Managing Search & Investigation
This course explores how to implement and manage auditing and eDiscovery in Microsoft 365. We'll start by covering Content Search and other search and investigation tools that are used to perform content searches, and how to export content search results.
You'll also learn about auditing management, before moving on to Core eDiscovery and how to search content using the Security & Compliance Admin Center. You’ll also learn how to configure Core eDiscovery and how to create cases. Finally, we'll cover Advanced eDiscovery, and you’ll learn what Advanced eDiscovery is, how to set it up, and how to create and manage Advanced eDiscovery cases.
- Learn about Content Search and other search and investigation tools that are used to perform content searches
- Export Content Search results
- Learn how to configure audit log retention and audit policy
- Learn what Core eDiscovery is and how to search content using the Security & Compliance Admin Center
- Configure Core eDiscovery and how to create cases
- Get an overview of Advanced eDiscovery and learn how to create and manage Advanced eDiscovery cases
This course is intended for those who wish to learn how to use and manage auditing and eDiscovery in Microsoft 365.
To get the most out of this course, you should already have some basic experience of working with Microsoft 365.
Welcome back! So now that you have an idea of what has to happen BEFORE you create a Core eDiscovery case, let’s quickly walk through the steps for creating a case. I’m not going to do a full demo here, because the process of creating a case is pretty straightforward. I really don’t think a full demo is necessary, so…
To create a Core eDiscovery case, you need to browse to the Microsoft 365 Compliance pane. This can be found at https://compliance.microsoft.com. You’ll need to sign with a user account that’s been assigned the appropriate eDiscovery permissions. We talked about these permissions earlier.
Clicking “Show All” in the left navigation pane of the Microsoft 365 compliance center reveals the eDiscovery dropdown.
Click the “Core” option, under eDiscovery, to open the Core eDiscovery page.
The Core eDiscovery page shows all existing Core eDiscovery cases, and allows you to create a new case. To create a new case, click +Create a Case. On the New case flyout page, provide a name for your new case, an optional case number, and an optional description. The case name that you supply needs to be unique within your organization.
You can then click Save, to create your case.
Once you’ve created your case, it’s displayed on the Core eDiscovery page. You can manage your case by clicking on it to reveal the management blade.
You’d use the management blade to manage members, role groups, and the status. Later on, we’ll walk through an actual demo of how to create an Advanced eDiscovery case, since an advanced case involves a bit more stuff.
Tom is a 25+ year veteran of the IT industry, having worked in environments as large as 40k seats and as small as 50 seats. Throughout the course of a long an interesting career, he has built an in-depth skillset that spans numerous IT disciplines. Tom has designed and architected small, large, and global IT solutions.
In addition to the Cloud Platform and Infrastructure MCSE certification, Tom also carries several other Microsoft certifications. His ability to see things from a strategic perspective allows Tom to architect solutions that closely align with business needs.
In his spare time, Tom enjoys camping, fishing, and playing poker.