Microsoft Purview eDiscovery — Simply Explained

Welcome to another episode of Microsoft Knowledge Nuggets here on M365, FM. I'm your host, Mirko Peters. Today's topic is one that almost everyone has heard of, but most people hope they never actually need to use. Picture this. A sensitive email lands in the wrong person's inbox, or an employee raises a complaint. Maybe a regulator asks for records, or someone thinks company data has left the business. When that happens, people can panic. Someone wants to delete the email, another person starts digging through inboxes by hand. Managers ask employees what they remember, while files move around and the story gets harder to piece together, that's exactly the point where Microsoft Perview eDiscovery comes in. By the end of this knowledge nugget, you'll understand how to find, protect, review, and hand over the right Microsoft 365 data without turning your IT team into a legal team. In plain English, Microsoft Perview eDiscovery is a case-based tool for finding, preserving, reviewing, and exporting work data. Think of Microsoft 365 like an office building, exchange online, teams, sharepoint, and one drive are different rooms where people work every day. Email sit in one room, team files sit in another, chats and shared documents sit somewhere else. Perview eDiscovery is like the locked records room in that building with a search desk outside it. You don't walk through every room without a plan. You open a case decide which rooms matter, protect the records, search for what fits, and prepare the right items for the people who need them. Let's break this down step by step. First, why eDiscovery exists? Then the case and the data sources, after that, legal hold, search, review, and export. We'll start with the reason this exists, because a search only helps if the data still exists. Building block one, why eDiscovery exists? 20 years ago, work data often sat in separate places. Email might live in one archive, files might sit on a file share, team conversations could happen in another tool. If someone needed to investigate an issue, IT would search each place separately, copy items into folders, and hope the copies included enough context. That approach creates gaps. A message might point to a file that nobody collected, a file may have been changed since the original discussion. Someone may remember the event differently than the records show. Work has moved, but the problem hasn't disappeared. Today, your work may spread across exchange online for email and calendars, teams for chat and meetings, SharePoint for team documents, OneDrive for personal work files, Microsoft 365 Groups for shared work, and Viva Engage for community conversations. One business decision can leave a trail across several of those places. That trail matters when your organization receives a legal request, looks into an HR concern, responds to an audit, checks an internal report, or investigates a security incident or possible data exposure. Imagine a former employee claims they were treated unfairly. HR and legal may need messages between that employee and their manager. They may need files from a certain project, they may need records from a defined period, not every email and document the company has ever created. The goal isn't to prove whether anyone did something wrong. Per view, e-discovery finds and preserves possible evidence. Legal, HR, compliance, security, and business leaders decide what the evidence means and what happens next. It also doesn't replace legal advice. It gives the right people a controlled way to work with the data they need. So why not just use normal Microsoft 365 search? Normal search helps you find your own work. It's built for day-to-day tasks, like locating a document from last week or finding an email from a customer. An investigation needs more control. You may need to limit who can see sensitive results. You need a clear record of the searches that ran. You may need to preserve content before someone deletes it. And you need to avoid collecting huge files of unrelated personal or business data just because a search was too broad. That's where e-discovery changes the process. Instead of saying, "Search everything and send me what you find", the team starts with a defined matter. They decide what they need to look for, where it may live, and who should have access. For you, the practical point is simple. Learn this process before an urgent request reaches it. In a real situation, people need fast answers, but fast doesn't mean careless. A little preparation helps your organization protect the right data while keeping the work focused and private. Every investigation needs a clear home before anyone starts searching. Building block two, the case and the data sources. So you have a reason to investigate something. Before you even type a single search word, you need a case. Think of a case as a secure digital file box for one specific matter. It holds everything. The people involved, the data sources, the searches, any holds, review work, and exports all in one place. Imagine a labeled file box, not one that says everything that happened this year. Instead, employee concern march through June, or project redwood review. That name matters because it tells everyone what they are working on. And just as important, what they are not working on. Cases keep things organized, but they also control access. Not everyone in IT should be able to open a sensitive HR matter, and not every HR investigator should see a legal case. Inside PerView, you assign people to the case based on what they need to do. A reader can view the case work, a manager can create and run cases, and administrator handles the wider settings and controls access across eDiscovery. The exact role names may change when Microsoft updates the service, but the simple idea stays the same. Some people need to look, some need to do the work, and a smaller group decides who gets that access in the first place. That separation protects the investigation. It also gives your organization a clearer record of what happened. You can see which case held the search, who worked on it, and why those locations were included, when someone asks. Why did you search these people and not everyone else? There is a place to explain the decision. Next, you choose the data sources. A data source is simply a place where eDiscovery looks for content. You can add people, groups, sites, or even broader organization locations, depending on the question you are trying to answer. To do that well, you need a basic map of where Microsoft 365 stores work. Business, email, and calendars live in exchange online. Your personal work files usually live in one drive. Think of it as your own digital filing cabinet. Team files usually live in SharePoint. That includes many files you open through Teams, even though you may never see the SharePoint site behind the scenes. Teams itself can confuse people. A Teams chat is not just sitting inside an app called Teams. One-to-one and group chat messages actually connect to the participants' exchange online mailboxes, and files shared in those chats are generally stored in one drive. So if you search only for email and ignore one drive, you could miss a file someone sent during a chat. Imagine HR needs to look into messages between two employees. You would not begin by searching every mailbox, every one drive, and every SharePoint site in the company. You would start with the two employees mailboxes and their related file locations. Then you might set a date range around the event and use the known project or topic as a guide. That is a focused starting point. If the results point to a shared project site or a group conversation, then you can widen the scope with a reason. You let the evidence guide the next move. This matters because a wider search does not automatically mean a better search. A huge result set can bury the few items that matter. It can also pull in private, unrelated work that nobody needs to review. More data means more time, more care, and more chances to lose the thread of the investigation. So start with known people, known dates, and known places. Then expand only when the results show you where to look next. For you, the main lesson is knowing where Microsoft 365 actually stores work data. Once you understand the map, you are less likely to miss content and far less likely to create a giant pile of results nobody can sensibly review. Then once the case points to the right places, you need to protect the evidence before it changes. Building block three, legal hold, the pause button for evidence. A legal hold is a preservation rule. It keeps relevant content available while a case remains active, even if someone later tries to delete or change that content. Think of a filing cabinet with a clear label on one drawer. Do not destroy. Someone can still try to throw away a document from that drawer, but the organization keeps the copy that may matter for the case. That is the job of a hold. People clean up inboxes all the time. They delete chat messages, replace a file with a newer version, or someone might leave the company and their account moves through an off-boarding process. None of those actions automatically mean somebody did something wrong. But once a matter needs preservation, normal day-to-day cleanup can create a real problem. The message or document you need may disappear before anyone has a chance to find it. That is why a hold often comes before a deep search. You may know enough to identify the people and locations connected to the matter, even before you know exactly which messages or files will matter. A hold keeps that material available while the team works out the right search. Now legal hold and retention are related, but they are not the same thing. A retention policy follows your organization's normal records rules. For example, it may keep certain business records for a set period, then remove them when that period ends. A legal hold responds to one specific matter. Retention asks, how long should we normally keep this kind of work? A legal hold asks, could this content matter in this case right now? Both can affect what stays available, but they start from different reasons. Imagine an employee learns that HR is looking into a complaint. That employee may delete a team's chat or remove an email from their mailbox. Maybe they think it is irrelevant, or maybe they are simply cleaning up. If the relevant locations are on hold, Perview can keep the needed copy available for the case. The user may no longer see the deleted item in the usual place, but the preserved copy remains available to authorised case members. That is why a hold carries weight. It is not a routine switch that IT turns on whenever someone wants a quick answer. A quick fact check may only need a narrow search. A hold belongs where legal, HR compliance, or an investigation team says the content needs to stay available. The decision should come from the people responsible for the matter, with IT helping apply it correctly. There is another detail that catches people out. Case status matters. If you close a case, the holds connected to that case can be released, so closing a case is not just housekeeping. It is a decision with consequences for preserved content. Before closing anything, the people responsible for the case need to know whether preservation should end. For you, treat a hold with care. It changes what data must remain available. It can affect mailboxes, files, chats, and sites connected to the matter. Make sure the scope is clear, access is controlled, and the case team knows who owns the decision to apply, change, or release it. With evidence preserved, the search process has something reliable to work with. Building block 4. Search without drowning in data. So, with the right locations protected, you can begin the search. A search asks Perview to find content that matches your conditions across the sources you selected for the case, and you're not asking, "Show me everything." You're asking a focused question like, "What did these two people discuss about this project during this period?" Perview gives you several simple ways to narrow that question. You can look for a word or exact phrase, set a date range, focus on a sender or recipient, or search by subject line file type or message type. Each condition cuts away content that probably has nothing to do with the matter. Start with the guided condition builder. It gives you clear fields to fill in, which is usually the right place for beginners. You pick the people, choose the dates, enter a phrase, and select the locations you need. Some people need more detailed search logic. For that, Perview supports keyword query language, usually called KQL. KQL lets you write more exact search rules. You don't need to learn it on day one, but it becomes useful when a simple phrase search returns too much noise or misses a very specific pattern. The people in places you search matter just as much as the words. You might search named Exchange Online mailboxes, individual one driver counts, a known SharePoint site, teams-related content connected to those locations, or when the matter truly calls for it broader organization sources. Imagine an investigation involving two employees and a project called Project Redwood. A sensible first search might cover the last 90 days, they're selected data sources, and the phrases, Project Redwood and Settlement. That first result is not your final answer. You run it, then check the statistics and sample results. Statistics show you the shape of the results set, and a sample lets you see whether Perview found the kind of messages and files you expected. Maybe the phrase Settlement brings back unrelated sales emails, so you adjust the search. Or maybe the sample shows a project code, nobody mentioned at the start, so you add that term and run another search. This is normal. Good searching is a loop. You ask a focused question, check the results, learn from them, and refine the question. You can also create more than one search inside the same case. One search might focus on messages between the two employees, another might look only for documents, and a third might narrow the date range to the week around a particular meeting. Separating these searches makes the work easier to follow, and keeps unlike results from becoming one confusing pile. Many people think the safest move is searching the whole organization first, but it usually isn't. A search that covers every mailbox, site, and file can produce far too much unrelated materials, slowing down the people who need to review it and exposing private work that has no connection to the matter. Start narrow, then expand with a reason. There is also content search in Perview, which can help with a quick check and early look at whether a term appears, or fact finding before a formal matter begins. But when the work becomes an investigation that needs controlled access and a clear home, an eDiscovery case gives the search a proper structure. For you, the lesson is simple. Good eDiscovery starts with a question, not a giant search box. Once results arrive, the job changes. You are no longer only finding content. You need to decide what actually belongs in the matter. Building block five, review sets, tags, and the final export. A search gives you possible matches. That word "possible" matters because Perview can find a document that includes your phrase, but software can't decide if it actually belongs in the matter. A person with the right context has to make that call. This is where a review set comes in. A review set is a working evidence table where collected results can be examined in more detail. Instead of looking at a large list of search matches, authorised reviewers can work through a selected group of content and decide what each item means for the case. Think of it as moving possible evidence onto a review table. The items are there because they match the search, and now someone needs to read them, understand the context, and sort them into useful groups. Review sets and the more advanced review tools depend on your licensing. Standard eDiscovery workflows center on the case, hold, search, and export, which may be enough for many smaller matters. Premium eDiscovery can add review sets and extra ways to analyse a larger or more complex set of results. So don't assume every Perview tenant will show the same buttons. Check what your license includes before a real case starts, so nobody plans a review process around a feature they can't use. The point of review stays the same either way. Search finds matching words, but people decide relevance. A word document may contain the phrase "project redwood", but that does not make it evidence by itself. It might be a meeting agenda with no useful detail, a draft contract that directly relates to the matter, or a document that needs legal review before anybody shares it outside the organisation. Tags help reviewers record those decisions. A tag is just a label you apply to an item after reviewing it. You might use tags such as relevant, not relevant, needs review, privileged, internal, or public. Your organisation may use different labels, but the goal is the same. Give the case team a clear way to sort content and explain what they decided. Imagine that word document turns up in a search. A reviewer reads it and finds details that connect directly to the issue, so they mark it relevant. The document also includes advice from legal counsel, so they apply a privileged tag as well. Now the item is no longer just a keyword match. It has been reviewed, classified, and placed in context for the people handling the matter. Premium review tools can help when the result set becomes larger. They can find duplicate or near-duplicate files, group-related content, and thread email or conversation context together, helping a reviewer see a discussion as a connected exchange rather than isolated messages. Those tools don't replace judgment. They help the reviewer spend more time on the content that needs a human decision. Once the case team has selected the right items, they can export them. An export package is selected content and supporting details for legal, HR, compliance, or an outside review team. It's the hand-off point where the work inside PerView becomes material another authorised person can review. There are two broad paths here. Sometimes a completed search needs a quick hand-off and the team may export directly from the search results. Other times, the matter needs closer review first, so the team can review the content, apply tags, filter out what does not belong, and export only the selected items from the review work. The second path gives you more control because instead of sending every item that happened to match a word, you can send the items that a reviewer has checked and marked for the right purpose. Access still matters all the way through. Only assigned case members should work with the matter, including the review and export stages. Permissions are not something you fix at the end. They need to be in place before the first search runs, because sensitive content can appear in the results immediately. For you, an export is not a download button for every search result. It is the last step in a careful chain of decisions. Someone defined the matter, selected the sources, protected the content, searched, reviewed, and sorted it. Only then does the right set move to the right people. That leads to the bigger picture. How the paths connect? From scattered work data to a defensible process. So here's the thing about eDiscovery. It's not one big search button. It's a process, a process that gives every search a purpose and a record of what happened. Let's break it down. The case defines the scope of the matter. Then the data sources tell you where to look. The hold makes sure content stays preserved while the case is active. The search narrows down the field. The reviewer separates what's relevant from what's not. And finally, the export hands the selected results to the people who need them. The order matters. Search before you define the scope, you get noise. Export before someone reviews. You might share way more than the case requires. Skip a hold when preservation is needed. The content could change or disappear before anyone can assess it. Let's go back to the office building analogy. Enter ID is the reception desk that controls who gets in. Microsoft 365 apps are the rooms where the daily work happens. Per view eDiscovery is like a key that only opens the rooms connected to the matter. And it records every step the case team took through those rooms. Why does that record matter? Because investigations involve more than just technology. IT manages the platform and makes sure the process runs correctly. But legal HR compliance security and business owners bring the actual question, the context, and the decisions about what happens next. No single group should try to do everything alone. That's a recipe for mistakes. Modern work also leaves connected trails everywhere. An email can point to a cloud file. A chat can involve a document stored somewhere else. A team discussion can lead to another shared location. That's why your source map matters just as much as your search words. Once your organization understands this connected path, you can prepare before the next request arrives. That's the real benefit. Actionable takeaways. Be ready before the request arrives. Start with a data map. Write down where your organization actually works, not where people think it works. Include exchange online for email, one drive for personal files, SharePoint for shared sites, and Teams, Microsoft 365 Groups and Viva Engage if your people use them. Keep the map simple. The goal is to help legal, HR, compliance, security, and IT answer one basic question quickly. Where could the records for this matter live? Next, check your PerView eDiscovery permissions. Only the people who actually need to handle sensitive cases should have access to cases, search results, and exports. Review the roles you've assigned and remove any access that doesn't have a clear reason. This is a good time to decide who does what, who can open a case, who can run a search, who can approve an export. Those decisions are much easier when there's no urgent request sitting in someone's inbox. After that, agree on a simple case naming pattern and a path for raising a matter. A case name could include the type of matter, a short subject, and a date. Keep it clear enough that the approved case team can tell one matter from another without opening every single case. Also agree on the first call. If HR receives an employee complaint, who contacts IT? If security finds a possible data exposure, when does legal join? If compliance receives a regulator request, who decides whether preservation is needed? You don't need a huge policy document before you start, you just need a clear path people can follow. Then practice with a small test case. Use a limited test data source and a short date range. Avoid real sensitive matters, create the case, confirm the right people can access it, run a narrow search, and see how the results move through your process. A practice run finds confusion early. Maybe the wrong people have permissions, maybe a team doesn't know where its files live, maybe the case name doesn't explain enough. Better to find those issues during a test than during a live investigation. Check licensing before you need advanced options. Content search and standard e-discovery usually come with e-3-level licensing. Premium review and analysis options generally need e-5 licensing or an add-on. Your exact setup can differ, so verify what your organization has before you promise a feature to legal or HR. And when a formal request or investigation begins, don't self-clean. Don't delete, move, or alter possible evidence. Raise the matter through the agreed path and let the right people decide what needs preserving. That's the practical system. Per view e-discovery turns scattered Microsoft 365 work into a controlled case process from the first question through the final handoff. Subscribe on your favorite podcast platform and share this knowledge nugget with someone starting their Microsoft 365 journey mode. One system, not just one search. Search finds the content and holds keep it available. Review separates useful material from keyword matches and export creates the handoff for the people handling the matter. Microsoft Per view e-discovery works best before a crisis. Make sure your data locations, access rules, and team responsibilities are already clear. Start with your data map and your case process because the right question means very little if nobody knows where the answer lives. Subscribe for more Microsoft knowledge nuggets on M365, FM, and share this with the person who still thinks teams files live inside teams.