You can add a definition to a case for email data.
Note: Changes that you make to the definitions for a case (including adding, modifying, and deleting definitions) apply only to data collection jobs that successfully ran since the last time the definition was modified.
Procedure
From the navigation pane, go to Data Insights.
The Data Insights page appears.
Click Case manager.
The Case manager page appears.
In the Name column, click the case.
The case page appears.
In the upper-right corner of the Definitions table, click Add definition.
The Definition dialog box appears.
Under General, enter the following information:
Definition name: Enter the name of the definition as you want it to appear in the Case Manager.
From the Data type list, select the type of data that you want to collect:
To collect data from archiving mailboxes, select Exchange archiving.
If you specify custodians, only mailboxes that are owned by the custodians are searched.
To collect data from journaling mailboxes, select Exchange journaling.
If you specify custodians, only email data that contains the custodians in the To, From, CC, or BCC boxes is searched.
To collect email data from a ContentStore client, select SMTP journaling.
From the Data Collection list, select one of the following options:
Continuous: Incremental data is collected continuously based on the Recovery Point Objective (RPO) of the Server Plan.
One time only: Data is collected only one time.
Under Custodians, enter the names or email addresses of the users or user groups whose data you want to add to the case, and then click Add.
Note:
If you are processing Exchange Online data, then you must enter the SMTP address for the automatic suggestion feature to work.
If you are processing Exchange journal mailbox data, then you must enter the user mailbox email address and not the journal mailbox email address.
To add multiple custodians, separate each custodian's name or email address with a comma. For example, enter Adhira Venkatesh, Bohai Wang, mtolliver@example.com.
Optional: Under Additional criteria, configure additional filter criteria to the data included in the case.
Only data that meets the filter criteria that you define is included in the case.
Click Save.