O365 - eDiscovery Permissions

[LansITGuy]

Afternoon all.

 

Trying to look into an issue between some pupils. I'm Global Admin for the tenancy, but eDiscoery will not let me get a PST file. I can run a search and download the Excel files, but I can't even preview results in the browser etc.

 

I've gone into Security and Compliance > Permissions and tried to add myself to eDiscovery Manager. But, when I look for my name in there, I don't show up. In fact only 50, seemingly random, users do show.

 

Does anyone know how to get this to work? I'm completely at a loss as I am in the Discovery Management group in Exchange Admin, which I swear used to work.

 

Cheers!

[psydii]

https://docs.microsoft.com/en-us/microsoft-365/compliance/get-started-core-ediscovery?view=o365-worldwide

 

Give yourself eDiscovery Administrator rights. (you might want to get that signed off by your Safeguarding, HR and Data Protection Officers - it gives you 'god like' powers to see *EVERYTHING* including emails, IMs and documents that people have deleted)

 

I've been advised it can take 24hrs for the relevant permissions to propagate through 365 and come into effect.

 

eDiscovery is a lot better than it was a few years ago, and far more capable (for what I've needed) than was possible in the Exchange Admin. However if all you are after is export to .pst or "delete this email from all mailboxes right now!" it is somewhat unwieldy.

 

 

 

For running an investigation, keep it all in eDiscovery. Run the searches and review the results and report your findings.

 

 

When adding yourself as an eDiscovery Administrator - use your Display Name not your email or SAMAccountName.

Edited February 23, 2021 by psydii

[LansITGuy]

Thanks for the info psydii.

 

When adding yourself as an eDiscovery Administrator - use your Display Name not your email or SAMAccountName.

 

Thanks for that. I've never seen that mentioned anywhere so is good to know.

 

Change is in the system so we'll see what happens next.