First page of Microsoft's 100,000-partner directory, sorted by responsiveness Microsoft Solutions Partner — Security, Modern Work, Infrastructure, App Innovation Microsoft partner since 2006 1,100+ organizations under management
Home/Services/Microsoft Purview eDiscovery Premium Implementation
ImplementationCompliance

Microsoft Purview eDiscovery Premium Implementation

Microsoft Purview eDiscovery Premium Implementation is a fixed-fee, two-week engagement that turns the eDiscovery Premium capability your Microsoft 365 E5-level licensing already includes into a working legal-hold and discovery operation: least-privilege permissions and case structure, custodian workflows with hold-notification communications, a legal hold policy designed with your counsel, the collection-to-review-set process configured end to end, and hands-on training for the legal and IT pair who will run cases after we leave. One boundary is stated up front and repeated throughout: IT Partner is not a law firm — we configure and enable the platform and teach your team to operate it; the legal review itself, privilege calls, and litigation strategy stay with your counsel, always.

Timeline 2 weeksService owner Dan ApplebyMicrosoft 365Microsoft Purview

What this engagement is

Organizations that face litigation regularly — in-house legal teams, law firms, regulated industries — usually already own Microsoft's premium eDiscovery tooling through E5-level licensing, and usually still handle a preservation notice the hard way: IT exports PSTs, legal loses defensibility, and nobody can say precisely who was on hold, since when, or whether they acknowledged it. eDiscovery Premium in Microsoft Purview solves exactly that — custodian management, documented hold notifications with reminders and escalations, targeted collections, and review sets with analytics — but it does not configure itself, and a half-configured eDiscovery process is worse than none, because it produces the appearance of defensibility without the substance. This engagement implements the platform properly and, just as importantly, sets up the operating discipline around it. Permissions come first: eDiscovery access is among the most sensitive in the tenant, since it can read anyone's mail and files, so role groups and case-level access are designed least-privilege and documented. Then the machinery: a case structure and naming convention that matches how your matters actually arrive, custodian workflows tested end to end, hold-notification templates with reminder and escalation schedules, and the collection-to-review-set pipeline — advanced indexing, collection estimates, committing collections to review sets, and the analytics your reviewers will lean on: near-duplicate detection, email threading, and themes. The legal hold policy itself is designed in a working session with your counsel: what triggers a hold, its default scope across mailboxes, OneDrive, SharePoint, and Teams, who approves it, and how and when holds are released. We bring the platform knowledge; your lawyers bring the legal judgment — the policy is theirs, executable by design. Everything runs in the unified Microsoft Purview eDiscovery experience in the Purview portal — the classic eDiscovery tools were retired in 2025, and teams trained on the old case pages need the updated workflow, which the training covers. The engagement closes with a pilot case walked end to end and two training sessions for the legal/IT pair, because the deliverable that matters is not the configuration — it is your team running the next matter without us. What this engagement is not: we are not a law firm, we do not conduct document review, make privilege or responsiveness determinations, or advise on litigation strategy — configuration and enablement only, with the legal work remaining your counsel's. If what you need today is a single defensible search rather than a standing capability, Microsoft Purview eDiscovery Search Assistance is the $500 engagement for that. For how we think about compliance-ready information architecture in the legal vertical, see How law firms should structure SharePoint for compliance.

Success criteria

01eDiscovery permissions are assigned least-privilege and documented: who holds which Purview role group, why, and how case-level access keeps matter teams inside their own cases.
02A case structure, naming convention, and intake checklist exist and match how your matters actually open — tested against the pilot case, not just written down.
03The custodian workflow runs end to end on the pilot case: custodian added with associated data sources, hold applied, hold notice issued and acknowledged, and the acknowledgment visible in the case record.
04The legal hold policy is documented and approved by your counsel: triggers, default scope, approval authority, release process, and the licensing rule for custodians recorded alongside it.
05Hold-notification templates with reminder and escalation schedules are configured and were exercised in the pilot.
06A collection was run against pilot custodians, committed to a review set, and the analytics your reviewers will use — near-duplicates, threading, themes — demonstrated on real (non-privileged, agreed) content.
07Export and production settings have an agreed baseline your team can reproduce.
08Both halves of the legal/IT pair completed training and each ran the core workflow hands-on; the runbook covers what they exercised.
09Licensing is verified: eDiscovery Premium entitlement confirmed at the tenant, and every intended custodian population covered by the custodian licensing rule or flagged with the gap named.

What you receive

Licensing and readiness assessment: confirmation of eDiscovery Premium entitlement (Microsoft 365 E5/A5/G5, E5 Compliance add-on, or eDiscovery and Audit add-on), the custodian licensing check across your intended custodian population, and current-state review of any existing cases, holds, or retention policies that interact with holds.
Permissions design and implementation: Purview role-group assignments (eDiscovery Manager versus eDiscovery Administrator, and supporting roles) built least-privilege, case-level access model, and an access-review note for your governance cadence.
Case architecture: naming convention, case templates and settings defaults, and a matter-intake checklist mapping how a new legal matter becomes a correctly configured case.
Legal hold policy design workshop with your counsel, and the written policy that results: hold triggers, default custodian and data-source scope (Exchange, OneDrive, SharePoint, Teams), approval authority, review cadence, and release procedure.
Custodian workflow configuration: custodian and data-source association procedure, hold-notification templates (initial notice, reminders, escalations) in your language and letterhead tone, and the acknowledgment-tracking view your legal team will actually check.
Collection-to-review-set standard operating procedure: search construction, collection estimates, advanced indexing behavior, committing to review sets, review-set query and tagging conventions, and analytics configuration (near-duplicate detection, email threading, themes).
Export and production baseline: agreed export settings and a documented, repeatable export procedure.
Pilot case executed end to end on agreed non-privileged content, with findings folded back into the SOPs.
Two training sessions — one oriented to legal (custodians, holds, notifications, review sets, tagging), one to IT (permissions, collections, indexing, exports, troubleshooting) — plus the operations runbook covering both.
Post-implementation summary: what was configured and why, open decisions with owners, and the recommended review cadence.

How the work unfolds

Week 1, days 1–2 — Assess and design

Verify licensing at tenant and custodian level, review existing holds and retention interactions, assign role groups least-privilege, and agree the case architecture and pilot-case scope.

Week 1 — Legal hold policy workshop

Working session with your counsel and IT together: hold triggers, default scope across Exchange, OneDrive, SharePoint, and Teams, approval authority, and release procedure. We contribute platform mechanics and defensibility features; your counsel owns every legal judgment. Scheduling this session early is the schedule's critical path.

Week 1–2 — Configure

Build case templates and settings defaults, custodian and data-source workflows, hold-notification templates with reminder and escalation schedules, review-set conventions and analytics settings, and the export baseline.

Week 2 — Pilot case

Run one case end to end on agreed non-privileged content: open the case from the intake checklist, add custodians, apply the hold, issue and acknowledge notifications, collect, commit to a review set, exercise the analytics, and export. Findings go back into the SOPs the same week.

Week 2 — Train and hand off

Two training sessions for the legal/IT pair, runbook delivery, and the post-implementation summary with open decisions and the review cadence. Success is your team opening the next real matter without calling us — and knowing exactly when they should.

Prerequisites

Licensing that includes eDiscovery Premium: Microsoft 365 E5, A5, or G5 — or Microsoft 365 E3-level licensing with the E5 Compliance add-on or the E5 eDiscovery and Audit add-on. We verify this on day one; if your tenant only reaches the standard eDiscovery tier, we will say so before any work is billed and lay out the options.
Custodian licensing understood and accepted: users whose data you place under hold as custodians must themselves hold an E5-level license or a qualifying add-on — the people managing cases and reviewing data do not need one. We check your intended custodian population against this rule as part of the assessment.
A named participant from your legal function — in-house counsel, outside counsel, or legal ops — with authority to make hold-policy decisions, available for the week-one workshop and the training. Without this person the engagement produces configuration without an operating policy, which we consider a failed outcome and will not quietly deliver.
A named IT participant who will own the platform side after handoff.
Administrative access sufficient to configure Purview eDiscovery settings and role groups.
Agreement on pilot-case content: a realistic, non-privileged data scope we can collect and review against without touching live matter strategy.
Disclosure of existing legal holds, retention policies, and any regulatory preservation obligations already in force, so new configuration does not disturb them.

Who does what

IT Partner

  • Verify licensing at tenant and custodian level and document gaps honestly.
  • Design and implement least-privilege eDiscovery permissions and the case architecture.
  • Facilitate the legal hold policy workshop, contributing platform mechanics and documenting the policy your counsel decides.
  • Configure custodian workflows, hold-notification templates and schedules, review-set conventions, analytics, and the export baseline.
  • Execute the pilot case end to end with your team participating.
  • Deliver both training sessions, the runbook, and the post-implementation summary.

Your team

  • Provide the legal participant with hold-policy authority and the IT platform owner, and keep both available for the workshop, pilot, and training.
  • Make every legal judgment: hold triggers and scope, custodian selection on real matters, privilege and responsiveness calls, and release decisions.
  • Provide administrative access and approve the permissions design.
  • Choose and approve the pilot-case content scope.
  • Disclose existing holds, retention policies, and preservation obligations.
  • Own all licensing purchase decisions arising from the assessment.
  • Operate the process after handoff, using the runbook and the agreed review cadence.

What's not included

Legal services of any kind. IT Partner is not a law firm: we do not conduct document review, make privilege, responsiveness, or relevance determinations, provide legal advice, draft or serve legal process, or opine on the defensibility of your positions. The platform is ours to configure; the law is your counsel's, entirely and always.
Per-case litigation support after handoff — running collections, managing review sets, or producing exports for specific live matters is available as a separately quoted time-and-materials follow-on, with the same boundary: we drive the tooling, your counsel makes every legal call.
One-off searches without the Premium build — that is the separate Microsoft Purview eDiscovery Search Assistance engagement at $500 per project.
Managed document review, review staffing, or paralegal services — engage a review provider for those; we will happily configure the review sets they work in.
Migration of matters or work product from third-party review platforms into Purview.
Discovery of data outside Microsoft 365 — file servers, endpoints, third-party SaaS, and personal devices are outside what Purview eDiscovery reaches and outside this scope.
Microsoft licensing purchases, including E5-level licenses or add-ons the assessment identifies as missing.
Broader Microsoft Purview implementation — retention and records management is Microsoft Purview Data Lifecycle Management Implementation, data loss prevention is Configure and Enable DLP Policies, and insider threat monitoring is Microsoft Purview Insider Risk Management Implementation.

Limitations & technical notes

!The not-a-law-firm boundary is structural, not small print: every workflow this engagement builds is designed so that legal judgments — what to hold, whom to add, what is privileged, when to release — are made by your counsel inside a process, rather than by an IT admin under deadline pressure. If you need the legal work itself, you need a law firm; we will work alongside yours gladly.
!eDiscovery Premium reaches Microsoft 365 data: Exchange mailboxes, OneDrive, SharePoint, and Teams (including chat, which is preserved and collected subject to Microsoft's documented behaviors for chat data). It does not reach file servers, endpoints, or non-Microsoft systems — matters spanning those need collection tooling beyond this platform, and the runbook says so rather than letting the gap surface mid-matter.
!Analytics — near-duplicates, threading, themes — and review-set behaviors operate within Microsoft's documented service limits on collection sizes, indexing, and processing times; large or unusually shaped collections can take material processing time, which the SOP teaches your team to anticipate rather than discover during a deadline.
!A hold preserves data from the moment it applies; it is not retroactive to data deleted before it, and it interacts with retention policies in documented but non-obvious ways — the policy workshop covers these interactions explicitly because they are where defensibility quietly fails.
!The two-week schedule's critical path is your counsel's availability for the week-one policy workshop; the fixed fee covers the scope on this page, and per-case support after handoff is separately quoted time-and-materials.
!Microsoft continues to evolve the unified Purview eDiscovery experience — the classic tools were retired in 2025, and features move. The training targets the current experience and teaches your team to work from the process, not from screenshot memory. Technical content reviewed August 2026.

Frequently asked questions

Are you lawyers? Will you review the documents for us?

No, and no — and we put it this bluntly because the boundary protects you. IT Partner is a Microsoft consultancy, not a law firm: we configure eDiscovery Premium, build the workflows, and train your team, but we never conduct the legal review, never make privilege or responsiveness calls, and never provide legal advice. Every workflow we build routes those judgments to your counsel by design. If a vendor offers to both run your platform and exercise legal judgment inside it, ask them which license they do that under.

What licensing do we need for eDiscovery Premium?

The Premium capability comes with Microsoft 365 E5, A5, or G5, or is added to E3-level licensing via the E5 Compliance add-on or the narrower E5 eDiscovery and Audit add-on. There is a second rule that surprises people: users whose data you place under hold as custodians must themselves be licensed at that level — while the case managers, lawyers, and reviewers working the case do not need an E5-level license at all. We verify both the tenant entitlement and your intended custodian population on day one, before configuration starts.

Does everyone in the company need E5 for this to work?

No — only the people whose data goes under Premium holds as custodians. A common pattern in litigation-heavy organizations is E5-level licensing for the populations most likely to become custodians — executives, finance, sales leadership — with the rest of the tenant on E3. The assessment maps your realistic custodian population against your licensing and names any gap plainly, so the licensing decision is made on facts rather than on a worst case.

What does Premium actually add over the standard eDiscovery we already use?

The operational layer that makes discovery defensible at scale: custodian management with associated data sources, hold notifications with tracked acknowledgments, reminders, and escalations, advanced indexing of partially indexed content, collections with estimates, and review sets — a working space where near-duplicate detection, email threading, and theme analytics cut the volume your reviewers actually read. Standard-tier eDiscovery gives you cases, holds, searches, and exports; Premium turns that into a process a legal team can run and defend.

What is a review set, and why does it matter to our lawyers?

A review set is a static, secured working copy of collected content inside the case — the collection is committed to it, and from that point your reviewers query, tag, annotate, and analyze without touching the live mailboxes and sites the data came from. That separation is precisely what counsel wants: a stable corpus with analytics (threading, near-duplicates, themes) that reduces review volume, and a place where tagging conventions — which we configure and teach — organize the work before anything is exported or produced.

How is this different from your $500 eDiscovery Search Assistance service?

Scale and permanence. Search Assistance is us running one defensible search for you — scope, search, summary report, results — the right size for an occasional request. This engagement builds the standing capability: permissions, case structure, custodian and hold workflows, review sets, and a trained legal/IT pair, so discovery is something your organization does rather than something it buys one search at a time. If holds arrive more than occasionally, the build pays for itself quickly.

What happened to the old eDiscovery pages we were trained on?

Microsoft retired the classic eDiscovery experiences in 2025 and consolidated everything into the unified eDiscovery experience in the Purview portal — content searches now live inside cases, and the case workflow changed materially. Teams trained on the classic pages genuinely do need the updated workflow, which is part of why the training sessions and runbook target the current experience and teach the process rather than the screenshots.

What is the difference between a legal hold and our retention policies?

Retention policies apply to broad content classes on a schedule, for governance; a legal hold preserves specific custodians and sources indefinitely because of a specific matter, and it overrides deletion — including deletion a retention policy would otherwise perform — for the data in its scope. The two interact in ways that are documented but genuinely non-obvious, and holds are not retroactive to data deleted before they applied, which is why speed from trigger to hold matters. The policy workshop covers these interactions explicitly; broader retention design is the separate Data Lifecycle Management engagement.

Can it preserve and collect Teams chats?

Yes — Teams chat and channel content for custodians can be preserved by holds and collected into review sets, where threading makes conversations reviewable, subject to Microsoft's documented behaviors for how chat data is stored and processed. The pilot case can include Teams content deliberately, because chat is where modern matters increasingly live and where your team should see the workflow before a real deadline does.

What do the hold notifications actually do?

They turn 'we told people to preserve documents' into evidence. When a custodian is added, the platform issues your hold notice, tracks acknowledgment, sends reminders on the schedule you set, and escalates non-responders — all recorded in the case. We configure the templates in your language and tone, with your counsel approving the wording, and the acknowledgment-tracking view becomes the artifact your legal team checks instead of a spreadsheet and hope.

Can you run cases for us after the implementation?

The platform side, yes — as a separately quoted time-and-materials follow-on we can drive collections, review-set mechanics, and exports for specific matters when your team is stretched. The boundary never moves, though: custodian selection on real matters, privilege and responsiveness review, and every other legal judgment remain with your counsel. The implementation is deliberately built so you do not depend on us for routine cases; the follow-on exists for surge, not for substitution.

What about data outside Microsoft 365 — file servers, endpoints, other SaaS?

Purview eDiscovery reaches Microsoft 365 data, and this engagement is honest about that edge: file servers, local devices, and third-party systems are outside its collection reach. For most Microsoft-centric organizations that covers the bulk of discoverable material; for matters that span other systems, your counsel will need collection tooling or vendors for those sources, and the runbook names the boundary so it is planned for rather than discovered mid-matter.

Didn’t find your question?

Ask it here. A real engineer answers by email within one business day — and if it’s a good one, it becomes part of this page so the next person finds it.

Answered by a person, one time, to your inbox. Nothing you type here is published without a human reviewing and anonymizing it first.

Often combined with

$3,950 per project
2 weeks
Book an eDiscovery call