TL;DR
Microsoft Purview eDiscovery comes in two types: standard features for holding and exporting evidence, and premium features for reviewing it. It covers email, chats and files in Microsoft 365. Microsoft 365 E3 includes the standard features, which suit most legal holds. Premium features need E5 or an add-on, and they suit large or sensitive reviews. Since August 31, 2025, every search runs inside a case in the Microsoft Purview portal. Use it for lawsuits, regulator requests, HR investigations and Copilot reviews.
Key Takeaways Purview eDiscovery has two types: standard features with Microsoft 365 E3, while premium features need E5 or an E5 add-on. Standard features handle cases, holds, searches and export, while premium features add review sets, OCR, decryption, analytics and privilege detection. The classic Content Search, eDiscovery (Standard) and eDiscovery (Premium) tools retired on August 31, 2025, so every search now belongs to a case. Copilot prompts and responses sit in user mailboxes, so they can be held, searched and exported like email. Search export packages expire 14 days after creation, so plan downloads and chain-of-custody logs around that window. Run a mock matter with known test records before the first real one, and reconcile counts from search to review set to export. The Request Named Email. The Evidence Was in Teams and Copilot. A preservation letter lands on a Tuesday. A supplier is disputing a pricing agreement, and its lawyers want every communication about the deal kept intact.
Its wording mentions email, but the evidence is spread much wider than that. The account manager who negotiated the deal left in March, so her mailbox is the first worry.
Six people argued the pricing in a Teams chat, while the final spreadsheet went through four versions in OneDrive. Then someone remembers that the sales director asked Copilot to summarize the contract before the renewal call.
Each of those items counts as electronically stored information, so your team has to find, hold, review and hand over all of it without gaps. That job belongs to Microsoft Purview eDiscovery. This guide covers its types, its capabilities and the use cases where each feature set fits.
What Is Microsoft Purview eDiscovery? Microsoft Purview eDiscovery is the set of tools in Microsoft 365 for finding, preserving and exporting content that may become evidence. Lawyers also call that content electronically stored information, or ESI. It covers email, chat and documents, as well as the metadata that shows who wrote what, and when.
The tool sits inside the wider Microsoft Purview suite, next to retention, data loss prevention and sensitivity labels. Its own job is narrower and more legal. It answers one question for counsel: can we find everything relevant, prove nobody altered it and hand it over?
Microsoft lists the services that eDiscovery can search :
Exchange Online: mailboxes, including the items Copilot stores there.Microsoft Teams: chats and channel conversations.Microsoft 365 Groups: group mailboxes and their shared sites.OneDrive: personal file storage; collecting earlier file versions needs premium features.SharePoint: team and communication sites.Viva Engage: community posts and conversations.Every matter lives in a case, which holds the people involved, the searches, any holds and the exports. So a lawyer who opens it six months later sees the whole history in one place.
With its record-keeping focus, eDiscovery belongs to information governance more than data management, the split our guide to data governance vs information governance explains.
Where eDiscovery Stops and the Rest of Purview Starts Several Purview tools touch the same content, so teams often expect eDiscovery to do their jobs. It does not. Each tool below has its own main job, and eDiscovery picks up only once a legal matter or investigation exists.
Purview tool Main job Where it meets eDiscovery Data lifecycle management (retention) Keeps or deletes content on a schedule A retention policy can delete content a case needs, so holds exist to stop that Data loss prevention policies Stops sensitive data before it leaves When a DLP alert flags an overshared email or chat message, a search-and-delete clean-up can follow Information Protection Applies sensitivity labels and encryption Premium features decrypt labeled content so reviewers can read it Unified Catalog (formerly Purview Data Catalog ) and Data Map Inventories data sources and lineage Shows where structured data lives, but eDiscovery does not search those sources Insider risk management Detects risky user activity Once confirmed, an insider case can move into eDiscovery for legal review
Keep that split in mind when someone asks eDiscovery to pull a database record or a data warehouse table. Native search covers the Microsoft 365 services listed above, so other systems need their own export or a separate import step.
The split also tells you who owns what. Retention and labels usually sit with the compliance team, while each case belongs to legal.
Datasheet
Elevate Data Governance , Compliance and Security of Your Organization
A Kanerika datasheet on governance, compliance and security services built on Microsoft Purview, from classification and policy design to audit-ready controls.
View the Datasheet → What Changed With the Unified eDiscovery Experience Microsoft rebuilt eDiscovery around a single, case-based experience in the Microsoft Purview portal. The classic Content Search, eDiscovery (Standard) and eDiscovery (Premium) experiences all retired on August 31, 2025 . Since then, legacy guidance applies only to Microsoft 365 operated by 21Vianet.
The change goes deeper than a new screen. Before, searches stood alone, and premium review lived in a separate tool with its own custodians and collections. Now every search belongs to a case, so one case can carry standard work and premium review side by side.
Old Terms and Their Current Names Content Search still survives as an idea. All of its functions now sit in a system-generated eDiscovery case. You can also create a dedicated Content Search case for quick, one-off searches. Both need membership of the eDiscovery Manager or eDiscovery Administrator role groups.
Old term or habit Current term What it means for your team Microsoft Purview compliance portal Microsoft Purview portal Update runbooks, bookmarks and training screenshots Stand-alone Content Search Content Search case Quick searches still exist, but inside a case Collections Search statistics and samples Check counts and sample hits before you commit to review Custodian-centric workflow Case-centric workflow The case, rather than the custodian list, is the unit you manage Jobs Processes Long-running tasks show their status in one place, so nothing runs unseen Manual advanced indexing Just-in-time advanced indexing The service reprocesses partially indexed items when needed Separate export paths Unified export One export flow serves searches as well as review sets
Two of those changes matter most day to day. A search stays editable after you add its results to a review set, so a better query no longer means starting again.
Advanced indexing also runs just in time, when you need it, rather than as a manual job someone had to remember. In practice, both changes remove the most common reason reviews used to stall.
Types of Microsoft Purview eDiscovery: Standard vs Premium Features There are two types of Microsoft Purview eDiscovery, although they are really two feature sets inside the same tool. Standard features come with Microsoft 365 E3. Premium features need Office 365 E5, Microsoft 365 E5 or a related E5 add-on .
The old names, eDiscovery (Standard) and eDiscovery (Premium), still appear in contracts and older guides. Treat them as history. In the current portal you turn premium features on in settings, and then they work inside the same cases as everything else.
Capability Standard features (E3) Premium features (E5 or add-on) Cases, role-based access, holds, KeyQL search, statistics, samples, export, and search and delete Yes Yes Microsoft Graph API Delegated authentication Delegated as well as app-only authentication Review sets, tagging, review set filtering and import of external data No Yes Advanced indexing, OCR, decryption, conversation threading, cloud attachments and SharePoint versions No Yes Analytics, computed metadata, privilege detection, Security Copilot and full reporting No Yes
The table reads as a simple rule. Both types can find and hand over content, but only premium features give you a place to process and review it inside Microsoft 365.
What Every E3 Tenant Gets Standard features cover the whole preserve-and-export path. With them, you can open a case and add members, then place holds, run searches and export the results. That is enough for many litigation holds, as well as most simple production requests.
Searches use KeyQL keyword queries plus conditions such as date ranges, senders and file types. Before exporting, you check search statistics and a sample of results to see whether the query is too broad or misses obvious items.
E3 also includes search and delete, plus Graph API access with delegated authentication. What standard features lack is a place to review, so reviewers work on exported files in another tool and the effort stays manual.
What Premium Features Add (E5 or E5 Add-On) Premium features turn eDiscovery from a collection tool into a review tool. At the center sits the review set, a static copy of search results that reviewers can tag and filter, then query again and export.
Around the review set sit the processing steps that make large reviews workable. For example, advanced indexing reprocesses partially indexed items, and OCR reads the text inside images and scans. Decryption opens content protected with sensitivity labels, so encrypted files do not drop out of review.
Conversation threading collects whole Teams and Viva Engage conversations, while analytics adds email threading, groups near-duplicates and computes metadata. Premium cases can also collect cloud attachments and SharePoint versions, so the reviewed copy matches what the sender actually shared.
Privilege detection changes review economics most, because it flags documents that look privileged from their content and a list of attorneys you supply. Microsoft is clear that it does not replace privilege review , so a lawyer still makes every call. Security Copilot eases the same reading load by drafting KeyQL from a plain-English request and summarizing items in a review set. For automation, app-only Graph API access then lets scripts run without a signed-in user.
Licences, Roles and Pay-As-You-Go Items Licensing catches teams out because it applies to people, not only to the tenant. Admins and users who work with cases need Microsoft 365 Enterprise E3 or E5. The account that runs exports also needs a SharePoint E3 licence, or SharePoint items may not export as expected.
Premium licensing follows the custodian rather than the reviewer. Each person whose data is analyzed with premium features needs E5 or the add-on, but case members do not.
Plan prices and bundles change often, so we keep them in a separate guide to Microsoft Purview licensing . This post sticks to which licence covers which work.
Then come roles, the second gate. The eDiscovery Manager role group has two subgroups , eDiscovery Managers and eDiscovery Administrators. A manager can access only the cases they create, while you add administrators as individual users rather than groups.
Treat these role groups like any other privileged access, so they get the regular reviews described in our guide to data access governance .
Some usage sits outside the subscription. Azure pay-as-you-go billing applies to two items, although Microsoft states no per-GB price on that page.
Item How it is paid for What to set up Cases, holds and searches Enterprise subscription (E3 or E5) Licence every person who works with cases Premium review features E5 or add-on for each custodian in premium review Turn on premium features in settings before the first case Graph API use on E3 Azure pay-as-you-go; only Export API usage is billed, by volume Set up an Azure subscription, then name a billing owner Non-Microsoft 365 AI app data stored in cases Azure pay-as-you-go Billing in place before a matter depends on that data
Which Feature Set Fits Your Matters? The choice turns on what happens after the search. When counsel only needs content preserved and handed over, standard features do the job. But when your team must read, tag and withhold content before it leaves, premium features earn their cost.
Matter type Pick Why Litigation hold, when outside counsel reviews Standard Hold, search and export are enough, since counsel reviews in its own platform Regulator request with a narrow scope Standard Statistics and samples confirm the scope before export Data spill clean-up Standard E3 also includes search and delete Internal HR investigation Premium Review sets, tagging and a small, restricted case team Matter with privileged content Premium Privilege detection and tagging before anything is produced Encrypted or labeled content Premium Decryption keeps protected files in review instead of dropping them High volume with many chat threads Premium Threading, analytics and OCR cut reading time when volumes climb
Take a contract dispute that touches a 40-person sales team, where the first search returns 18,000 items.
When outside counsel will review everything in its own platform, a standard case and a PST export cover the need. If in-house counsel must remove privileged emails before anything leaves, the same matter belongs in a case with premium features turned on.
Talk to Kanerika
Not Sure Which eDiscovery Features Your Matters Need?
Kanerika reviews your licences, roles and typical matters, then maps each one to standard or premium features before you buy or configure anything.
Book a Working Session → Capabilities of Microsoft Purview eDiscovery The capabilities follow the order of a real matter, from opening a case to handing over evidence. Each one below also comes with a short example of how legal and IT teams use it.
Cases and Access Control A case is the container for one matter. It lists members, searches, holds, review sets and exports, while only members can see it.
A contract dispute, a regulator inquiry and an HR complaint should be three separate cases, each with its own small group of members. You add named users, or a role group you belong to; a mail-enabled security group cannot be a case member. Small, named membership leaves a clean record of who could see each matter.
Holds A hold preserves content in place, so users cannot permanently delete it while the matter is open. You can hold a whole mailbox or site on any eligible licence, while query-based, time-bound and custodian-scoped holds need premium licensing .
A new hold can take up to 24 hours to take effect, so place it the day the matter opens. Frontline users on F1 or F3 licences cannot be held at all, so flag them to counsel early.
The duty behind it is real. Under Federal Rule of Civil Procedure 37(e) , a court can act when ESI that should have been preserved is lost. That applies when the party failed to take reasonable steps to keep it, and it cannot be restored or replaced through other discovery.
Preservation also comes up early in a lawsuit. Rule 26(f) of the Federal Rules of Civil Procedure (December 1, 2025 edition) requires the discovery plan to cover issues about preserving electronically stored information.
Remember that a search preserves nothing on its own. Place the hold first, then search.
Search With KeyQL, Statistics and Samples Searches combine keywords with conditions. A good first query is narrow enough to read and broad enough to catch synonyms. You then test it against statistics and a sample before exporting anything.
The two queries below show the pattern for the supplier dispute in the opening scenario. The first targets email about the deal in a six-month window, while the second finds Teams messages that mention it.
(subject:"Atlas supply agreement" OR "Atlas pricing")
AND from:[email protected]
AND sent>=2026-01-01 AND sent<=2026-06-30
participants:[email protected] AND kind:microsoftteams AND "Atlas"Statistics show how many items each condition and location returns. A query that matches 400,000 items flags itself before it costs any review time.
The sample shows real hits, which is the fastest way to spot a keyword that also matches newsletters or email signatures. Record the final query and its counts in the case notes, since you will need them later to prove the export is complete.
Before you trust a query, validate it. Sample the hits to confirm they are relevant, then run the inverse query over the same locations and dates and sample that too. Anything responsive in the second sample means the keywords need widening, and a broader second query gives a count to compare against. Record this recall check in the case notes beside the final query.
Review Sets and Analytics A review set is a frozen copy of selected search results, available with premium features. Reviewers tag items as responsive, not responsive or privileged, then filter by metadata and run further queries inside the set.
Analytics then cuts the pile down. Near-duplicate detection and threading group similar items, so a reviewer reads one email thread instead of forty copies of it.
Volume sets the pace of review. Every item that reaches the set is one more item to tag, so a tighter search is the cheapest way to speed review up.
Review is also rarely a single pass. The Electronic Discovery Reference Model (EDRM) describes practitioners moving between stages rather than through a one-way sequence. In Purview, a new custodian or keyword found in review sends you back to search, and the new results join the review set.
Machine help speeds up triage, but the relevance and privilege calls still sit with people, the same line any AI legal document summarizer has to respect.
Export Export packages the results for hand-off. Mailbox items come out as PST files or as individual messages, while SharePoint and OneDrive documents come out in native format .
Search export packages expire 14 days after creation and are then deleted. Download within that window, and log who downloaded each package and when.
That 14-day expiry applies to search exports, not to exports from a review set. Files blocked by a data loss prevention (DLP) action show in statistics but are left out of the export, a common cause of count mismatches. Note both in the case record, so the count reconciliation in the readiness checklist explains every gap.
Search and Delete Search and delete removes email messages, Teams chat messages and Copilot data found by a search. Typical targets include a phishing email sent to every inbox and a Teams chat message that pasted salary details into the wrong channel. Files are out of its reach, because a file shared in a Teams channel lives in SharePoint.
Deletion needs the Search And Purge role, which Data Investigator and Organization Management hold but eDiscovery Manager does not by default. For AI data, each run removes up to 10 items per mailbox.
It is a clean-up tool with permanent effects, so run it from a case with its own approval trail. Finding where else the same data sits, on the other hand, is the job of sensitive data discovery .
Kanerika Service
Data Governance Services on Microsoft Purview
Kanerika sets up classification, retention and access controls on Microsoft Purview, so sensitive data is known before a clean-up or a legal search starts.
Explore Data Governance Services Copilot and AI App Data as Evidence Microsoft 365 Copilot and other AI apps store their prompts and responses in the user’s mailbox. So eDiscovery can search them and delete them like other mailbox content, and holds on the mailbox also cover them.
This changes the scope of a preservation notice. For example, if a manager asked Copilot to summarize a supplier’s contract, that prompt and the response can be relevant evidence. Security teams weighing this exposure can also find the wider picture in our guide to Microsoft Copilot security concerns .
Data from AI apps outside Microsoft 365 is different. Azure pay-as-you-go bills for storing it in a case, so confirm the billing setup before a matter depends on it.
On-Demand Webinar
Data Security Risks in AI: How Microsoft Purview Protects You
An on-demand Kanerika session on how Microsoft Purview governs data used by Copilot and other AI apps, the same data eDiscovery now treats as evidence.
Watch the Webinar → Microsoft Graph API Automation The Microsoft Graph eDiscovery API lets teams script repeatable work, such as creating cases from a matter-intake form. Delegated authentication works with both feature sets, while app-only authentication needs premium features.
On E3, Azure pay-as-you-go also bills Graph API export use by volume. Start small, as with any compliance automation . One script that opens a case and adds members from a ticket is easier to audit than a full pipeline.
How a Microsoft Purview eDiscovery Case Works, Step by Step A case runs in two phases: one-time setup, then the matter itself. IT and compliance usually share setup, while legal owns the matter steps.
Each step below ends with a check. Do not move on until the check passes, because a gap found at export is far harder to fix than one found at setup.
One-Time Setup These four steps happen once per tenant, then again after major changes such as a new licence plan.
Confirm licences. Case staff have Microsoft 365 E3 or E5. Every person whose data goes into premium review has E5, or E3 plus Microsoft Purview Suite or the eDiscovery and Audit add-on. Check: a licence report covers case staff and custodians before any case opens.Assign role groups. Add case staff to the eDiscovery Manager subgroup and add eDiscovery Administrators as individual users. Check: a test user can open eDiscovery once signed in to the Microsoft Purview portal.Verify the four enterprise apps. Built-in security add-on for on-premises mailboxes, ComplianceWorkbenchApp, MicrosoftPurviewEDiscovery and Office365Zoom must be enabled for sign-in . Check: each app shows sign-in enabled before you go further.Configure settings. Turn on premium features if licensed, set up attorney-client privilege detection, decide on guest users and create tag templates. Check: a test case shows the expected options when you open it.Running the Matter The remaining steps repeat for every matter, so the case record shows the full chain of work from hold to hand-off.
Create the case. Name it after the matter, add named users or a role group you belong to as members, and note the date of the legal hold notice. Check: a non-member still cannot see the case.Place holds. Hold the mailboxes, sites and chats of everyone named in the matter. Check: every named person and location appears on the hold before you search.Create the search. Build the KeyQL query with conditions for dates, people and content types. Check: statistics return results for each location, so none is silently empty.Refine on Statistics and Sample. Adjust terms until the sample shows relevant hits. Check: the case notes hold the final query and its counts.Add results to a review set (premium). Tag, filter and mark privileged items. Check: the review set count matches the search count, unless a note explains the gap.Export. Choose PST or individual messages for mail and native files for documents. Check: you download the package within 14 days and then confirm its counts match.Hand off. Deliver the package to counsel or the requesting party. Check: the recipient confirms receipt and the item count.Close the case with legal approval. Closing the case releases every hold in it, so close only after legal approves the release in writing. Check: the approval sits in the case record before you close.Since steps five to twelve repeat for every matter, a written runbook pays off quickly.
Checklist
Data Governance Checklist
A downloadable checklist for ownership, classification and policy, the groundwork that keeps an eDiscovery runbook accurate.
Get the Checklist → Use Cases for Microsoft Purview eDiscovery Most eDiscovery work falls into a handful of patterns. The table maps each one to its trigger, the capabilities it uses and the feature set that usually fits.
Use case Typical trigger Capabilities used Standard or premium US litigation hold Preservation letter or legal hold notice Case, holds, search, export Standard, unless review stays in-house Regulator or agency request Formal inquiry or subpoena Search, statistics, samples, export Standard, then premium when volumes grow HR or internal investigation Harassment or misconduct complaint Restricted case, holds, review set, tagging Premium Insider risk escalation Insider risk alert, once confirmed Case, holds, review set, analytics Premium Data spill clean-up Sensitive email, chat or phishing message sent widely Search, search and delete Standard AI prompt and response review Question about how people used Copilot on a matter Search of Copilot data, holds, export Standard, then premium for review Privacy access request Individual asks for their personal data Search, statistics, export Standard
How the Patterns Differ in Practice Litigation holds are the everyday pattern for US companies. The trigger is usually a preservation letter or a legal hold notice from counsel, and a standard case with a hold and a saved search covers most of them.
Investigations work differently. The evidence is sensitive, the case team is small, and the findings may never leave the company. Review sets, tagging and restricted membership matter more here than export, so premium features usually fit.
Some investigations start in other tools. For instance, an alert in insider risk management can move into an eDiscovery case, while contract-heavy matters often connect to wider legal process automation .
AI review follows from where Copilot keeps its data. Because Copilot prompts and responses are mailbox content, the same hold and search that cover email also cover how people used Copilot on the deal.
Limitations and Common Mistakes Purview eDiscovery is strong inside Microsoft 365 but weaker at the edges. Most failed matters trace back to a few predictable gaps, so each row below pairs a gap with a control you can prove.
Failure Control Proof Evidence sits outside Microsoft 365 Map every source per matter, then import external data into a review set or use a dedicated platform Legal signs off the source map A query misses partially indexed items Review partially indexed counts, then use advanced indexing (premium) Counts recorded before and after indexing Someone treats a search as a hold Place holds before or alongside the first search Hold list matches the named people Export package expires Download before the 14-day expiry Download entry in the chain-of-custody log A manager cannot find a colleague’s case Managers see only cases they create, so plan who creates each case A role matrix per matter Someone tries to add a mail-enabled security group as a case member Add named users or a role group you belong to instead Member list shows named people or role groups Unexpected Azure charges Set up pay-as-you-go billing before Graph export on E3 or non-Microsoft 365 AI data A named billing owner
Why Reach and Indexing Cause Most Misses Reach is the biggest limit. Native search covers Microsoft 365 content, so evidence in a CRM, a ticketing tool or a file share outside Microsoft 365 needs its own route. A dedicated review platform still makes sense when most evidence sits outside Microsoft 365, or when outside counsel insists on its own tool.
Partially indexed items are the quiet risk. The index may skip parts of large files, unusual formats and protected content, so a query can miss them without any error. The same blind spot shows up in any unstructured data governance program, so measure the partially indexed count on every matter.
Finally, some mistakes are about people. Role and membership rules are strict, so they are easy to get wrong under deadline pressure. Write them down once, so nobody has to rediscover them on a live matter.
Readiness Checklist: Run a Mock Matter Before a Real One The cheapest time to find a gap is before a court deadline. A mock matter therefore uses known test content to prove that search, review and export return what you expect.
Plant a small set of known records: an email, a Teams chat, a OneDrive file with two versions and a Copilot prompt. Then run a full case and see whether each one comes out the other end.
Known-record test: the search finds every planted record, and then the export contains it.Count reconciliation: search, review set and export counts match, unless a written reason covers each gap.Chain-of-custody log: the log records each hold, search, export and download, as well as the person and date.Owner matrix: the matrix names legal, IT and compliance owners for each step, so nobody guesses under pressure.Export window: the team downloads the test package well before the 14-day expiry.Role check: a non-member cannot see the mock case, while every member can.Billing check: any pay-as-you-go item in scope has a named owner and an Azure subscription.Keep the scorecard with the runbook, since auditors and outside counsel may ask how you know the process works.
Score each item pass or fail, and fix every failure before the first real matter. Repeat the test after major tenant changes, such as a new licence plan or a new retention policy.
When you want a wider governance review around the mock matter, the Data Governance Checklist covers ownership, classification and policy. It also pairs well with this eDiscovery-specific test.
How Kanerika Helps With Microsoft Purview eDiscovery Kanerika is a Microsoft Solutions Partner for Data & AI with the Analytics specialization, and it delivers its governance work on Microsoft Purview. Two of its data governance services frame that work: kanComply, a regulatory compliance framework, and kanGovern, which covers governance strategy and enforcement.
Watch on YouTube
Empower Your Business with Kanerika’s Data Governance Solutions | Microsoft Purview Integration
Kanerika’s walk-through of data governance on Microsoft Purview, the cataloging and classification work that tells an eDiscovery search where the evidence actually lives.
For eDiscovery readiness, the method runs in five stages, and each one also ends with something you can check.
Stage What happens Output Assess Review sources, licences, roles and gaps A gap list ranked by legal risk Design Set owners and the rules for preservation, review and hand-off An owner matrix and a case template Configure Set up roles, enterprise apps, settings and the case template A configured tenant with test evidence Pilot Run a mock matter with known evidence, then reconcile counts A scored readiness report Operate Write the runbook, train the case team and set a change process A runbook the legal team owns
Kanerika’s closest delivered example is a Purview data-governance engagement rather than an eDiscovery deployment. A North American healthcare organization needed a central data catalog, a classification framework and Power BI governance dashboards.
The Purview data governance engagement cut data discovery time by 57%, raised compliance adherence by 90% and improved data accessibility by 70%.
That foundation matters for eDiscovery because a search is only as complete as your knowledge of where data lives and how it is classified. Our guides to data governance with Microsoft Purview and data classification best practices cover that groundwork, as well as the data governance principles behind it.
Case Study
90% Compliance Adherence for Healthcare with Purview
Kanerika delivered a Microsoft Purview data-governance program for a North American healthcare organization, with a central catalog, classification framework and governance dashboards, cutting data discovery time by 57%.
Read the Case Study → Bottom Line: Types, Capabilities and Use Cases Microsoft Purview eDiscovery has two types: standard features for preserve-and-export work, while premium features handle review inside Microsoft 365. Its capabilities run from cases and holds through KeyQL search, review sets and export, and they also reach Copilot prompts and responses.
Pick standard features for litigation holds, narrow regulator requests and spill clean-up. Pick premium features instead for investigations, privileged review and high-volume matters. If counsel reviews in its own platform, standard features on E3 carry the matter. If content must be read, tagged or withheld before it leaves your tenant, license premium for every custodian in that review.
Frequently Asked Questions
What is Microsoft Purview eDiscovery used for? Microsoft Purview eDiscovery is used to find, preserve, review and export content that may become evidence in a legal matter or investigation. It searches Exchange Online, Teams, Microsoft 365 Groups, OneDrive, SharePoint and Viva Engage from cases in the Microsoft Purview portal. Legal, compliance and IT teams use it for litigation holds, regulator requests and internal investigations.
What are the eDiscovery roles in Purview? Access runs through the eDiscovery Manager role group, which has two subgroups: eDiscovery Managers and eDiscovery Administrators. Managers see only cases they create. Administrators must be added as individual users, not groups, and mail-enabled security groups work only for the Manager subgroup. Cases accept named users or a role group you belong to, never a mail-enabled security group.
What are common eDiscovery mistakes? Common mistakes include treating a search as a hold, missing partially indexed items and letting an export package expire after 14 days. Teams also add security groups as case members, forget that managers see only their own cases and get surprised by Azure pay-as-you-go charges. A mock matter with known test records catches most of these early.
What is an example of eDiscovery? A supplier disputes a pricing agreement and sends a preservation letter. The legal team opens a case, places holds on the mailboxes, chats and OneDrive files of everyone involved, and searches for the deal name within the contract dates. It checks the counts and sample, exports the results and hands the package to outside counsel.
What are the limitations of Purview eDiscovery? Native search covers Microsoft 365 content, so evidence in other systems needs its own route or an import into a premium review set. Partially indexed items can be missed without an error, and export packages expire after 14 days. Role and membership rules are strict, and some usage, such as Graph export on E3, is billed through Azure.
What is the difference between data discovery and eDiscovery? Data discovery finds and classifies data across an estate so it can be governed, often through a catalog such as Microsoft Purview Unified Catalog. eDiscovery finds specific content for a legal matter, then preserves, reviews and exports it as evidence. Data discovery answers where data lives, while eDiscovery answers what must be handed over for a case.
Will AI replace eDiscovery review? AI speeds up review but does not replace it. Purview’s premium features include privilege detection, analytics that group near-duplicates and Security Copilot support for reviewers. Microsoft says privilege detection does not replace privilege review, and relevance calls still need human judgment. Expect AI to cut reading time while lawyers remain responsible for what is produced.
Does Microsoft 365 E3 include eDiscovery? Yes. Microsoft 365 E3 includes the standard eDiscovery features: cases, role-based access, holds, KeyQL searches with conditions, statistics and samples, export, and search and delete. It also includes Graph API access with delegated authentication. Review sets, OCR, decryption, analytics and privilege detection are not included and need Office 365 E5, Microsoft 365 E5 or an add-on.
How much does Purview eDiscovery cost? The cost is mainly the licence: Microsoft 365 E3 for standard features, and E5 or a related E5 add-on for premium features. Azure pay-as-you-go applies to Graph API export use on E3 and to storing non-Microsoft 365 AI app data in cases. Search, holds and case management stay within the subscription. Current plan prices sit in our licensing guide.
What data can Purview eDiscovery search? Purview eDiscovery searches Exchange Online mailboxes, Microsoft Teams chats and channel messages, Microsoft 365 Groups, OneDrive accounts, SharePoint sites and Viva Engage. Prompts and responses from Copilot and other AI apps are stored in user mailboxes, so they are searchable too. Content held in systems outside Microsoft 365 needs its own export route or an import.
Can Purview eDiscovery search Teams chats? Yes. Microsoft Teams is one of the core services eDiscovery searches, covering chats and channel conversations. You can narrow a query to Teams content with conditions such as participants and message kind, then place holds on the people involved. With premium features, conversation threading rebuilds chat threads, so reviewers read the discussion in context rather than single messages.
Can Purview eDiscovery search Copilot prompts and responses? Yes. Prompts and responses from Microsoft 365 Copilot and other AI apps are stored in the user’s mailbox, so eDiscovery can search them and delete them like other mailbox content. A hold on that mailbox also preserves them. Storing data from AI apps outside Microsoft 365 in a case is billed through Azure pay-as-you-go.
What is the difference between eDiscovery standard and premium features? Standard features, included with Microsoft 365 E3, cover cases, holds, KeyQL searches, statistics, samples, export and search and delete. Premium features, which need E5 or a related E5 add-on, add review sets, advanced indexing, OCR, decryption, conversation threading, analytics, tagging and privilege detection. Both run inside the same cases in the Microsoft Purview portal.
Does an eDiscovery search preserve the results? No. A search only finds content; it does not stop anyone from deleting it. To preserve content, place a hold on the mailboxes, sites and chats involved, either in full or, on premium, narrowed with a query. Place the hold before or alongside the first search, because content deleted before the hold may already be gone when you export.
What are review sets? A review set is a static copy of selected search results, available with premium eDiscovery features. Reviewers tag items as responsive, not responsive or privileged, filter by metadata and run further queries inside the set. Processing such as OCR, decryption and threading runs on review set content. The approved items are then exported for production or hand-off.
How long do eDiscovery export packages stay available? Search export packages expire 14 days after they are created and are then deleted. Plan downloads inside that window, and record who downloaded each package and when in a chain-of-custody log. If a package expires before hand-off, you have to run the export again, and the counts may then differ from the first run.
How do you check whether an eDiscovery export is complete? Reconcile the counts at each stage: the search statistics, the review set count and the items in the export package. Any gap needs a written reason, such as partially indexed items or deliberate exclusions. Running a mock matter with known test records first shows whether every planted email, chat, file version and Copilot prompt comes through.
Which eDiscovery features need a premium licence? Review sets need a premium licence, along with advanced indexing, OCR, decryption of labeled content, conversation threading, analytics, computed metadata and tagging. Attorney-client privilege detection, importing external data into review sets, Security Copilot support and app-only Graph API access are premium too. These require E5 or a related add-on for each custodian reviewed.
Is Content Search still separate from Purview eDiscovery? No. Content Search is no longer a stand-alone tool. All of its functions now sit in a system-generated eDiscovery case, and you can also create a dedicated Content Search case for quick searches. The classic Content Search experience retired on August 31, 2025, with the classic eDiscovery (Standard) and eDiscovery (Premium) experiences.
What licence does Purview eDiscovery require? Admins and users who work with eDiscovery cases need Microsoft 365 Enterprise E3 or E5, which covers the standard features. Premium features follow the custodian: each person whose data goes into premium review needs E5, or E3 plus the eDiscovery and Audit add-on. The account running exports also needs SharePoint E3, or SharePoint items may not export as expected.
How do I create a case in Purview eDiscovery? Open eDiscovery in the Microsoft Purview portal and create a case named after the matter. Add named users or a role group you belong to as members. Then place holds on the people and locations involved and build a search. Before your first case, confirm licences, role groups, the four required enterprise apps and eDiscovery settings.
What is the Purview eDiscovery process? The process starts with setup: licences, role groups, enterprise apps and settings. Each matter then runs through the same steps: create a case, place holds, build a KeyQL search and refine it using statistics and samples. With premium features you add results to a review set, then export, hand off the package and close the case after legal approval.
What is the eDiscovery document review process? Review starts once search results are added to a review set, which needs premium features. Reviewers tag items as responsive, not responsive or privileged, filter by metadata and run further queries inside the set. Threading and near-duplicate analytics reduce reading time. The tagged, approved items are then exported for production to the other side or a regulator.
What is privilege in eDiscovery? Privilege protects communications between a client and its lawyers from being handed over in a legal matter. Purview’s attorney-client privilege detection, a premium feature, flags documents that look privileged using their content and a list of attorneys you supply. Microsoft states that it does not replace privilege review, so a lawyer still makes the final call.
