Compliance
eDiscovery
Microsoft Purview eDiscovery
Microsoft Purview eDiscovery is the set of tools within Microsoft Purview for identifying, holding, searching, and exporting content across Microsoft 365 workloads, including Exchange Online mailboxes, SharePoint and OneDrive sites, Teams chats and channel messages, and Viva Engage.
Why eDiscovery matters in a Microsoft estate
eDiscovery matters because customers, resellers, and procurement teams need evidence that controls are defined, operated, and reviewable. A useful glossary definition should help a reader connect the term to audit preparation, policy work, or repeatable assurance activity.
How eDiscovery shows up in practice
It is used in response to litigation, regulatory investigations, internal HR or compliance investigations, or subject access requests, and is structured across three tiers of increasing capability. eDiscovery (Standard), included broadly across Microsoft 365 plans, provides core case management, content search, and legal hold functionality sufficient for straightforward searches and preservation. eDiscovery (Premium), available with E5 or as an add-on, adds custodian management, legal hold notifications and tracking, review sets with deduplication and near-duplicate detection, communication threading that reconstructs email and chat conversations, and analytics such as email threading and predictive coding-style relevance review.
These matter directly in any matter involving more than a handful of custodians, since manually reviewing unstructured search results at scale is not realistic. A more recent Premium capability extends the same case and review-set workflow to Microsoft Copilot interaction data, reflecting that Copilot prompts and responses over an organisation's own content are themselves discoverable content requiring the same hold and review treatment as email or chat. The core preservation mechanism is the legal hold, which suspends normal retention and deletion for in-scope content the moment it is applied.
This means it must be scoped and applied before, not after, content the organisation is obligated to preserve is deleted or ages out under an existing retention policy. A hold applied late is a common and serious operational failure, since Purview cannot recover content already permanently purged. Search results and legal holds also interact directly with retention labels and policies configured elsewhere in Purview: a hold placed through eDiscovery Premium generally overrides a shorter retention or deletion policy on the same content for its duration. Organisations still need to understand how their configured retention and disposition rules behave in combination with an active hold, though, rather than assuming the hold alone guarantees nothing has already been lost.
For MSPs and IT teams, the most common practical mistakes are underestimating scope, missing custodians whose content lives in shared mailboxes, Teams private channels, or third-party-connected data sources rather than only their primary mailbox, and treating a keyword search as equivalent to a defensible legal hold when the two serve genuinely different purposes. Search finds content, while a hold is what actually prevents it being lost. A matter that later goes to litigation can turn on whether the hold was applied promptly, correctly scoped, and properly documented.