\n
![\"\"](\"http:\/\/blog.hosebei.ch\/wp-content\/uploads\/2018\/07\/contentsearch01.png\")
<\/a><\/p>\nThe first questions that may raise up, what is content search and eDiscovery, and what is the difference of those two options.
\nWith content search, you can search all the content that is actually available, regarding existent policies (given example: Exchange Hold). Content search may help you in various occasions, where it may not be required to use eDiscovery. For legal documentation the eDiscovery should be used, where you also can specify Mailboxes, SharePoint Locations and OneDrive for Business to set hold policies on them.<\/p>\n
The next question might be: Who has access to those features by Default?<\/strong><\/p>\n It depends… <\/p>\n Yes, that is true, it depends on how your Azure AD is configured. Out-of-the-Box nobody can access the two features, not even the Global Administrator. The Global Administrator can perform searches, and he is able to assign the necessary roles to export the data from the searches. But those role assignments are not set by Default. So it is like within the On-Premise Domain, you can configure the Domain Admin as an Exchange Org Admin as example, but it is not set by Default.<\/p>\n How can I assign the content search permission?<\/strong> Your Role group wizard should look like this: How can I assign the eDiscovery permission?<\/strong> How restrict access?<\/strong> Download Data from Content Search<\/strong> There are different options when you select to export the results, and the most questionable option is “Unsearchable items”. See the official statement from Microsoft to Unsearchable items for Exchange 2013 or Exchange Online:
\nI would like to show you, how you can assign the content search permissions to a user (or group). Even there are preconfigured roles within the Security & Compliance Center, I create my own role, to make sure the granted access is sufficient. For creating the new role, open the permission blade within the center, and click on “+Create”:
\n<\/a>
\nName the name role properly and after a click on next, you have to assign the existent roles to your own role:<\/p>\n
\n<\/a>
\nMind that it takes up to 15 minutes, until a user can access the portal. But afterwards he is logged in, the user can immediately start a content search, and is able to preview and download the reports and data.<\/p>\n
\nThis one is more likely used, and also easier to achieve. If you click on the built-in eDiscovery Manager role, you can see, that there are two sub-roles available, the Administrator role and the manager role. As an Administrator, you have all the access to all cases that are existent. As a a manager, you can only access those case, that are assigned to you.
\n<\/a><\/p>\n
\nIf you require to restrict that access of the eDiscovery searches, for example to divide the countries, you can use the permission filters. Tony Redmond already wrote an excellent article about implementing permission filters:
\nRestricting Office 365 Content Searches with Permission Filters<\/a><\/p>\n
\nIf your content search was successful, you can then download the results:
\n<\/a><\/p>\n
\n<\/a>
\n(Source: https:\/\/docs.microsoft.com\/en-us\/exchange\/security-and-compliance\/in-place-ediscovery\/in-place-ediscovery<\/a>)<\/p>\n