Microsoft Purview · eDiscovery
Custodian
Identify and manage custodians (data owners) for eDiscovery cases and track their data sources.
Scope: Custodian management within assigned eDiscovery cases
Permissions
- Custodian Management - Add and remove custodians from cases
- Data Sources - Identify custodian data sources (mailboxes, OneDrive, SharePoint)
- Custodian Holds - Place custodian communications on hold
- Acknowledgments - Track custodian acknowledgment of holds
- Indexing - Manage custodian index and reprocessing
Common use cases
- Tracking employees involved in litigation
- Managing data preservation for departing executives
- Organizing multi-custodian investigations
- Ensuring all relevant data sources are identified and preserved
Best practices
- Document justification for each custodian addition
- Verify all data sources for each custodian
- Send hold notifications promptly upon custodian addition
- Track custodian acknowledgments and follow up on non-responses
- Remove custodians when no longer relevant to reduce scope
Security considerations
- Custodian identification can reveal investigation subjects
- Hold notifications alert custodians to investigations
- Ensure proper communication with legal counsel before adding custodians
- Maintain confidentiality of custodian lists
Common questions
When should I assign the Custodian role?
Assign Custodian when you need to: Tracking employees involved in litigation; Managing data preservation for departing executives; Organizing multi-custodian investigations; and Ensuring all relevant data sources are identified and preserved. It is part of Microsoft Purview and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Custodian role do?
The Custodian role grants permissions including: Custodian Management - Add and remove custodians from cases; Data Sources - Identify custodian data sources (mailboxes, OneDrive, SharePoint); Custodian Holds - Place custodian communications on hold; Acknowledgments - Track custodian acknowledgment of holds; and Indexing - Manage custodian index and reprocessing. See the Permissions section above for the full list.
What are the security risks of the Custodian role?
Key considerations when assigning Custodian: Custodian identification can reveal investigation subjects; Hold notifications alert custodians to investigations; Ensure proper communication with legal counsel before adding custodians; and Maintain confidentiality of custodian lists. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.