Advanced eDiscovery Architecture in Microsoft 365

Work flow in a Single-Geo environment Work flow in a Multi-Geo environment

Advanced eDiscovery provides an end-to-end workflow to preserve, collect, in a case, as required by regulatory bodies like FINRA and FINMA. Pertinent Microsoft 365 Multi-Geo is an add-on
review, analyze, and export content that is responsive to your organization's information can be collected from Microsoft 365 and third-party data capability that gives organizations the ability to
internal and external investigations. It also lets legal teams manage the entire sources, analyzed, and then redacted so that only relevant sections are made manage and store data in multiple geographic
legal hold notification workflow to communicate with custodians involved available to external parties for investigation. regions within their tenant. By default, an Trigger event
eDiscovery Manager or admin in a multi-geo Review set in
environment can only search for content central
located in their own geo location. location (APC)
Contoso Group
However in Advanced eDiscovery, admins can
search for content in any geo location in their
Trigger event Create case Add custodians & Collect and pre-process data Review and process data Export data Create case and Review and
organization. That means they don't have to
preserve data add case managers process data
create search permissions filters by using the
New-ComplianceSecurityFilter cmdlet with Central location: APC
Add case Add data the Region parameter. Case creation
Search and process the data
managers custodians and Collect the M365 location: APC
to eDiscovery preserve their and non-M365 data
An internal or Manager role data
M365 sources 3rd party data In Advanced eDiscovery, all case content is Add Search Collect, pre- Export data
external event that group (RBAC) copied to reviews sets located in the geo custodians data process data
creates the need
for an investigation
location where the case was created. Similarly, All data is exported
Send hold
Create case notification
during export, case content is exported from from the central
communications the geo location where the case was created. location (APC)
Add custodians Multi-Geo search is conducted
Data from satellite
location is
Assign case View relevant and preserve data in Advanced eDiscovery stored in APC
managers custodian
audit activity

Satellite location: NAM

Add Search Collect, pre-

custodians data process data

Data flow in Advanced eDiscovery

Add custodians & Collect and pre-process data Review and process data Analyze data Export data
preserve data
Advanced eDiscovery supports the EDRM workflow
Contoso
Non-custodial data sources
When an organization responds to a legal investigation, the workflow around
3rd party data
identifying, preserving, and collecting potentially relevant content is based
on the people in the organization who are the custodians of relevant data. In
eDiscovery, these individuals are called data custodians (or just custodians). Trigger event
Case managers Collect non-M365 data

Content locations where case custodians don't have administrative control

Storage Blob
but may be owners of relevant data, are known as non-custodial data
sources. In an Advanced eDiscovery case, legal teams can add individuals in
their organization as custodians, and identify and preserve content in
custodial M365 data sources and non-custodial data sources. By using the Add data Search/process the data
built-in custodian and data source management tool in Advanced Create case custodians and
preserve their data
eDiscovery, organizations can secure collect electronically stored information
and preserve it from inadvertent (or intentional) deletion.
Create a case and assign
case managers with Send hold Custodial data sources
appropriate permissions notifications Search and collect
M365 sources
(RBAC) M365 data

Custodian
audit log
(if needed)

October 2020 © 2020 Microsoft Corporation. All rights reserved. To send feedback about this documentation, please write to us at CloudAdopt@microsoft.com.