Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Case settings in eDiscovery let you view and update case information and take action on specific cases in eDiscovery.
The following information displays for the selected case:
- Premium features: Shows the status of premium eDiscovery features enabled in the case. To use premium eDiscovery features for the selected case, enable the eDiscovery (Premium) toggle.
- License: Shows the current licensing subscription for the case. Values are eDiscovery (Premium) or eDiscovery (Standard).
- ID: Shows the case identification number. You can review this number, but you can't change it once the case is created.
- Case name: Shows the case name. This field is required. To change the case name, enter the new case name and select Actions > Save.
- Case number: Shows an optional docket number or other numeric identifier for the case. To change the case number, enter the new case number and select Actions > Save.
- Case description: Shows an optional description to help others understand this case. To change the case description, enter the new case description and select Actions > Save.
- Case status: Shows the current case status.
- Case created: Shows the date and time when the case was created.
Tip
Get started with Microsoft Security Copilot to explore new ways to work smarter and faster using the power of AI. Learn more about Microsoft Security Copilot in Microsoft Purview.
Close a case
When you complete the legal case or investigation supported by eDiscovery, you can close the case. Here's what happens when you close an eDiscovery case:
- If the case contains any content locations on hold, these holds are turned off. After the hold is turned off, a 30-day grace period (called a delay hold) is applied to content locations that were on hold. This delay hold helps prevent content from being immediately deleted and gives admins an opportunity to search for or recover content that is permanently deleted after the delay hold period expires.
- Closing a case only turns off the holds that are associated with that case. If other holds are place on a content ___location (such as a Litigation Hold, eDiscovery hold, or a hold from a different eDiscovery case) those holds are still maintained.
- The case is still listed on the Cases page in the Microsoft Purview portal. The details, holds, searches, and members of a closed case are retained.
- You can edit a closed case. For example, you can add or remove members, create searches, export search results, and prepare search results for analysis in eDiscovery. The primary difference between active and closed cases is that holds are turned off when a case is closed.
To close a case, complete the following steps:
- Go to the Microsoft Purview portal and sign in using the credentials for a user account assigned eDiscovery permissions.
- Select the eDiscovery solution card and then select Cases.
- Select a case, then select Case settings.
- On Case settings, select Actions, then select Close case. It might take up to 60 minutes for the closing process to complete.
When closing a case, you see the status of the case changing as the case is processed for closing.
Reopen a closed case
When you reopen an eDiscovery case, any holds that were in place when the case was closed aren't automatically reinstated. After the case is reopened, you need to go to the Holds tab and turn on the previous holds. To turn on a hold, select it to display the flyout page, then set the Status toggle to On.
To reopen a closed case, complete the following steps:
- Go to the Microsoft Purview portal and sign in using the credentials for a user account assigned eDiscovery permissions.
- Select the eDiscovery solution card and then select Cases (preview) in the left nav.
- Select a case, then select Case settings.
- On Case settings, select Actions, then select Reopen case. It might take up to 60 minutes for the reopening process to complete.
Delete a case
You can delete both active and closed eDiscovery cases. When you delete a case, you also delete all components associated with the case, such as the list of communications, searches, review sets, and exports. You can't recover or reopen a deleted case.
Note
In data spillage scenarios, the only way to remove items in a review set is to delete the eDiscovery case. Other "search and purge" methods don't remove items from a review set.
Before you can delete a case, you must first delete all hold policies listed on the Hold policies tab of the case. That requirement includes deleting holds with a status of Off. You can delete default hold policies only when the hold is turned off. You must close an active case to turn off any default hold policies in the case. Once you turn off the holds for default hold policies, you can delete them.
To delete hold policies associated with a case, complete the following steps:
- Go the Hold policies tab in the eDiscovery case that you want to delete.
- Select the hold policy that you want to delete.
- On the hold policy page, select Policy actions > Delete policy.
To delete a case, complete the following steps:
- Go to the Microsoft Purview portal and sign in using the credentials for a user account assigned eDiscovery permissions.
- Select the eDiscovery solution card and then select Cases (preview) in the left nav.
- Select a case, then select Case settings.
- On the Case settings page, select Actions, then select Delete case.