Merge pull request #50466 from MicrosoftDocs/NEW-purview-ediscovery-create-case

New purview ediscovery create case

Author: v-dirichards

learn-pr/wwl-sci/deploy-message-encryption-microsoft-365/media/ediscovery-security-copilot-summary.png

@@ -0,0 +1,15 @@
+### YamlMime:ModuleUnit
+uid: learn.wwl.purview-ediscovery-create-case.case-access-permissions
+title: Manage case access and permissions
+metadata:
+  title: Manage case access and permissions
+  description: "Manage case access and permissions."
+  ms.date: 05/15/2025
+  author: wwlpublish
+  ms.author: riswinto
+  ms.topic: unit
+azureSandbox: false
+labModal: false
+durationInMinutes: 6
+content: |
+  [!include[](includes/case-access-permissions.md)]

learn-pr/wwl-sci/purview-ediscovery-create-case/case-access-permissions.yml

@@ -0,0 +1,15 @@
+### YamlMime:ModuleUnit
+uid: learn.wwl.purview-ediscovery-create-case.configure-case-settings
+title: Configure case settings
+metadata:
+  title: Configure case settings
+  description: "Configure case settings."
+  ms.date: 05/15/2025
+  author: wwlpublish
+  ms.author: riswinto
+  ms.topic: unit
+azureSandbox: false
+labModal: false
+durationInMinutes: 5
+content: |
+  [!include[](includes/configure-case-settings.md)]

learn-pr/wwl-sci/purview-ediscovery-create-case/configure-case-settings.yml

@@ -0,0 +1,15 @@
+### YamlMime:ModuleUnit
+uid: learn.wwl.purview-ediscovery-create-case.create-manage-ediscovery-case
+title: Create and manage eDiscovery cases
+metadata:
+  title: Create and manage eDiscovery cases
+  description: "Create and manage eDiscovery cases."
+  ms.date: 05/15/2025
+  author: wwlpublish
+  ms.author: riswinto
+  ms.topic: unit
+azureSandbox: false
+labModal: false
+durationInMinutes: 5
+content: |
+  [!include[](includes/create-manage-ediscovery-case.md)]

learn-pr/wwl-sci/purview-ediscovery-create-case/create-manage-ediscovery-case.yml

@@ -0,0 +1,15 @@
+### YamlMime:ModuleUnit
+uid: learn.wwl.purview-ediscovery-create-case.ediscovery-prerequisites
+title: Configure eDiscovery prerequisites
+metadata:
+  title: Configure eDiscovery prerequisites
+  description: "Configure eDiscovery prerequisites."
+  ms.date: 05/15/2025
+  author: wwlpublish
+  ms.author: riswinto
+  ms.topic: unit
+azureSandbox: false
+labModal: false
+durationInMinutes: 8
+content: |
+  [!include[](includes/ediscovery-prerequisites.md)]

learn-pr/wwl-sci/purview-ediscovery-create-case/ediscovery-prerequisites.yml

@@ -0,0 +1,64 @@
+Access control is essential in Microsoft Purview eDiscovery. Case access is restricted to designated users and role groups, helping ensure sensitive investigations stay secure and traceable. Before someone can contribute to or review case content, they must have the appropriate permissions and be added to the case.
+
+## Add users to a case
+
+Before a user can access any eDiscovery case, they must be assigned to the **eDiscovery Manager** role group. This gives them access to the **eDiscovery** area of the Microsoft Purview portal.
+
+After role group assignment, you can add them to individual cases. Being added to a case grants access to its searches, review sets, exports, and other investigation data.
+
+To add users to a case:
+
+1. Go to the [Microsoft Purview portal](https://purview.microsoft.com?azure-portal=true) and sign in with eDiscovery permissions.
+1. Navigate to **Solutions** > **eDiscovery** > **Cases**.
+1. Select a case, then open **Case settings**.
+
+      :::image type="content" source="../media/case-settings-button.png" alt-text="Screenshot showing the Case settings button in Microsoft Purview." lightbox="../media/case-settings-button.png":::
+
+1. Select the **Permissions** tab.
+1. Under **Users**, select **Add**, then choose the users you want to assign.
+
+You can also assign a role group to a case. However, you can only assign role groups you belong to. If a role is removed from a role group after assignment, the group is automatically removed from the case to prevent overexposure.
+
+## Remove users from a case
+
+Only users in the **eDiscovery Administrator** role group can remove other users from a case. Even if you originally created the case or are part of the **eDiscovery Manager** role group, you won't be able to remove users without elevated permissions.
+
+To remove users:
+
+1. From the case, go to **Case settings** > **Permissions**.
+1. Under **Users** or **Role groups**, select **Remove**, then confirm your changes.
+
+## Manage guest access
+
+You can invite external users to participate in a case as guests. This is useful when external reviewers, such as legal counsel, need access.
+
+Guest access must first be enabled in your environment. For more information, see [Enable guest access in eDiscovery](/purview/edisc-settings-guest-users?azure-portal=true).
+
+Once enabled, follow these steps to invite a guest:
+
+1. Open the case, then go to **Case settings** > **Permissions**.
+1. In the **Guest users** section, select **Invite**.
+1. Provide the guest's full name, email, organization, and justification.
+1. Assign the guest the **Reviewer** role (the only available role for guests).
+1. Submit the request for approval by an eDiscovery Administrator.
+
+   :::image type="content" source="../media/ediscovery-guest-access.png" alt-text="Screenshot showing where to add guest users to an eDiscovery case." lightbox="../media/ediscovery-guest-access.png":::
+
+### Approve and manage guest access
+
+Only **eDiscovery Administrators** can approve or deny guest access. Admins can manage guest requests from **Settings** > **eDiscovery** > **Guest users**.
+
+:::image type="content" source="../media/guest-access-request.png" alt-text="Screenshot showing a guest access request." lightbox="../media/guest-access-request.png":::
+
+If the guest is new to the tenant, a two-step approval is required. After their account is created, a second approval step is needed to assign case access.
+
+Once approved, the guest receives an email invitation with a unique link to access the case.
+
+Guests with a Microsoft Entra ID account can authenticate immediately. Others receive a one-time passcode, assuming this is enabled in your organization.
+
+To remove guest access:
+
+1. Go to **Settings** > **eDiscovery** > **Guest users**.
+1. Select the guest and choose **Remove**.
+
+The guest's Microsoft Entra account remains active, but they lose access to the case. Regular cleanup of inactive guest accounts is recommended in Microsoft Entra ID.

learn-pr/wwl-sci/purview-ediscovery-create-case/includes/case-access-permissions.md

@@ -0,0 +1,48 @@
+Each eDiscovery case in Microsoft Purview includes configurable settings that affect how searches, analytics, and review sets behave. These settings help tailor investigations to your organization’s needs and control how reviewers interact with case data.
+
+You can configure case settings in several categories:
+
+- Data sources
+- Search and analytics
+- Review sets
+
+These settings are applied at the case level and affect all review sets within the case.
+
+## Configure data source settings
+
+Data source settings control which people and groups are included during organization-wide searches. By default, only licensed users are included. You can expand this scope to include other types of users, depending on your investigative needs.
+
+From the **Case settings** page, select **Data sources**, then choose one or more of the following options:
+
+- All people and groups including unlicensed, on-premises, and guest users
+- All people and groups including shared Teams channels
+- All people and groups including departed users
+
+Adding more data sources can increase search time. Only use these settings when they support the scope of your investigation. To reset to the default configuration, select **Restore defaults**.
+
+## Configure search and analytics settings
+
+The **Search and analytics** settings apply to all review sets in a case. These settings control how data is grouped, how search results are processed, and whether advanced analytics features are used.
+
+To access these settings, go to **Case settings** > **Search and analytics**.
+
+Available options include:
+
+- **Near duplicate and email threading analysis**: Groups similar documents and emails together to improve review efficiency. Set the similarity threshold and word count ranges for inclusion.
+- **Themes**: Automatically groups documents by dominant ideas to help identify patterns across large datasets. You can set a maximum number of themes and enable dynamic adjustment if the document count is low.
+- **Auto-generated review set query**: Automatically creates a saved search called **For Review** that filters out duplicates after analytics is run.
+- **Ignore text**: Exclude known irrelevant content, such as boilerplate email disclaimers, from analytics processing using specific text or regular expressions.
+- **Optical character recognition (OCR)**: Enables OCR during advanced indexing so that text in image files becomes searchable and reviewable.
+
+   :::image type="content" source="../media/search-analytics-settings.png" alt-text="Screenshot showing the options for search and analytics settings in an eDiscovery case." lightbox="../media/search-analytics-settings.png":::
+
+These settings help streamline case review and reduce time spent on redundant content.
+
+## Configure review set grouping
+
+Review sets can be grouped to make it easier for reviewers to see related content. Grouping settings vary based on when the case was created:
+
+- **For cases created after March 15, 2023**: Items are grouped by **Group ID** and **Thread ID**
+- **For cases created before that date**: Items are grouped by **Family ID** and **Conversation ID**
+
+You can view or change the grouping method in **Case settings** > **Review sets** by toggling **Allow grouping**. This setting affects how related items are organized within the review set and can affect review speed and clarity.

learn-pr/wwl-sci/purview-ediscovery-create-case/includes/configure-case-settings.md

@@ -0,0 +1,85 @@
+After you complete initial setup, you can begin creating and managing eDiscovery cases in the Microsoft Purview portal. Each case serves as a secure workspace that brings together related investigation tasks such as searches, holds, review sets, and exports. Cases help isolate and track the details of a specific legal, compliance, or security matter.
+
+Before using the investigation tools, you need to create a case. From there, you can organize, manage, and monitor case activity in the Microsoft Purview portal.
+
+## Create a case
+
+Creating a case gives you a dedicated environment for your investigation. You must have the correct eDiscovery permissions to perform this task.
+
+To create a case:
+
+1. Go to the [Microsoft Purview portal](https://purview.microsoft.com?azure-portal=true) and sign in as a user with eDiscovery permissions.
+1. Select **Solutions** > **eDiscovery** to go to the **Cases** page.
+1. Select **Create case**.
+1. Enter a **Case name** and optional **Case description**.
+1. Select **Create**.
+
+   :::image type="content" source="../media/create-ediscovery-case.png" alt-text="Screenshot showing case creation in Microsoft Purview eDiscovery." lightbox="../media/create-ediscovery-case.png":::
+
+After the case is created, the user who created it is automatically added as a member. Members can access the case and complete tasks based on their assigned roles.
+
+## View and organize existing cases
+
+Once you create a case, it appears on the **Cases** dashboard. This dashboard shows all existing cases across your organization, along with details such as:
+
+- Case name
+- Status (Active, Closed, and other states)
+- Type (Standard or Premium)
+- Created and modified timestamps
+- Last modified by
+- Optional case number and description
+
+You can adjust the dashboard to meet your needs. Choose which columns to show, apply filters based on case type or status, group by properties such as last modified user, and export the full case list as a `.csv` file.
+
+To prioritize a case for quick access, mark it as a favorite by selecting the star icon next to its name. The correct terminology is **marking as a favorite**, not pinning.
+
+## Use Security Copilot to summarize a case (preview)
+
+Security Copilot provides a summary of case activity using AI-generated natural language. This helps you review case progress without navigating every tab.
+
+You can use it to:
+
+- Review status updates and outstanding tasks at a glance
+- Prepare for case meetings or reporting
+- Identify priorities based on recent actions
+
+Copilot summarizes key areas, including:
+
+- Case information such as creation date, status, and last modified user
+- Data sources included in the investigation
+- Searches, holds, and review sets
+- Exports and case-related jobs
+- Case settings like optical character recognition (OCR) and near-duplicate detection
+
+   :::image type="content" source="../media/ediscovery-security-copilot-summary.png" alt-text="Screenshot showing Security Copilot being used in an eDiscovery case." lightbox="../media/ediscovery-security-copilot-summary.png":::
+
+Security Copilot is available to users assigned the **eDiscovery Administrator** or **eDiscovery Manager** role. It must be enabled in your environment. Select **Summarize this case** to generate or refresh the summary in the Copilot pane.
+
+## Manage case settings
+
+Each case includes settings for metadata, access, and investigation behavior. To update settings, open the case and select **Case settings**. You can:
+
+- Edit the name, number, or description
+- View the license level for the case (Standard or Premium)
+- Manage access for users, role groups, and guests
+- Configure advanced features such as OCR or analytics
+
+   :::image type="content" source="../media/ediscovery-case-settings.png" alt-text="Screenshot showing the case settings in an eDiscovery case." lightbox="../media/ediscovery-case-settings.png":::
+
+You can also close or delete a case from this area.
+
+- Closing a case turns off all holds associated with it. A 30-day delay hold applies to content that was previously held.
+- Reopening a case doesn't restore holds automatically. You must manually turn them back on.
+- Deleting a case permanently removes all associated data. This includes hold policies, searches, review sets, and exports. Deleted cases can't be recovered.
+
+To close or delete a case:
+
+1. Go to the **Case settings** page from an eDiscovery case.
+1. Select the **Case details** tab.
+1. Select **Actions** then choose to close or delete the case.
+
+To delete a case, you must first remove all hold policies, even those that are currently turned off.
+
+Use the **Create and configure a case** interactive guide to walk through case eDiscovery creation and management.
+
+[:::image type="content" source="../media/guide-create-case.png" alt-text="Illustration showing the opening page to the Create and configure a case interactive guide." lightbox="../media/guide-create-case.png":::](https://mslearn.cloudguides.com/guides/Create%20and%20configure%20a%20case%20with%20Microsoft%20Purview%20eDiscovery?azure-portal=true)