5.4.2. eDiscovery Solutions
💡 First Principle: When litigation, an investigation, or a regulatory request requires producing specific content, eDiscovery exists to identify, preserve (via legal hold, preventing deletion or modification), search, and export exactly the relevant content across Microsoft 365 — turning "we might need this for a legal case" into a defensible, repeatable process.
Legal hold is the critical preservation step — once applied, content subject to the hold can't be permanently deleted, even if a user or an automatic retention policy would otherwise remove it, ensuring evidence isn't lost while a case is active.
⚠️ Exam Trap: eDiscovery finds and preserves content relevant to a case — it does not, by itself, tell you what actions a user took (that's Audit, 5.4.3), even though both might be used together during the same investigation.
Reflection Question: Why is applying a legal hold a necessary first step in an eDiscovery case, before content is even searched or reviewed?
