Entra / Microsoft 365 · Compliance & audit
Report eDiscovery cases
Report eDiscovery cases in the tenant, including status, members, and hold policy details.
Connect & set up
Run these once per session. All scopes are read-only unless the script makes changes.
Connect-ExchangeOnline -ShowBanner:$falseConnect-IPPSSession
Run it
The main script. Copy it, or download the .ps1 and run it from your console.
$ClosedCases = 0 ;$ActiveHolds = 0$Report = [System.Collections.Generic.List[Object]]::new()Write-Host "Finding eDiscovery Cases"$Cases = Get-ComplianceCase -ErrorAction SilentlyContinueWrite-Host $Cases.Count " cases found. Now extracting information."ForEach ($Case in $Cases) {Write-Host "Processing eDiscovery Case:" $Case.Name$CaseMembers = (Get-ComplianceCaseMember -Case $Case.Name | Select Name, WindowsLiveId)$Names = $Null$First = $True# Figure out display name for case managers - nicer than their email addressForEach ($M in $CaseMembers) {If ($First) {$Names = $M.Name$First = $False }Else {$Names = $Names, $M.Name -Join ", " } }If ($Case.Status -eq "Closed") {$ReportLine = [PSCustomObject]@{Case = $Case.NameStatus = $Case.StatusCreated = $Case.CreatedDateTimeClosedBy = $Case.ClosedByClosed = $Case.ClosedDateTimeMembers = $Names }$Report.Add($ReportLine)$ClosedCases++ }ElseIf ($Case.Status = "Open") {$HoldPolicies = (Get-CaseHoldPolicy -Case $Case.Name | % {Get-CaseHoldPolicy $_.Name -Case $_.CaseId -DistributionDetail})ForEach ($Hold in $HoldPolicies) {$HoldRule = Get-CaseHoldRule -Policy $Hold.Name$ActiveHolds++$i = 0 # Section of code to highlight inactive mailboxes that are under hold$Mbxes = $Null$CountMbx = 0ForEach ($H in $Hold.ExchangeLocation) {$Len = $Hold.ExchangeLocation[$i].DisplayName | Measure-Object -Character | Select -Expandproperty CharactersIf ($Hold.ExchangeLocation[$i].DisplayName.Substring(0,1) -eq ".") {$Mbx = ($Hold.ExchangeLocation[$i].DisplayName.Substring(1,$Len - 1)) + " (Inactive); "$Mbxes = $Mbxes + $Mbx }Else {$Mbxes = $Mbxes + ($Hold.ExchangeLocation[$i].DisplayName) + "; " }$CountMbx++$i++ }# Write out the report line$ReportLine = [PSCustomObject]@{Case = $Case.NameStatus = $Case.StatusCreated = Get-Date ($Case.CreatedDateTime) -format gClosedBy = $Case.ClosedByClosed = $Case.ClosedDateTimeMembers = $NamesHold = $Hold.NameHoldEnabled = $Hold.EnabledHoldCreatedby = $Hold.CreatedByHoldModifiedby = $Hold.LastModifiedByMailboxes = $MbxesMailboxCount = $CountMbxSPOSites = ($Hold.SharePointLocation.Name) -Join ","Query = $HoldRule.ContentMatchQueryHoldCreated = Get-Date($HoldRule.WhenCreatedUTC) -format gHoldModifued = Get-Date($HoldRule.WhenChangedUTC) -format g }$Report.Add($ReportLine)}}}CLSWrite-Host "EDiscovery Cases found: " $Cases.CountWrite-Host "Active Cases: " ($Cases.Count - $ClosedCases)Write-Host "Closed Cases: " $ClosedCasesWrite-Host "Active Holds: " $ActiveHolds$Report | Sort Status, Case | Format-Table Case, Status, Created, HoldCreated
Attribution
Author
Office365itpros