5.4.2. eDiscovery Solutions
💡 First Principle: When litigation, an investigation, or a regulatory request requires producing specific content, eDiscovery exists to identify, preserve (via legal hold, preventing deletion or modification), search, and export exactly the relevant content across Microsoft 365 — turning "we might need this for a legal case" into a defensible, repeatable process.
Holds are the preservation step — once applied, content subject to the hold can't be permanently deleted, even if a user or an automatic retention policy would otherwise remove it, ensuring evidence isn't lost while a case is active. Microsoft treats placing a hold as optional, but investigators usually place one as soon as the case is created so nothing relevant disappears while searches run. Searching now happens inside an eDiscovery case; the separate Content search tool of the old compliance portal has been folded into eDiscovery.
⚠️ Exam Trap: eDiscovery finds and preserves content relevant to a case — it does not, by itself, tell you what actions a user took (that's Audit, 5.4.3), even though both might be used together during the same investigation.
Reflection Question: Why do investigators usually place a hold as soon as an eDiscovery case is created, even though Microsoft treats the hold as optional?
