Running an eDiscovery Case in Microsoft Purview

eDiscovery in Microsoft Purview lets you search, preserve, and export content from across Microsoft 365 in response to a legal hold, regulatory request, or internal investigation. This article walks through a typical case end to end.

When you need eDiscovery

Common triggers:

• A legal hold from your legal counsel
• A subpoena or regulatory request
• An internal HR or misconduct investigation
• A subject access request under the Privacy Act

Permission first

eDiscovery is a privileged capability. Make sure the person running the case is in the correct role group (eDiscovery Manager or eDiscovery Administrator) before starting. Standard global admins do not get eDiscovery access by default.

Step 1: Create the case

In the Microsoft Purview portal, go to eDiscovery and create a new case. Give it a clear name that references the matter (e.g. Smith v Acme - 2026-05). Add the people who need access to the case as members.

Step 2: Place custodians on hold

A hold preserves content for named users and mailboxes, locations, sites, or Teams. Once a hold is in place, content cannot be permanently deleted until the hold is released, even if users try to.

Set holds early. Once a custodian deletes content, recovery becomes harder.

Step 3: Build searches

Searches in eDiscovery use Keyword Query Language (KQL). Typical patterns:

• Keywords: "Project Pine Needle"
• Senders: From:[e-mail]
• Date range: (Sent>=2026-01-01) AND (Sent<=2026-04-30)
• Locations: limit to specific mailboxes or sites

Run a small test search first to validate the keywords return what you expect. Refine before running the full search.

Step 4: Review and tag

In eDiscovery Premium, results land in a review set where you can tag content (Responsive, Privileged, Not relevant) and redact sensitive portions before export.

Step 5: Export

Export in the format your legal team needs (PST, MSG, native, or load file). Keep a chain-of-custody record of what was exported, when, and by whom.

Close the case

Once the matter is resolved, release holds and close the case. Holds left in place indefinitely accumulate cost and complicate retention.

For help setting up or running an eDiscovery case, submit a support ticket.