Microsoft 365’s Purview eDiscovery enables legal departments to search, preserve, review and export M365 indexed content in response to internal and external requests. Content Search requires an E1 or equivalent license for basic search and export. Purview eDiscovery(Standard) requires an E3 subscription license for custodian targets and supports a streamlined workflow. eDiscovery (Premium) requires an E5 license and expands functionality to include advanced indexing, review, topic clustering and more.

Purview platform leverages the Microsoft Graph API to access and analyze data from different M365 apps stored in user or M365 Group mailboxes, OneDrives and SharePoint libraries. Purview eDiscovery enables users to create and manage eDiscovery cases, custodians, holds, searches, and exports through a unified web interface, PowerShell commands or integrations with partner eDiscovery technologies through the Graph API.

Purview eDiscovery supports the basic requirements of corporate legal departments with relatively simple litigation or compliance profiles. Regulated verticals and customers with complex discovery workflows may have to invest in either custom automation development or a Microsoft integration partner platform to meet their requirements.

Purview eDiscovery Functions

• Create and manage eDiscovery cases: Users can create eDiscovery cases to organize and track their eDiscovery activities and assign permissions to case members.
• Add and manage custodians: Users can add and manage custodians, who are the individuals or groups whose data is relevant to the eDiscovery case.
• Create and manage legal holds: Users can also apply legal holds to custodians and target locations to preserve their data from deletion or modification. Some sources and content types may not yet have a preservation mechanism, so customers should verify every source before relying on legal holds. Hold notification requires Advanced.
• Create and run eDiscovery searches: Users can create and run eDiscovery searches to find and collect data from various sources, such as Exchange Online, SharePoint Online, OneDrive for Business, Teams, and Yammer. Users can use keywords, conditions, and filters to refine their search queries and preview the search results.
• Add content to Review Sets (Advanced): Copies results to secure Azure storage. Processes for advanced indexing, threading, OCR, cloud attachments and analytics with error remediation. Analysis, filtering and predictive coding of review sets.
• Export eDiscovery data: Users can export eDiscovery data to a local folder or an Azure Storage account for further analysis and review. Users can choose to export the data in its native format or in a PST format. Users can also apply deduplication, encryption, and hashing options to the exported data.