Purview eDiscovery: search, hold, review, export
Microsoft Purview eDiscovery finds, preserves, reviews and exports content from Exchange Online, Teams, Microsoft 365 Groups, OneDrive, SharePoint and Viva Engage so it can serve as evidence in an investigation or legal matter. The decision rule: to find content, search; to stop it from being deleted while you work, put a hold on the case’s data sources; to tag, analyze and cull it, you need Premium features and a review set. Audit answers “who did what”, eDiscovery answers “show me the items”.
Pick the tool by the question being asked
| The question in the stem | Tool |
|---|---|
| Who accessed, shared or deleted something, and when? | Purview Audit |
| Which mailboxes or sites contain this message or file? | eDiscovery search (the old Content search) |
| Preserve content for a legal matter, with a case team | eDiscovery case with a hold policy |
| Review, tag and de-duplicate thousands of items | eDiscovery Premium review set |
| Keep or delete content by policy, for years | Retention policy or label, not a hold |
| Delete a harmful message from many mailboxes | eDiscovery search and delete (Search And Purge role) |
The old compliance portal’s separate Content search solution is gone. Per Microsoft Learn, all Content search functionality now lives inside eDiscovery in the Microsoft Purview portal: a system-generated Content Search case, available by default to the eDiscovery Manager and Administrator role groups, holds the searches. Exam stems that say “Content search” still describe that capability.
One case from request to export
Scenario. Legal at Fabrikam receives a request about “Project Atlas” for two employees and the Atlas team, covering the first quarter of 2026.
- Create the case. A case holds every search, hold and review set for one matter. Learn lists escalation from Insider Risk Management as one trigger for opening a case. See Insider Risk Management.
- Add data sources. The two people (mailbox and OneDrive) and the Atlas Team’s mailbox and SharePoint site. A Teams channel is stored in the team’s mailbox and site; 1:1 and group chats are stored in the participants’ mailboxes, and shared chat files are in the sharer’s OneDrive. Missing the team mailbox is a classic gap.
- Hold. Place the data sources on hold so deletions cannot destroy the evidence. After you create a hold, Learn says it can take up to 24 hours to take effect.
- Search and refine. Keyword Query Language (KeyQL) or the condition builder narrows the results (keywords plus a date range). Statistics show counts and sizes so you can tighten the query before collecting.
- Act on the results. Standard path: export. Premium path: add the results to a review set, then filter, tag, run analytics and export. Search exports expire 14 days after creation, so download them in time.
- Close the case. Closing turns the holds off, and removed locations get a 30-day delay hold so that data is not purged immediately.
Standard versus Premium
Both tiers include searching, keyword queries, statistics, export, role-based permissions, cases, holds, and search and delete. Premium adds:
| Premium only | Why it matters |
|---|---|
| Review sets | A static, Microsoft-hosted copy of collected items to search, filter and tag |
| Advanced indexing | Reprocesses partially indexed items so they are searchable |
| Analytics | Near-duplicate detection, email threading and themes cut review volume |
| Tagging, OCR, conversation threading | Reviewer opinions, text in images, whole chat threads |
| Decryption | Content protected by Microsoft encryption or sensitivity labels is decrypted automatically |
| Import of external data | Review material that is not in Microsoft 365 |
Premium features require an Office 365 E5 or Microsoft 365 E5 license (or a related add-on) for the users whose data is analyzed; Learn notes that case members who only review do not need an E5 license themselves.
Who can do what
The primary role group is eDiscovery Manager, which has two subgroups. An eDiscovery Manager can create cases, add members, create holds, search and export, but can only access cases they created. An eDiscovery Administrator is also a Manager but can access all cases, configure eDiscovery settings, and remove members from a case. Only an administrator can remove case members. Bulk deletion needs the separate Search And Purge role, which Learn assigns by default to the Organization Management role group. The Reviewer role group can open review sets but cannot search or manage cases. Limit the number of administrators, since they can reach sensitive content in any case.
Holds are not retention
An eDiscovery hold exists to preserve content for a specific matter. Learn tells you to use retention policies and retention labels for long-term retention that is unrelated to an investigation; see retention labels versus policies. Holds can be query-based, so only matching content is preserved, and a hold applied through a group is a snapshot of the membership at creation time. For the chain-of-evidence side of this, see digital forensics and chain of custody.
Which exams test this
| Exam | How it appears | Where on this site |
|---|---|---|
| SC-900 | Microsoft compliance solutions (20 to 25%): describe eDiscovery solutions, alongside insider risk and audit. Outline applies from October 21, 2026 | Compliance solutions explained |
| SC-200 | Manage a security operations environment (40 to 45%): investigate Microsoft 365 activities by using Content search in Purview eDiscovery, next to Purview Audit and Graph activity logs. Outline applies from October 21, 2026 | Respond to security incidents |
| SC-401 | Manage risks, alerts, and activities (30 to 35%): perform searches by using eDiscovery. Outline applies from October 28, 2026 | Alerts, audit and eDiscovery |
| AB-900 | Data protection and governance (35 to 40%): search for files and emails with Content search in Purview eDiscovery. Outline applies from October 14, 2026 | Data protection and governance |
How the questions are built
- “Find every mailbox that received this message” is a search. Pair it with a hold only if the stem says preserve.
- “Prevent deletion during an investigation” is a hold, not a retention policy. “Keep for seven years” is the reverse.
- “Tag, de-duplicate, thread” means Premium and a review set. “Export search results” alone is Standard.
- “A manager cannot see a colleague’s case” is expected; only administrators see all cases.
- “Delete a phishing email from all mailboxes” needs the Search And Purge role.
- Audit versus eDiscovery: actions and timelines point to Audit, items and content to eDiscovery. See also DLP for the preventive side.
Question 1. Legal counsel needs to preserve the mailboxes and OneDrive accounts of three employees during a lawsuit, and later review, tag and de-duplicate the collected items. Which approach fits?
- A. A retention policy on Exchange and OneDrive
- B. Purview Audit search and export
- C. A Content search with no case
- D. An eDiscovery Premium case with a hold and a review set
Show answer
Answer: D
A case with a hold preserves the data sources, and a review set with tagging and analytics (near-duplicate detection, email threading) is a Premium eDiscovery capability. A retention policy is for long-term keep or delete rules, not for a specific matter. Audit logs record actions, not item content. A Content search alone neither preserves content nor offers tagging or de-duplication.
Question 2. Two eDiscovery Managers each create a case. One of them asks why they cannot open the other's case. Who can see both cases?
- A. Any member of the Reviewer role group
- B. A member of the eDiscovery Administrator subgroup
- C. Anyone assigned the Search And Purge role
- D. Nobody, because cases are isolated even from administrators
Show answer
Answer: B
An eDiscovery Manager can only access the cases they created. An eDiscovery Administrator can access all cases in the organization. A Reviewer can open review sets only in cases they are a member of. The Search And Purge role is for bulk deletion and gives no case visibility.