PST files 
Hands-On Exercise 3: 
- Add 2–3 custodians to a case
- Include a Team and a SharePoint site
- Explore Custodian dashboard (status, errors, indexing, etc.)

Legal Hold

When and why holds are applied 
What content a hold actually blocks 
Notification workflows & tracking acknowledgements 
Custodian communications & reminders 
Release of hold + auditing 
Hands-On Exercise 4: 
- Create a legal hold 
- Apply to custodians or sites 
- Test scenario: release a hold & verify content behaviour

Searches & Collections

Search parameters (KQL, keywords, date ranges, inbox only vs all folders) 
Refiners & search analytics 
Estimating volume 
Adding results to a Review set 
Hands-On Exercise 5: 
- Build a search: email + Teams messages + SharePoint files 
- Use operators (AND/OR/NEAR) 
- Add search results to a review set

Review Sets & Analytics

Ingesting collected data 
Deduplication, near-duplicates, email threading 
Themes, sentiment analysis, key people 
Tagging & annotation 
Redactions & custom export sets 
Hands-On Exercise 6: 
- Open a Review Set 
- Tag items as relevant/not relevant 
- Use analytics tools to identify themes or key email participants 
- Add redactions to a PDF or email

Exporting Content

Export vs producing a review package 
PST, native files, PDF options 
Preparing a defensible legal package 
Audit logs & chain-of-custody 
Downloading the export from Azure Storage
Hands-On Exercise 7: 
- Create an export set
- Select content to produce 
- Download/export report

Closing Scenario Challenge (Capstone Activity)

Participants receive a simulated incident: 
HR bullying complaint, OR 
Data breach investigation, OR 
Public records / information request, OR 
Audit request from regulator 
Final Activity: Teams must: 
- Create a case 
- Add custodians 
- Apply hold 
- Build a search 
- Move to review set 
- Tag & export relevant content
Instructor scores based on: 
- Correct setup 
- Clear search logic 
- Use of review & tags 
- Quality of final export reasoning

Learning Objectives

To give an overview of the Microsoft Purview eDiscovery solutions for eDiscovery managers, investigators and legal professionals.
To look at the comparison of key capabilities within eDiscovery solutions.
To gain an understanding of the eDiscovery Premium functionality of Microsoft Purview.
Considerations when investigating cases from a compliance perspective.
To gain hands-on experience with eDiscovery Premium features.
Thinking about how eDiscovery investigations can be undertaken.

Benefits

Learn how to use Microsoft Purview eDiscovery tools in depth.
Learn how to carry out investigations across Microsoft 365 data.
Understand the impacts of Microsoft Purview eDiscovery for information managers.
Learn from scenarios and use cases.
Follow along with the practical exercises and test out different scenarios by using our virtual training environment (powered by Microsoft Sandbox).
Instructor-led training for thorough understanding.
PowerPoint slides are shared after the course.

Is this course right for me?

This course is for people with existing knowledge of investigation requirements, who want to learn how to use the search features in the Microsoft Purview Compliance Portal in order to carry out investigations.

Note: To carry out the investigations in your own organization you will need the eDiscovery Manager role in Microsoft 365.