Welcome to Core eDiscovery! As I mentioned earlier, the Core eDiscovery offering in Microsoft 365 is a basic eDiscovery tool that is used to search and export content in both Microsoft 365 and Office 365. It’s used to place eDiscovery holds on content locations, like Exchange mailboxes, SharePoint sites, OneDrive accounts, and Microsoft Teams. 

The Core eDiscovery workflow that you see on your screen highlights the general flow of how things are done. The workflow kicks off when you create a case. Once the case is created, you create the eDiscovery hold. Although the creation of an eDiscovery hold is optional, what it does is preserve any content that you might be interested in as part of an investigation. 

An eDiscovery hold preserves all content in a specific location, or you can use a query-based hold that preserves only specific content that matches your query. For example, if you are investigating a leak of corporate secrets, you might only want to preserve all emails sent from a specific user inside the organization to a specific user outside the organization.

Once you’ve created the hold, you can search for the content you are interested in. You can search by using keywords, properties, and even certain conditions via search queries. These search queries then return data that's most likely relevant to your case.

Once you’ve found what you are searching for, you can then export and download your search results. The export process is actually a two-step process. First, you export the results of your search out of Office 365. To complete this step, you copy the results of your search to a Microsoft-provided Azure Storage location. Once the results are copied to your Azure storage location, you use the eDiscovery Export tool to download the content to your local computer, so you can review it.