Microsoft Purview Data Preservations

Users can create, track, and release Microsoft Purview holds within Everlaw, and view these preservation-in-place objects alongside hold notices pertaining to the same matter. When you create the hold in Everlaw, you do not need to navigate to a separate tool to track and monitor it. 

To set up a Microsoft hold in Everlaw’s legal hold system, you need to create a data preservation.  Each data preservation is defined by:

• A set of services (such as Microsoft or Google) 
• A set of custodians 
• A query (including optional dates and keywords)
• A set of data sources within those services (such as Exchange mailbox)

Requirements

To leverage Microsoft preservation-in-place, organizations must have access to Premium eDiscovery. See Microsoft’s documentation for a list of the licenses that include Premium eDiscovery.

On your organization’s Legal Holds page, you can check which Microsoft account, if any, is currently logged in for data preservations. To do so, select Manage data preservation login. This displays the Microsoft account you are currently logged into and allows you to select Log out to log out of that account. 

To create a Microsoft data preservation within Everlaw, you must be a:

• Microsoft eDiscovery Admin or eDiscovery Manager
  

  Note

  Although it is possible to create data preservations with eDiscovery Manager permissions, Everlaw recommends that users have eDiscovery Admin permissions.

  On Purview, eDiscovery Admins can access any case, but eDiscovery Managers can only access cases they have created. This means that on Everlaw, if you log in as a user with eDiscovery Manager permissions, you will not be able to edit any hold that has been created by another user since you do not have access to the corresponding case on Purview.

  Additionally, even though you will be able to “see” the holds, Everlaw will not be able to retrieve any updates about them, so the displayed information about these holds may be inaccurate.

  To avoid these possible inaccuracies and confusion, we recommend that any user creating data preservations have eDiscovery Admin permissions.

  Note that permissions on these cases can be altered in Microsoft Purview but not in Everlaw. If needed, you can share specific cases to the eDiscovery Managers that should have access.

• Everlaw Organization Admin or Everlaw Legal Holds Organization Admin with access to the database/matter that the preservation will be housed in
• [Optional] To create a data preservation that includes additional data sources (data that isn't owned by a specific custodian), you must also be added to the Microsoft cloud organization from Organization home > Cloud Management > Data preservations. 

Connect to a Microsoft cloud organization (Data preservations) to preserve additional data sources

Before you can create a data preservation that includes additional data sources, you must connect your Microsoft organization to Everlaw. 

The Microsoft organization must be connected from Everlaw’s Data preservation page, even if the same Microsoft organization is connected from the Office 365 Cloud management page to support cloud uploads.

Required permissions:

• Microsoft Global Admin
• Everlaw Organization Admin or Everlaw Cloud Admin

To make the connection:

1. Go to Organization home > Cloud Management > Data preservations.
2. Select + Add Microsoft Organization.
3. A dialog prompts you to log into your Microsoft account. If you are already logged in, it will ask you to select your account.
4. If this is the first time you are connecting your Purview tenant to Everlaw, a dialog requests permission to access your account information. See Data security and privacy for the specific permissions requested. Select Accept to move on.
5. The first time you connect your Purview tenant to Everlaw, a second dialog requests permission to access information from additional data sources. See Data security and privacy for the specific permissions requested. Select Accept to move on.
6. Once you log in and consent to the permissions, your organization is connected, and you are added as an approved user.
   

   Note

   If you are a Cloud Admin without Legal Holds Organization Admin permissions, you will not be able to create data preservations within Everlaw, even if you are the one who created the connection.

7. [Optional] To grant additional users access to preserve additional data sources for data preservations, select + Add users to cloud organization.
   The users you add should have either Everlaw Legal Holds Organization Admin or Org Admin permissions and either Microsoft eDiscovery Admin or eDiscovery Manager permissions.
   

   Note

   Granting a user access at this step is required for a user to create a data preservation that includes additional data sources. Users creating a data preservation that does not include these data sources must have Everlaw Legal Holds Organization Admin/Org Admin permissions and Microsoft eDiscovery Admin (or eDiscovery Manager) permissions, but do not need to be added as users here.

Data security and privacy

When an Admin grants permission to form the cloud connection between Everlaw and Purview to collect additional data sources, they grant Everlaw two sets of permissions. First, you consent to allow Everlaw to:

• Access the directory as you
• Maintain access to data you have given it access to
• View your email address
• Sign in as you

Once those permissions are consented to, a separate dialog requests the permissions necessary for Purview eDiscovery Managers and Admins in your Purview tenant to collect data from additional data sources. The requested permissions are:

• Access the directory as the signed in user
• Read and write all eDiscovery objects
• Maintain access to data you have given it access to
• Read all users' profiles
• Read the names and descriptions of all channels
• Read the members of all channels
• Read all groups
• Read items in all site collections
• Get a list of all teams
• Read all users' full profiles

Create a new data preservation

To create a new data preservation:

1. From the Organization Legal Holds tab, select View on the matter/database you want to create a hold notice in. Consider the following:
   • If you create your legal hold with a database, the legal hold will also show up in the Legal Holds tab for that database. Database admins will be able to view information about it.
   • Matters allow you to create a hold notice without associating it with an Everlaw database.
     You should leverage matters instead of databases when creating legal holds for a particular investigation ahead of data collection. Later on, should you need to collect data, you can promote the matter to a database. 
     
2. From the main page for the database/matter, select +New and then Data Preservation.
   
3. Enter a name for your data preservation. Microsoft 365 is automatically selected as the service for the data preservation. 
4. Select Continue. 
5. A Microsoft popup prompts you to log in with your Microsoft credentials.
   
6. Either Select an existing Microsoft case or Create a new Microsoft case.
   To choose an existing Microsoft case, select it from the dropdown. Each case can only contain one custodian preservation, so some existing cases will be disabled by default. You can see this case, and the holds created later in this process, in your Microsoft Purview account.
   To create a new Microsoft case, enter the case name.
   
7. Select Continue to move on to the Custodians step.
8. On the Custodians step, select the custodians to include in the data preservation.
   
   
9. When you're done choosing your custodians, select Next. Everlaw analyzes your selected custodian against those in your Microsoft organization and checks for any duplicates.
   • If any duplicates are identified, you are taken to the Duplicate custodians in Everlaw step. See our article on managing duplicate emails to learn more about this step.
   • If any custodians are not detected in your Microsoft organization, you are taken to a warning page to view a list of those custodians before proceeding with the preservation.
   • If any custodians exist in your Microsoft organization but have not yet been added to the Everlaw directory, you can automatically add them to the directory at this step. To do so, select Add custodians to directory and include in data preservation. The directory entry will be populated with the custodian’s name, email, manager name, and manager email address. These properties will be pulled from your organization’s Microsoft Azure Active (Entra ID) Directory.
     
     If any of the custodians in your organization have a Microsoft User Principal Name (UPN) that differs from their email address, Everlaw is still able to identify that custodian and add them to the directory with the correct email address. It's not guaranteed that Everlaw can identify all data sources associated with a particular user if their email address and UPNs do not match. We highly recommend ensuring that users’ email addresses and UPNs match before creating data preservations on those users.

11. Select Next to move on to the Query step.
12. [Optional] Add a query, including a start and end date and keyword query. Keywords should follow Microsoft search syntax.
13.  Select Next to move onto the Data sources step.
14. On the Data sources step you choose which data to include in the data preservation. There are two types of data sources:
    • Custodian data sources: Mailboxes and sites that belong to a single custodian
    • Additional data sources: Mailboxes and sites that an individual custodian does not have administrative control or ownership over, but is a member of 

Under Custodian data sources, Mailbox and OneDrive are selected by default. Deselect any custodial data source you do not want to preserve. This will remove this data source from the data preservation for all your selected custodians.

15. Under Additional data sources, select how to view the data available for selection. You can choose to view by Custodian or Data Source.
    
    • If you view by Custodian:
      1. Under Custodian, select a custodian's name. A table displays the additional data sources. In the Data source column, the number indicates the number of data source locations selected for each Additional data source. Select the caret to see the data source location(s).
         
      2. To include data from an Additional data source in the data preservation, select the edit button.
         • For Sharepoint, this opens a dialog that displays all of the sites in the organization. 
         • For Exchange, this opens a dialog that displays all of the mailboxes the selected custodians in the data preservation are members of. 
         • For Teams, Viva Engage, and Groups, this opens a dialog that displays the data source locations that the custodian is a member of. 

If a custodian is not a member of any data source location for a certain data source category, the row for that data source category will be grayed out.

From the dialog for any additional data source, select the data source locations to include. This adds that data source location to the data preservation and identifies that custodian as a custodian of it. 

• If you view by Data source:
  1. Select a Data source. A table lists the data source locations for that data source category and displays information about them.
     
  2. To include a data source location in the data preservation, select the checkbox in its row.
  3. To edit the custodian(s) for the data source location, select the  edit button (already at least one custodian selected) or plus button (no custodians selected yet):
     • For Sharepoint and Exchange, select the button in the Custodians column. 
     • For Teams, Viva Engage, and Groups, select the three dots under the View details column, then select the button in the Custodians column.

When you select the button, a dialog listing the custodians who are members of this data source location opens. Select the custodians you'd like to associate with this data source location.

16. When you're done selecting your data sources, select Next.
17. If any of the selected data sources don't have a custodian associated with them, a dialog appears for you to designate one or more custodians. You can select a Default custodian to designate as the custodian for any data source for which you don't individually designate a custodian.
    
18. Select Continue to move on to the Summary.
19. Review the Summary. If it looks good, complete the data preservation by selecting Preserve. Otherwise, select Previous.
    Once the data preservation has been created, a new Data Preservation card will appear on the Legal Holds tab, described in the following section.

View and edit a data preservation

On the Legal Holds tab, data preservations are nested under the matter/database they belong to. Expand a matter/database to see any data preservations within it. To find a specific data preservation, enter a keyword to filter.

You can filter by: 

• Matter/database name
• Hold notice/data preservation name
• Matter/database field name
• Matter/database field values

The data preservation card displays all the high-level information about the data preservation object:

• The status of the preservation
• The total number of errored, pending, active, and released custodians.
  If you just created the preservation, that status of many custodians is likely to be Pending as Microsoft Purview works its way through creating holds on each custodian.
• The directories used to create the data preservation
• The data sources preserved
• The date and keyword query, if any

To access a data preservation, select it. This takes you to the Summary page for that data preservation.

From this page you can:

• See a summary of details about the data preservation
• View the custodians of the preservation, the data sources associated with them for this preservation, and details about the custodians
• Release custodians from the preservation individually or as a group
• Add custodians to the data preservation
• Delete the preservation
• Reactivate released custodians
• View and export activity within Everlaw on this preservation

To see the most recent status of the preservation, select Sync with Microsoft 365. 

After creation, Microsoft may take some time to set up the holds on each custodian, so many of your custodians may be pending for some time after you initially create the preservation. You will need to select Sync again later to see that the holds on those custodians were successfully created.

You can also check the status of your hold in Microsoft itself, as described in the section below.

Custodian status and details

To see the status of each data source belonging to each custodian in a table format, select Custodians. From here, you can also perform actions on subsets of custodians, including releasing active custodians, reactivating released custodians, or exporting reports.

Select a custodian to open a side panel with information about the custodian. The panel has two tabs:

• The Properties tab includes information about the custodian
• The Legal holds tab includes information about hold notices and data preservations to which this custodian belongs.

Select Export to export CSVs containing the information for this custodian. One CSV includes the information from the Properties tab and another CSV includes the information from the Legal holds tab.

Use the arrow buttons to toggle through the custodians.

Data preservation activity

To see all recorded activity on the data preservation, including custodian statuses (successful, pending, or errored) at each sync event, go to the Activity tab. From here, you can also:

• See who performed each action
• Filter the activity by date
• Export a report of all activity

Select the eye button in the View details column to see a detailed breakdown by custodian and data source for each event. This information is also included in the export.

To export this information, select Export to download. 

Access your hold in Microsoft Purview

To see the status of the holds in Microsoft, select the linked name below Case. In the example here, the Microsoft case is titled Example Case.

Select Example Case to go to the Data Sources tab of the selected case in Microsoft Purview. All custodians placed on hold are shown here. 

Within the Microsoft Purview environment, you can also select the Hold tab to see details of the newly created custodian hold. To verify that the query entered in Everlaw was added to the Microsoft hold, click on that hold, then select “Edit” to see the existing settings.

Modify a data preservation

You can modify a data preservation in Everlaw by:

• Adding custodians to the data preservation
• Editing the query
• Editing the Additional data sources associated with the preservation

Add Custodians

Once you have created a data preservation, you night need to add additional custodians to it. Custodians that you want to add must already be added to the database/matter the preservation is housed in. To learn how to add custodians to a matter/database, see our article Manage Legal Holds in a Matter or Database.

To add custodians to the preservation:

1. Select the three-dot menu, then select Add more custodians.
   This opens the Custodians to preserve step.
2. Select the custodians to add.
3. When you're done, select Next. You are taken to the Data sources step of the preservation setup.
4. [Optional] If you have access to additional data sources, you can add them here. For more detailed instructions, see step 15 in the Create a new data preservation section.
5. Select Next to move on to the Summary step.
6. On the Summary step, select Preserve.

Edit the query

To edit the query:

1. From the Summary tab of the data preservation page, select Edit next to Query.
2. Enter the query. It can be a date range, keywords. or both.
3. When you're done, select Save.

Change Additional data sources

You can modify your data source selection for additional data sources. To do so:

1. From the Summary tab of the Data preservation page, under Services and data sources (next to Microsoft 365), select the three-dot menu, then Modify data sources
   
2. This takes you to the Data Sources step in the data preservation wizard.  From here, you can add and remove different Additional data sources. For more detailed instructions, see step 15 in the Create a new data preservation section.
3. Select Next  to move on and complete the preservation.

Release custodians from a data preservation

To release all custodians from a data preservation:

From the data preservation page, select Release all custodians. 

After you release the custodians, your hold and case still exist in Microsoft, but the Hold column display False instead of True.

To release specific custodians from a data preservation:

1. Navigate to the Custodians tab of the data preservation.
2. Select the custodian(s) to release. Options for actions you can take appears.
3. Select Release.
   
   

Reactivate a data preservation

Once your data preservation has been released, you can reactivate it. To do so, select Reactivate all custodians at the top right of your data preservation. You are taken to a wizard to modify the query and data sources associated with this data preservation.

Just as with creating a preservation, reactivating the hold in Microsoft will not be instantaneous, so the status of the released data preservation is likely to be Pending at first. You may need to press the Sync button later to see the data preservation status be successfully updated.

You can also reactivate individual custodians that have been released. To do so

1. Navigate to the Custodians tab of the data preservation.
2. Select the custodian(s) to release. Options for actions you can take appears.
3. Select Reactivate.
   
   

If you reactivate custodians on a data preservation while other custodians are still active, you cannot  modify the query during the reactivation process. This is because the query and data sources must match for all custodians in a particular data preservation.

Delete the data preservation

To delete a data preservation:

1. Release the preservation from within Microsoft.
2. From the data preservation page, select the three-dot menu, then Delete data preservation.
   

Deleting the data preservation in Everlaw does not delete the corresponding hold in Microsoft. To delete the released hold in Microsoft, you need to delete the hold in Microsoft Purview itself.