eDiscovery is the process of identifying and delivering electronically stored information for investigations and legal cases. Microsoft Purview searches Exchange Online mailboxes, OneDrive, SharePoint sites, Teams and Microsoft 365 Groups. Standard eDiscovery handles searches, holds and export. Premium eDiscovery adds review sets and analytics and needs an E5 license.
Legal and compliance teams ask for emails and files from Microsoft 365 during an investigation. Microsoft Purview eDiscovery is the tool for that request.
Facts follow the Microsoft Learn article on eDiscovery in Microsoft Purview.
What is eDiscovery in Microsoft 365?
Microsoft defines eDiscovery as the process of identifying and delivering electronically stored information as evidence in investigations and legal cases. Purview identifies, reviews and manages Microsoft 365 content for that purpose. Cases are the central unit. Every case contains all searches, holds and review sets for one investigation.
What are the eDiscovery Stages?
| Stage | What happens in Purview |
|---|---|
| Identify | Search content with KeyQL queries and conditions and view statistics and samples |
| Hold | Place content locations on hold to prevent accidental or deliberate deletion |
| Collect | Add results to a review set in a secure Microsoft Azure Storage location |
| Review | Search, filter, tag and analyze review set content (premium) |
| Export | Export search results to a local computer as a package |
Which eDiscovery Edition is Needed?
- Standard. Search, statistics and samples, export, role based permissions, case management, holds and search and delete.
- Premium. Needs an Office 365 E5 or Microsoft 365 E5 subscription or a related E5 add-on. Adds advanced indexing, review sets, OCR, conversation threading, decryption, tagging and analytics.
Which Locations are Searched?
Purview searches Exchange Online mailboxes, OneDrive accounts, SharePoint sites, Microsoft Teams, Microsoft 365 Groups and Viva Engage teams. Content from other Microsoft 365 apps that store data in mailboxes and sites is included.
Who is Allowed to Use eDiscovery?
Access follows role based access control. eDiscovery Manager and Administrator role groups receive Content Search by default. Guest users receive the Reviewer role group. Custom role groups carry specific eDiscovery permissions and case settings decide who opens every case.
Related reading: how to enable multifactor authentication in Microsoft 365 and how to encrypt Outlook emails.
Frequently Asked Questions
What is eDiscovery in Office 365?
It is the Microsoft Purview process for identifying and delivering electronically stored information as evidence.
Is an E5 License Needed for eDiscovery?
Only the premium edition. Microsoft states premium needs an E5 subscription or a related E5 add-on.
Which Microsoft 365 Content is Searched?
Exchange Online mailboxes, OneDrive, SharePoint, Teams, Microsoft 365 Groups and Viva Engage teams.
What is a Hold in eDiscovery?
Holds place content locations under protection so nobody can delete the content by accident or on purpose.
Key Takeaways
- eDiscovery identifies and delivers electronically stored information for investigations.
- Cases organize searches, holds and review sets.
- Workflow stages go from identify to hold to collect to review to export.
- Premium eDiscovery needs an E5 license.
- Role based access controls who opens every case.
Sources and References
Facts follow Microsoft Learn.
- Learn about eDiscovery (Microsoft Learn) learn.microsoft.com