The Core eDiscovery workflow

In the first section of this chapter, you learned about insider risk management and the workflow of an insider risk case. Similar to an insider risk case, where we want to triage and investigate activity that may create a legal issue for your company, eDiscovery is used to gather evidence that will possibly be used in a legal case against a user or users within your company. When an eDiscovery case is created, the activity of that user across Microsoft 365 services is suspended and documented so that it can be held for legal investigations. Note that when an eDiscovery case is created, the documents have a 24-hour delay in terms of being legally held. Therefore, you should not make the user or users aware that they are under any type of investigation to avoid loss of evidence. As a company, you should already have tools in place, such as insider risk management, to monitor and detect this malicious activity.

For an additional overview of eDiscovery...