Microsoft Purview eDiscovery for Microsoft 365

Advanced eDiscovery has evolved into Microsoft Purview eDiscovery Premium. For organizations that must preserve, search, review, and export Microsoft 365 data for litigation, investigations, regulatory requests, or internal policy obligations, Purview now provides a more complete compliance workflow across Exchange, SharePoint, OneDrive, Teams, and other supported Microsoft 365 sources.

From Advanced eDiscovery to Microsoft Purview eDiscovery

The former Microsoft 365 Advanced eDiscovery experience is now part of Microsoft Purview eDiscovery, managed from the Microsoft Purview portal rather than the old Security & Compliance Center. The core purpose remains the same: help organizations identify relevant data, preserve it, reduce noise, review content, and export defensible results. The terminology and workflow have changed since 2019. Current Purview eDiscovery work typically revolves around cases, permissions, custodians, non-custodial data sources, holds, collections, review sets, analytics, tagging, error remediation, and export.

Standard vs. Premium eDiscovery

Microsoft Purview eDiscovery Standard is designed for core search, case management, legal hold, and export scenarios. Microsoft Purview eDiscovery Premium adds capabilities for more complex investigations, including custodian management, legal hold notifications, advanced collections, processing, review sets, analytics, tagging, redaction workflows, and richer export options. Licensing depends on your Microsoft 365 plan. Many organizations access Premium through Microsoft 365 E5, Office 365 E5, or eligible Microsoft 365 E5 Compliance add-ons. If you buy through CSP, confirm New Commerce Experience terms, annual or monthly commitment, add-on eligibility, and whether every user whose data is processed requires the appropriate compliance license.

Plan permissions before you create a case

Before starting an eDiscovery matter, assign roles using least privilege. In Microsoft Purview, eDiscovery access is controlled through role groups such as eDiscovery Manager and eDiscovery Administrator. eDiscovery Managers can be scoped to specific cases, while administrators have broader control. Identity and access governance should use current Microsoft Entra ID practices, including strong authentication, privileged access controls, and regular access reviews for legal, compliance, HR, and IT personnel involved in investigations.

Create a case and define the scope

A case provides the container for an investigation or legal matter. After creating a case in the Microsoft Purview portal, define who can access it, identify custodians, add non-custodial data sources when needed, and document the purpose and scope of the request. Supported sources commonly include Exchange Online mailboxes, SharePoint Online sites, OneDrive for Business accounts, Microsoft Teams messages and files through their underlying Microsoft 365 storage locations, and other Purview-supported workloads. Because Microsoft adds and changes workload support over time, verify source-specific support before relying on a workflow for a regulated matter.

Preserve data with holds

Legal hold is one of the most important eDiscovery steps. In Purview eDiscovery, you can preserve relevant custodial and non-custodial data so it is not permanently deleted while the matter is active. Premium workflows can also support custodian communications, including hold notices, reminders, acknowledgments, and release notices. This helps legal and compliance teams track who has been notified and whether custodians have acknowledged their obligations. eDiscovery holds should be coordinated with broader Microsoft Purview retention, records management, and information governance policies to avoid conflicting assumptions about preservation.

Run collections and validate the results

After data sources are identified and preservation is in place, create collections to search for potentially relevant content. Use keywords, dates, participants, locations, and other conditions carefully. The goal is not simply to collect everything; it is to create a defensible search strategy that is broad enough to capture relevant information and narrow enough to reduce unnecessary review volume. Preview and statistics help validate whether the collection is returning expected results before content is committed to a review set.

Use review sets, analytics, and tagging

In Premium workflows, collected content can be added to a review set for processing and analysis. Review sets replace the older concept of working sets and load sets used in earlier Advanced eDiscovery interfaces. Processing extracts metadata and prepares items for review. Analytics can help reduce duplicate content, identify email threads, group related material, and support faster review. Reviewers can tag items, apply issue codes, mark relevance or privilege, and use redaction where appropriate before production. These features help teams focus on the documents that matter rather than manually reviewing every duplicate or low-value item.

Remediate processing errors

Not every item can be processed cleanly on the first pass. Password-protected files, corrupted documents, unsupported formats, and encrypted content may generate errors. Purview eDiscovery provides error reporting so the team can decide whether remediation is necessary. In some matters, the correct response is to repair or replace files and reprocess them. In others, it may be sufficient to document the errors and include them in the matter record. The decision should be based on legal, regulatory, and organizational requirements.

Export and produce content

Once review is complete, export the required content in the format that fits the receiving party’s needs. Smaller requests may involve downloading selected documents, while larger productions may require structured exports with metadata and load files for legal review platforms. Before exporting, confirm redactions, privilege calls, tags, and exclusion decisions. Also confirm who is authorized to receive the export and how it will be transferred securely.

How eDiscovery fits into Microsoft Purview compliance

eDiscovery is only one part of a complete compliance program. It works best when supported by sound information governance, retention policies, audit logging, sensitivity labeling, Teams and SharePoint governance, and strong identity controls. Organizations that wait until a subpoena, investigation, or regulatory request arrives often discover that data ownership, retention, permissions, and collaboration sprawl make eDiscovery harder than it needs to be. A proactive Purview implementation reduces friction when urgent requests appear.

Key takeaways

• Microsoft 365 Advanced eDiscovery is now positioned as Microsoft Purview eDiscovery Premium.
• Use the Microsoft Purview portal and current workflows: cases, custodians, holds, collections, review sets, analytics, tagging, remediation, and export.
• eDiscovery Standard covers core search, hold, and export scenarios; Premium is intended for more complex legal and investigation workflows.
• Licensing should be reviewed carefully, especially for Microsoft 365 E5, E5 Compliance add-ons, and CSP New Commerce Experience commitments.
• Successful eDiscovery depends on more than the tool itself: permissions, retention, audit, Teams and SharePoint governance, and Microsoft Entra ID controls all matter.

Need help assessing Microsoft Purview eDiscovery licensing, configuration, or readiness? IT Partner can help you plan and implement Microsoft Purview compliance capabilities across your Microsoft 365 environment.