Microsoft Purview eDiscovery

What it is

Microsoft Purview eDiscovery is the identify-preserve-collect-review-export tooling built into Microsoft 365. It searches Exchange Online, SharePoint, OneDrive, Teams, Microsoft 365 Groups, and Viva Engage in place, holds those locations, and exports the results without copying anything to a third-party platform first. For most in-house legal teams it is the eDiscovery they already own.

On 31 August 2025 Microsoft retired every classic experience — classic Content Search, classic eDiscovery (Standard), and classic eDiscovery (Premium). What replaced them is one Cases list in the Purview portal where standard and premium behaviour sit side by side, separated by a setting rather than by a separate product. The vocabulary moved with it: custodians became data sources and the case is now the organizing unit, collections became Statistics inside a search, jobs became processes, and advanced indexing runs just-in-time during each search, add-to-review-set, and export instead of as a reindex you trigger per custodian.

If your runbook still says “add a custodian, run a collection, check the job,” it describes a product that no longer exists.

The licensing line one Cases list hides

One list, two products. Search, KeyQL queries, statistics and samples, holds, search-and-delete, role-based permissions, case management, and export of search results are included at E3. Everything that makes it a review platform is premium-gated: review sets, advanced indexing, analytics (near-duplicate detection, email threading, themes), OCR, decryption, conversation threading, tagging, external data import, guest reviewer access, Security Copilot, and Graph app-only authentication.

The gate is the part buyers get wrong. Premium features are licensed against the person whose data you analyze, not the person doing the analysis. To pull a given employee’s mail into a review set, that employee needs Office 365 E5 or Microsoft 365 E5 — or, on E1/E3, a Microsoft Purview Suite (formerly Microsoft 365 E5 Compliance) or Microsoft 365 eDiscovery and Audit add-on license. A fully licensed legal team on an E3 tenant can open the case, run the search, place the hold, and still be unable to build a review set over the custodians that matter.

Pricing

• Microsoft 365 E3 — $39 per user/month, annual commitment paid yearly. Buys search, hold, and export.
• Microsoft 365 E5 — $60 per user/month, same terms. Buys premium features against that user’s data.
• Microsoft Purview Suite — $12 per user/month on top of E1/E3, to light up premium behaviour for a subset of people instead of upgrading everyone. On a 2,000-seat E3 tenant with 60 recurring custodians that is about $8,600/year, against roughly $504,000/year for the $21/user/month delta to move the whole tenant to E5.
• Pay-as-you-go — $20 per GB per month for non-Microsoft 365 AI application data (Copilot in Fabric, Security Copilot, connected and cloud AI apps) that you add to a review set or export. The meter needs an Azure subscription attached, is rated every 24 hours, and keeps running on closed cases — only deleting the case takes the data off it. Microsoft 365 data and Microsoft 365 Copilot data are included in the subscription and aren’t metered.
• Graph eDiscovery API is open to E3 tenants with 50 GB of export included per month; only export calls bill.

Where in-place discovery stops being enough

Purview collects and holds the data Microsoft owns. Past that the ceilings are concrete: a single review-set export is capped at 5 million documents or 500 GB, whichever is smaller; a tenant can export 5 TB per day with premium features and 2 TB without; mailbox export runs at 2 GB per hour per mailbox and any process still running after 7 days is cancelled; advanced indexing tops out at 2 GB per hour; files above 150 MB aren’t indexed and OCR stops at 24 MB.

Two harder walls sit behind the throughput numbers.

Non-Microsoft 365 data. Slack, Bloomberg, and mobile message archives reach eDiscovery only through paid third-party connectors — 17a-4’s DataParser and equivalents — that write items into Exchange mailboxes as email so Purview treats them as native content. External data import into a review set is a manual upload, not a collection. Forensic images and device collections have no path at all.

Production. There is no Bates numbering, no redaction tooling, and no privilege log generation. Attorney-client privilege detection flags likely-privileged documents against an attorney list you supply, and Microsoft’s own documentation states it doesn’t replace privilege review. When a matter reaches production, the export leaves for a review platform.

Best for

In-house legal ops and litigation support at an E5 organization whose evidence lives in Microsoft 365 — employment claims, internal investigations, subpoena and regulator response, and early case assessment on mid-sized civil matters. It is the collect-and-cull layer, not the platform you produce from.

Alternatives

• Relativity — when outside counsel runs the matter, the data already lives there, or you need production, Bates, and privilege logs at multi-million-document scale.
• Everlaw — when the review team wants a current-generation interface and per-GB hosting it can forecast, without a hosting partner in the middle.
• DISCO — when you want cloud-native review priced per matter and a shorter path from collection to first-pass coding than a Relativity implementation cycle.

Pick Purview over all three when the matter never leaves Microsoft 365, the collected volume stays in the low hundreds of GB, and preserving in place beats moving data out.

Watch-outs

• The premium license follows the custodian, not the reviewer. Guard: before enabling premium features on a case, check licensing against the data sources rather than the case members, and keep a pool of eDiscovery and Audit add-on licenses you assign before collection — not after a review set fails.
• Closing a case doesn’t stop the pay-as-you-go meter. Guard: make export-then-delete an explicit matter-closure step, or exclude non-Microsoft 365 AI data at search time using the ItemClass KeyQL filter Microsoft publishes.
• Hold notices and acknowledgment tracking are gone. The current workflow runs trigger event, case, search, hold, review, export — custodian communications and the Communications library belonged to the retired classic experience. Guard: run notices and acknowledgments in a dedicated legal-hold tool such as Exterro or Relativity Legal Hold, and keep that acknowledgment chain documented separately from the system hold.
• Case data doesn’t move with the tenant. Guard: before any Advanced Data Residency move or a commercial-to-GCC migration, export review sets, download search results, and record hold membership — cases created before the move are unreachable from the destination tenant, and there is no in-place migration path.

Related reading: the EDRM model for where this sits in the discovery lifecycle, and the legal hold process for what has to happen around the system hold.