Creating a Case for Exchange Online Data

Compliance officers can create a case to collect Exchange Online data.

Legal hold case: If you want to identify and segregate relevant data and preserve them for a long term for legal purpose certain data, then you can create a Legal hold case. Case data is stored in a separate copy and the source data is retained until the case is deleted.
Review set case: If you want to sort and group relevant data for further processing and review, then you can create a Review set case. Case data is obtained directly from the backup source. Once you create a review set case, you cannot remove case data from it.

Procedure

From the Command Center navigation pane, go to Comply > eDiscovery & Compliance.
Click Case manager.

The Case manager page appears.
In the upper-right area of the page, click Add case, and then select Legal hold or Review set.

The Legal hold or Review set dialog box appears.
In the Name box, enter a name for the case.
From the Data classification plan list, select the data classification plan to use for the case.
From the Backup plan list, select the backup plan to use for the case.
From the Data type list, select Exchange Online, and then click OK.
From the Data Collection list, select one of the following options:
- Continuous: Incremental data is collected continuously based on the Recovery Point Objective (RPO) of the backup plan.
- One time only: Data is collected only once.
To filter the data by custodians, under Custodians, enter the custodians, and then click Add.

You can enter user names, user groups, and/or email addresses. To enter multiple custodians at one time, separate the values with commas. For example, enter Adhira Venkatesh, Bohai Wang, mtolliver@example.com.
To filter the collected data by keyword or other criteria, such as Has attachment and Subject, expand Additional criteria, and then enter the criteria.
Click Save.

The option that you selected from the Data collection list specifies how often the Commvault software automatically collects data. To run a collection job on demand, in the upper-right corner of the case page, click Submit collection job.
After a data collection job runs, you can search the data that is collected.
When you create a case, a case definition is automatically created. The case definition specifies what data is collected, how often it is collected, and other settings. You can create more definitions for a case. Changes that you make to the definitions for a case (including adding, modifying, and deleting definitions) apply only to subsequent data collection jobs.

For information about searching collected data, see Searching Data in a Case.
For information additional criteria, such as Has attachment and Subject, see Additional Criteria for Case Manager.