eDiscovery problems rarely arrive as a neat error code. More often they're counts that don't add up, items that won't preview, lines in the export package reports or a hold stuck in Pending. This quick reference collects the behaviors and messages Microsoft documents for eDiscovery in the Microsoft Purview portal: partially indexed items, encrypted content, export package messages and hold distribution result codes, each with the usual cause and the first thing to check.
Codes in this quick reference
Partially indexed count is 0 for a search of SharePoint or OneDrive only (statistics exclude sites)Search statisticsPartially indexed items can't be previewedSearch previewExport has no partially indexed items although the search statistics showed someExport packagePartially indexed items from outside the queried path or folder appear in the exportExport packageExclude partially indexed items in locations without search hits has no effect on a single-location searchExport dialogDate range doesn't exclude partially indexed itemsSearch statistics / exportPartially indexed items missing from the partially indexed PST when the query has no keywordsExport package (PST)Partially indexed items from mailboxes or sites without search hits aren't exportedExport package
+ 21 more codes in the tables below.
Note: The classic Content search, eDiscovery (Standard) and eDiscovery (Premium) experiences were retired on August 31, 2025, so this page describes the current eDiscovery experience. Search errors such as "Location is ambiguous", "Recipient not found", CS007, the 500 error, the 50-job limit and the main FailedToExportItem messages are covered step by step in Microsoft Purview eDiscovery: search statistics, partially indexed items and export errors and aren't repeated here.
How to read these codes#
- Search statistics are an estimate, not a count. Partially indexed totals in the statistics cover Exchange only.
- Export package reports tell you what actually happened:
Export Summary <timestamp>.csv,Export Warnings and Errors.csv,Skipped Items.csvandtrace.log. - Search-time and export-time settings are independent. The partially indexed choice on the search only shapes statistics and previews; the choices in the export dialog decide what the package contains.
- A location is a whole mailbox or a whole SharePoint or OneDrive site, never a folder, library or URL prefix. That matters for every partially indexed option.
- Hold distribution shows in the hold's status in the portal and in PowerShell. Each failed location has a
ResultCode, a message and aLastResultTime:
PowerShell
Connect-IPPSSession
Get-CaseHoldPolicy -Identity "<hold policy name>" -DistributionDetail |
Select-Object -ExpandProperty DistributionResultsPermissions matter too: case work needs the eDiscovery Manager role group, listing every case's exports needs eDiscovery Administrator, and decrypting rights-protected email needs the RMS Decrypt role, which the eDiscovery Manager role group has by default.
Partially indexed items#
Partially indexed items are mailbox items and SharePoint or OneDrive documents the index couldn't fully read. Microsoft notes that most organizations have less than 1% of content by volume, and less than 12% by size, partially indexed.
| Code or message | Meaning | Usual cause | First check |
|---|---|---|---|
| Partially indexed count is 0 for a search of sites | Statistics don't include SharePoint and OneDrive partially indexed items | By design | Include partially indexed items at export or when adding to a review set |
| Partially indexed item can't be previewed | Preview isn't available for these items | By design | Export the results, or add them to a review set |
| Export has no partially indexed items, though statistics showed some | The export-time setting wins | Included at search, cleared in the export dialog | Export again with a partially indexed option selected |
| Partially indexed items from outside the queried path appear | KQL conditions don't constrain partially indexed items | A path, URL or property restriction in the query; the location is the whole site | Select Perform advanced indexing on partially indexed items at export |
| "Exclude … in locations without search hits" has no effect | A single location with any hit counts as responsive | Search scoped to one mailbox or site | Use advanced indexing to apply the query to those items |
| Date range doesn't exclude partially indexed items | Statistics and exports include items outside the range | A date range can't filter them in the query | Add them to a review set and filter, or use advanced indexing |
| Items missing from the partially indexed PST | They're already in the regular results | Query with no keywords, only a date range, or all items | Expected; look in the regular results |
| Nothing exported from mailboxes or sites without hits | Only locations with hits contribute partially indexed items | Exclude partially indexed items in locations without search hits is selected | Clear the option, or search all items and export only partially indexed items |
| Large file only partly indexed | Indexing stopped at a size limit (for example after the first 4 MB of an Excel file) | File too large | The file can appear both in results and as partially indexed |
| Unsupported or disabled file type | No full-text indexing (for example .bmp or .mp3) | Type unsupported, or indexing disabled by default or by an admin | Microsoft's lists of formats indexed by Exchange Search and crawled by SharePoint |
| Attachment can't be opened, too many or too large | The attachment content wasn't indexed | An unreadable attachment is the most common cause for email | Include partially indexed items; review the attachments after export |
| Password-protected or non-Microsoft encryption | Content can't be read for indexing | A file password, or encryption from a non-Microsoft tool | Include partially indexed items, then review them with the owner's password or key |
Uncrawlable folder in the export | Partially indexed SharePoint items | Partially indexed items were included | Review that folder separately |
Encrypted content#
| Code or message | Meaning | Usual cause | First check |
|---|---|---|---|
| Keyword inside an encrypted attachment doesn't match | Exchange doesn't index encrypted attachments | Attachment encrypted, for example by a sensitivity label | The message still matches on subject, sender and body; attachments can be decrypted during preview and export |
| Encrypted SharePoint or OneDrive file is partially indexed | Files encrypted with Microsoft encryption are partially indexed there | Label or Rights Management encryption | Include partially indexed items, then analyze decrypted content in a review set |
| S/MIME message is partially indexed | Applies with or without attachments | S/MIME encryption, which eDiscovery doesn't decrypt | Include partially indexed items so they're collected |
| Rights-protected email not decrypted | Decryption needs the RMS Decrypt role | Role not assigned to the reviewer | Check eDiscovery Manager membership or the role in a custom group; see Decryption in eDiscovery |
Export package messages#
| Code or message | Meaning | Usual cause | First check |
|---|---|---|---|
ContentDownloadTemporaryFailure … ServerErrorCode: -2147024894 … File Not Found | A SharePoint or OneDrive file couldn't be downloaded | Renamed, moved or deleted after the search, before the index caught up | Look for the file; request a reindex of the site or library and rerun the search |
This search result was not downloaded as it is a folder or other artifact that can't be downloaded by itself | Informational, in Skipped Items.csv | Folders aren't downloadable items | None; the items inside are exported |
| Estimated and downloaded counts differ | Shown in Export Summary <timestamp>.csv | Statistics are an estimate | Expected; compare item lists, not totals |
| No files downloaded (Estimated Total shows none) | The download never started | Pop-ups blocked, or network endpoints not allowed | Allow pop-ups and follow Microsoft's best practices for downloading export packages |
eDiscovery hold distribution#
| Code or message | Meaning | Usual cause | First check |
|---|---|---|---|
On (Pending) / Off (Pending) | Distribution still in progress | Recent change to the hold | Wait; don't change a hold while it's pending |
PolicySyncTimeout: "It's taking longer than expected to deploy the policy. It might take an additional 2 hours to update the final deployment status, so check back in a couple hours." | Sync timed out | Slow or large deployment | If LastResultTime is more than two hours old, run Set-CaseHoldPolicy -RetryDistribution or select Retry |
PolicyNotifyError | A temporary Microsoft 365 datacenter issue blocked deployment; the hold isn't applied to that source yet | Service-side, transient | Retry distribution |
InternalError: "Policy deployment has been interrupted by an unexpected Microsoft 365 datacenter issue. Please contact Microsoft support to fix the deployment issue." | Needs Microsoft | Service-side | Open a support case with the policy name, workload, result code, message and diagnostics |
FailedToOpenContainer: "The mailbox or SharePoint site may not exist. If this is incorrect, please contact Microsoft support. Otherwise, please remove it from this policy." | A location can't be opened | Mailbox removed or site URL changed | Check with Get-Mailbox and Get-SPOSite; remove locations that no longer exist |
SiteInReadonlyOrNotAccessible: "The SharePoint site is read-only or not accessible." | The site can't take the hold | Site in read-only mode | Check whether the site is locked or read-only (for example with Get-SPOSite), then retry distribution |
| Query-based hold misses encrypted or partially indexed items | Keyword or path conditions may not apply to them | Hold query goes beyond dates, participants or item types | Limit query conditions to those three, or use a location-based hold |
| Repeated hold errors after many small updates | Microsoft recommends one bulk update instead of many | Locations added one at a time, or changes made while the hold is pending | Batch changes into one request (below) |
PowerShell
$users = "adele@contoso.com", "lee@contoso.com", "megan@contoso.com"
$status = Get-CaseHoldPolicy -Identity "<hold policy name>" -DistributionDetail
if ($status.DistributionStatus -ne "Pending") {
Set-CaseHoldPolicy -Identity "<hold policy name>" -AddExchangeLocation $users
} else {
Write-Host "Hold policy still pending."
}Retention and DLP policies have their own distribution status; see Purview policy distribution errors for those.
How to verify a fix#
- Holds: the hold shows On without (Pending), and
DistributionResultsno longer lists failed locations. For holds by case, see eDiscovery cases, holds and review sets. - Searches and exports:
Get-ComplianceSearch -Case "<case name>" | Format-Table Name, Status, Items, Sizeshows the searches completed, andGet-ComplianceSearchAction -Case "<case name>"shows the export actions. Keep this output if you open a support case; Microsoft asks for it. - Export package:
Export Warnings and Errors.csvis empty or only lists entries you can explain, andSkipped Items.csvonly lists folders. - Partially indexed items: record which export options you chose for each matter, so differences between statistics and the package are explainable later.
- Encrypted content: a reviewer with the RMS Decrypt role can preview rights-protected email in readable form.
