Microsoft eDiscovery in Depth: Become an expert in Microsoft Purview content search and eDiscovery

by Ryan John Murphy, Heather Eckman

Overview

Learn about the locations of Microsoft 365 data, grasp the concepts of content search and eDiscovery, acquire the skills to craft powerful KQL queries, and explore how real organizations tackle complex issues through eDiscovery

Key Features

• Learn about the concept of eDiscovery and distinguish it from content search
• Delve into more complex aspects like multi-geo and attorney-client privilege
• Apply your new knowledge to implement eDiscovery solutions within your organization

Book Description

In today's rapidly evolving digital landscape, where information is abundant and security concerns are paramount, organizations face the daunting task of safeguarding their sensitive information while complying with stringent regulatory requirements. The process of identifying, preserving, collecting, reviewing, and producing electronically stored information (ESI) as evidence in legal proceedings, investigations, or regulatory matters is critical. The stakes are high, and the consequences of non-compliance for eDiscovery are severe. Welcome to Microsoft eDiscovery in Depth – a dynamic administrative book where Microsoft's cutting-edge technology meets legal intricacies to protect, investigate, preserve, and present data, safeguarding and ensuring the very essence of modern businesses. Based on both the technological possibilities within the Microsoft 365 cloud and real-life use cases, this book contains everything you need to know. After reading this book, you will have sound knowledge of how to create and manage eDiscovery cases in Microsoft’s eDiscovery. You will have advanced knowledge on how to collect and investigate data from within and outside of Microsoft’s eco-system. You will have knowledge of how to query data using Microsoft’s Keyword Query Language (KQL).

What you will learn

• Gain insight into configuring the relevant components
• Deep dive into advanced aspects like multi-geo and attorney-client privilege
• Understand the logging, monitoring, and alerting for eDiscovery
• Explore real-world use cases for eDiscovery
• Understand how to segment eDiscovery admins and managers to provide least permissions possible
• Learn data segmentation for regional sovereignty laws, departmental security, and effective search and exclusion

Who this book is for

If you are working with Microsoft 365 on the information management or security aspects, then this book is for you. This book is also excellent if you are working in eDiscovery, compliance, surveillance or legal teams and need to find, preserve and present information from Microsoft 365. Consultants and technical leads working with Microsoft 365 and want a more clear understanding of the eDiscovery components will find this book very helpful.

Product Details

ISBN-13:	9781835462706
Publisher:	Packt Publishing
Publication date:	04/24/2026
Product dimensions:	75.00(w) x 92.50(h) x (d)

About the Author

Ryan John Murphy has been deploying Microsoft products for over 22 years. The majority of this time has been supporting clients in designing, deploying and migrating in Microsoft Exchange. This served as the foundation for his move to Microsoft Purview, which has been his focus for the past 6 years. His clients include some of the biggest names in Banking and Finance and Telecoms as well as clients across the UK and Global Legal industry, UK and EU Education and UK and EU Public Sector, e-Hospitals and Future Energy Cities in Arabia. This has seen Ryan working with his clients to support their use of M365 both to actively support client processes and a compliant environment in one with the regulatory requirements of the relevant jurisdictions in particular data investigations and discovery.  Ryan John Murphy is a Microsoft Security MVP and Microsoft Security and Compliance Certified.

Heather Eckman is an eDiscovery Consultant and Trainer with over 15 years of experience in the legal technology industry. With a deep understanding of the EDRM, she is passionate about educating service providers, corporations, government agencies, and law firms on efficient data processing, review, and production. She strongly believes in the right balance of people, technology, and procedure. In recent years, she has focused on developing self-paced online courses that provide clients with "just in time" learning—an approach that accommodates various budgets while ensuring a faster return on investment.

Table of Contents

Table of Contents

1. Product Information Document
2. Know your data
3. Content Search
4. An introduction into (Microsoft) eDiscovery
5. eDiscovery (Premium)
6. Using PowerShell
7. KQL Deep Dive
8. Advanced settings
9. Copilot
10. Unified Auditing and Sentinel - Logging, Monitoring and Alerting
11. Trips, trick and troubleshooting
12. eDiscovery (Standard)
13. Logging and monitoring
14. Use-case