eDiscovery in Microsoft Purview is now a single experience: no separate Content search, eDiscovery (Standard) or eDiscovery (Premium) tool, just cases, with your licenses deciding which features you get. In this post I'll walk through a matter in the order it really runs and point out what behaves differently if you learned the classic tools.
Status (October 2026): Microsoft Learn describes the old compliance portal as retired. eDiscovery runs in the Microsoft Purview portal (purview.microsoft.com), and Content search now lives inside eDiscovery as a system-generated Content Search case. Several review features are still marked preview, so re-check Microsoft's eDiscovery overview before you rely on them.
Prerequisites#
- Licenses. Microsoft states that both the admins and the users who work in cases need a Microsoft 365 Enterprise E3 or E5 license, and that an admin without a SharePoint E3 license may find some SharePoint capabilities limited. Premium features, such as review sets and analytics, need Office 365 E5, Microsoft 365 E5 or a related E5 add-on.
- Permissions. Add investigators to the eDiscovery Manager role group under Settings › Roles and scopes › Role groups. eDiscovery Managers work only in cases they're members of; people in the eDiscovery Administrator subgroup can see every case in the organization. Members of Organization Management can also create cases. Use a custom role group when some people should search but never export. If the portal says you don't have access, see Purview roles and role groups.
- Audit and PowerShell. eDiscovery activity is written to the audit log, and the checks below use Security & Compliance PowerShell (Connect-IPPSSession help).
What changed from classic eDiscovery#
| Classic tools | Unified eDiscovery |
|---|---|
| Content search was a separate tool | A system-generated Content Search case, open to all eDiscovery Managers and Administrators; restrict it through that case's members |
| Custodians and noncustodial sources drove the workflow | The case is the organizing unit; you add people, groups and sites as data sources |
| Collections, immutable once added to a review set | Search statistics; searches stay editable even after results go to a review set |
| You reindexed partially indexed content yourself | Advanced indexing runs automatically for statistics, review set additions and exports |
| Jobs | Processes, tracked in the Process report |
| Different Standard and Premium export formats | One export structure for both |
Every case created in the Purview portal shows the Premium case type whatever your license; the type only maps cases back to the old portal. Some older cases carry a Limited format tag, and advanced indexing isn't available in them.
Step-by-step#
1. Review the global settings once#
The global eDiscovery settings control premium features for new cases, attorney-client privilege detection, guest access and tag templates. Read Microsoft's eDiscovery billing page too: depending on the data in your cases, storage charges can apply.
2. Create the case#
In the Microsoft Purview portal, open the eDiscovery solution and select Cases › Create case. Enter a case name (it must be unique in the organization) and an optional description, then select Create. You're added as a member automatically and land on the Searches tab. Open Case settings to add the other members and role groups and to set the data source, search and analytics, and review set options. Use the Number field for your matter or docket number.
3. Add data sources#
Data sources are the locations the case reuses in every search and hold. Add a person and the case includes their associated resources, such as their mailbox and OneDrive; data source mapping can also add a group's site and show frequent collaborators. Add SharePoint sites and Microsoft 365 groups for shared content. For a one-off location, add it to a single search or hold instead of the whole case.
4. Place holds#
On the Hold policies tab, create a hold policy and add the data sources. Leave the query empty to preserve everything in those locations, or add one to create a query-based hold that preserves only matching content. Don't report the data as preserved until distribution has finished (see Verify). Searches can then simply target the locations on hold.
5. Search and generate statistics#
Create a search on the Searches tab, add data sources, and build the query from keywords (KeyQL) plus conditions such as dates, participants or file types. Run it for statistics: estimated item count and size, the locations with the most hits and the items each query returns. Then generate a sample to look at real items before you commit. Refine and rerun freely; each statistics run also reindexes partially indexed items.
6. Review in a review set#
Add the search results to a review set. The items are copied to a secure, Microsoft-provided Azure Storage location, and content protected by Microsoft Purview Message Encryption, sensitivity labels or Azure Rights Management is decrypted automatically. You can include the target files of cloud attachments, all versions of SharePoint documents and whole Teams or Viva Engage conversation threads. Inside the review set, filter and save queries, tag items (for example "nonresponsive"), and run analytics such as near-duplicate detection, email threading and themes; OCR makes text in images searchable.
7. Export#
Export straight from a search (mailbox items as PST files or individual messages, SharePoint and OneDrive documents as native copies) or from a review set (selected documents, all filtered documents or all documents). Search export packages expire 14 days after creation, so download them promptly. If an export fails or doesn't match the statistics, use eDiscovery search and export errors and the eDiscovery error quick reference.
8. Close the case deliberately#
Closing or deleting a case turns off all of its holds, and content that was on hold is released. Confirm with legal first, then use Actions › Close case. A case with holds shows Closing while they're removed; Closed with errors or Pending delete usually means a hold policy didn't update, so fix it and redistribute the policy.
Verify#
Check hold distribution in Security & Compliance PowerShell, then confirm the hold on a mailbox:
Connect-IPPSSession
Get-CaseHoldPolicy -Case "Contoso-HR-0142" -DistributionDetail |
Format-List Name, Enabled, DistributionStatus, DistributionResults
# Exchange Online PowerShell: eDiscovery case holds appear as UniH<GUID>
Connect-ExchangeOnline
Get-Mailbox -Identity adele@contoso.com | Format-List InPlaceHoldsGood looks like DistributionStatus : Success with no failed locations in DistributionResults, and a UniH entry in InPlaceHolds for each held mailbox. Then compare the search statistics with the export's summary report, and search the audit log for the case's eDiscovery activities to confirm they were recorded.
Tips & gotchas#
- Lock down the Content Search case. Every eDiscovery Manager and Administrator can see it by default; trim its members if searches there are sensitive.
- Holds aren't retention. A case hold lasts as long as the case. For long-term keeping, use retention policies; see retention policies, labels and litigation hold. Held SharePoint and OneDrive content can grow the Preservation Hold library.
- Insider risk escalation. Insider Risk Management cases can be escalated into eDiscovery for legal review; see Insider Risk Management setup.
- Search and delete. eDiscovery can also delete harmful email, Teams chat messages and Copilot and AI app data. Check the query's statistics first; deletion can't be reviewed afterwards.
- Automation. The Microsoft Graph eDiscovery API (
/security/cases/ediscoveryCases) supports delegated and app-only authentication for scripted case work.
