New eDiscovery UI - Data Sources

It's different for better and worse - adjust your workflows

Photo by Alina Grubnyak on Unsplash

Microsoft recently announced the end of life for the classic eDiscovery interface in Purview. As part of that, I will walk through the eDiscovery process and highlight where things are different. The first area that caught my attention was eliminating the Data Sources tab from eDiscovery Premium.

You might have gotten used to this tab and the way it worked in classic eDiscovery:

When adding a custodian source, you search for the user and can add or remove their mailbox, OneDrive, other mailboxes, SharePoint sites, and Teams or Yammer groups they had access to, and you could place the locations on hold on the next screen:

When it came time to run a search, the locations were defined already, and you could select the custodian for your search scope:

I will be the first to admit this workflow didn’t cover every situation and could get cumbersome due to the lack of flexibility.

For example:

1. If you want to search across different sources for your custodian compared to what you placed on hold, you must create a second source or manually add those non-held locations.

2. I’ve discussed the dangers of assigning custodians to shared data locations, such as Teams and SharePoint sites. This workflow made it too easy to do that by default.

3. Frankly, I can’t count the times I wanted to create a data source without a hold but made a hold policy because the checkbox was set on by default.

There are no custodians in the new interface, which makes that problem disappear.

The workflow is also very different. In Classic, you set the locations where you want to assign Mike as the custodian, then search across them using the custodian data sources option in the collection wizard.

You can create as many collections from those same sources as you want. It’s now hard-coded as a location.

In the new UI, things are very different (At least as of this week. It’s a fluid situation):