The classic experience was switched off in 2025. If your written process still describes it, then what you have is a document rather than a process.
Every classic discovery experience was retired on 31 August 2025, the old content search included. What replaced it is built around the case rather than the custodian, indexes on its own, folds content search into a case the system creates for you, and brings Copilot in for writing queries. If nobody has placed a legal hold since that date, the runbook your team would reach for under a court deadline describes an interface that stopped existing.
- Six servicesExchange, Teams, Groups, OneDrive, SharePoint, Viva Engage
- Case-centricCases replaced custodians as the organizing unit
- Auto-indexedAdvanced indexing runs on every search
- DecryptionLabeled and rights-protected content handled
Five differences from the version most process documents describe.
Every classic experience went on 31 August 2025, meaning the old content search along with both classic discovery tiers. If nobody has run a matter since then, these are what you will walk into.
- Collections no longer exist. Statistics within the search replace them, showing you what is actually in the results. And a search is no longer fixed once run, even after results have gone into a review set, so it can be amended at any point rather than begun again from nothing.
- The custodian is no longer what everything hangs off. The case is. People, groups and data sources still get added, but the whole workflow is built around the case, and that changes how a matter is assembled from the very first step.
- Reindexing has stopped being a task anybody performs. Advanced indexing runs by itself during any search scoped for statistics, and again when adding to a review set or exporting, which removes one of the commonest causes of quietly incomplete results under the old arrangement.
- Content search has stopped being a product of its own. It sits inside a case the system generates, open by default to discovery managers and administrators, carrying the full range of case capability including holds and review sets.
- What used to be called jobs are now processes, with a report covering cases, searches, review sets and holds, and tracking for anything long-running. A trivial change of vocabulary, and precisely the one that makes an old runbook read as though a feature has been removed.
Eight capabilities, and several of them changed substantially in the past two years.
Content Search is now inside eDiscovery
Everything the old content search did now lives inside a case the system generates for you, available by default to anybody in the discovery manager or administrator role groups. That case behaves like any other, so holds and review sets can be created in it. Where you need to restrict who can see those searches, membership is controlled in the case settings, and it is worth looking, because the default reaches further than most people assume.
Cases replaced custodians as the organizing unit
Custodians used to be the thing everything else hung off. Now the case is, and people, groups and data sources get added into it. That is a real change to how a matter gets set up, not a cosmetic one, and any process written against the old model produces instructions for steps that no longer exist anywhere in the interface.
Indexing happens automatically, which removes a common failure
It used to be necessary to reindex partially indexed or errored content separately before searching, and a stale index was a routine cause of results that were quietly incomplete. Advanced indexing now runs by itself during any search scoped for statistics, and again when results go into a review set or get exported. Running or rerunning a search updates every index, so that separate step has simply disappeared.
Decryption of your own protected content
Mail and attachments protected by message encryption, and documents carrying a sensitivity label or rights management, are decrypted automatically as they enter search results or a review set. For any company that has actually deployed labeling and encryption, that is the thing preventing your own data protection from obstructing your own investigation.
Teams conversations reconstructed, not fragmented
Threading pulls in the whole conversation surrounding whatever matched, so a reviewer reads the exchange rather than a fragment of it. With more and more substantive discussion having moved out of email and into chat, this is precisely what makes a Teams review legible to a lawyer instead of a stack of lines with no context attached.
Search and delete, including AI application data
Mail, Teams messages, and data generated by Copilot and other AI applications can all be searched for and deleted across the whole company, framed as finding and removing content that is harmful or carries real risk. Bringing AI application data into that scope is genuinely new ground, and increasingly it is the thing a business actually needs to be capable of doing.
Security Copilot for query drafting and summarizing
Copilot turns a plain description into the query language underneath without anybody needing to know the operators or which metadata fields are supported, and it summarizes most items in a review set, whether documents, meeting transcripts or attachments. For any business without somebody who does this for a living, that lowers the skill required to run a competent search quite considerably.
External reviewers, in preview
Guest access, still in preview, lets an outside reviewer be invited into a case with reviewer permissions and see only what has been shared with them. For a matter being run alongside outside counsel, that removes the deeply awkward step of exporting enormous volumes of material out of your tenant purely so a lawyer can read it.
Four things that determine whether any of this works on the day you need it.
We are clear about where our role ends
We are not attorneys and we do not advise on legal obligations, on how far a preservation duty reaches, or on what has to be produced. Your counsel runs the matter. Our job is making the platform capable of executing whatever they ask for, quickly and in a way that holds up, which is technical work that no lawyer should have to learn to do themselves.
We rewrite the runbook against the current experience
Every classic experience went on 31 August 2025, and most companies still hold documentation describing custodian-led workflows, collections and separate reindexing steps, none of which exist any more. A runbook that does not match the interface is worse than having no runbook at all, because somebody follows it under real time pressure and concludes the capability has been taken away.
A hold and an export get rehearsed long before anybody needs either
Placing the hold is where delay turns into genuine legal exposure, and exporting in a format your counsel can actually open is where an unrehearsed process falls over at the final moment. Both get walked through against a real scenario, and the export format gets confirmed with your legal advisers well in advance rather than discovered on the day of production.
We check the permissions and the default case membership
Content search now sits inside a case the system generates, open by default to everybody holding the discovery manager or administrator role. In several tenants we have opened, that turns out to be a considerably wider audience than anybody would have chosen for a sensitive search, and the case settings are where you narrow it. A five minute check, and almost nobody performs it.
Six US situations where eDiscovery capability gets tested.
A litigation hold notice arrives from counsel
Once litigation is reasonably anticipated, the duty to preserve attaches, and your exposure is precisely the gap between receiving notice and having holds actually in place. A hold protects electronically stored information from being deleted, whether by accident or deliberately. The practical requirement is one named person who could place one this afternoon with no purchase to make and no training course to sit through first. Your counsel decides how far it reaches. The platform simply has to be ready to do it.
A regulatory inquiry with a production deadline
Financial firms, healthcare organizations and government contractors all face inquiries arriving with a clock attached, whether from a federal agency, a state attorney general or a sector regulator. The base tier handles searching, holding and exporting. The premium tier adds review sets, analytics and decryption, and that is what converts a very large collection into something reviewable inside the deadline rather than a fortnight after it.
An internal investigation into an employee
These frequently arrive escalated out of an insider risk case, which the platform handles directly. What matters is scoping the search tightly, keeping the number of people who can see the case very small, and dealing properly with encrypted or labeled content, because a labeled document nobody can open is a hole in your investigation rather than a security win.
A commercial dispute where the evidence is in Teams
What was agreed, on what date, and by whom, decided in a channel or a private chat rather than in email. Threading brings in the entire conversation surrounding whatever matched, and that is what makes a Teams record intelligible as evidence at all. Without it a reviewer receives fragments and cannot establish either sequence or context.
A consumer rights request under CCPA/CPRA or a state privacy law
When somebody asks what personal information you hold about them, the legal framework is entirely different and the search problem is identical. Query across the six supported services with keywords and conditions, use statistics to establish how much there is, and export. The obligation comes from law. The mechanics come from the same platform as everything else here.
A matter where everything that matters is in a photograph or a scan
Signed documents photographed on somebody phone, contracts run through a scanner, screenshots of conversations. Character recognition pulls the text out of those images and includes it with whatever goes into a review set, which makes it searchable. Without that step, the material most likely to matter is precisely the material a keyword search cannot see at all.
What businesses could actually do if a legal matter landed tomorrow.
| Feature | Rehearsed and current | Licensed, never used | Base tier only |
|---|---|---|---|
Can place a hold within hours | Yes | Probably | Yes |
Somebody has done it before | Yes | No | No |
Runbook matches the current interface | Yes | Unlikely | Unlikely |
Can review content in place | Yes | Yes | No |
Encrypted and labeled content readable | Yes | Yes | No |
Teams conversations reconstructed | Yes | Yes | No |
Volume reduced by analytics before review | Yes | Yes | No |
External counsel can review without bulk export | Yes | Preview | No |
Export format agreed with counsel in advance | Yes | No | No |
Preservation defensible under deadline pressure | Yes | Untested | Partly |
What is achievable without the top tier, and what genuinely is not.
Capability
Search for content across the six services
- Base eDiscovery
- Yes
- Premium eDiscovery
- Yes
Capability
Keyword queries and search conditions
- Base eDiscovery
- Yes
- Premium eDiscovery
- Yes
Capability
Search statistics and samples
- Base eDiscovery
- Yes
- Premium eDiscovery
- Yes
Capability
Export search results
- Base eDiscovery
- Yes
- Premium eDiscovery
- Yes
Capability
Case management and role-based permissions
- Base eDiscovery
- Yes
- Premium eDiscovery
- Yes
Capability
Place content locations on hold
- Base eDiscovery
- Yes
- Premium eDiscovery
- Yes
Capability
Search and delete data
- Base eDiscovery
- Yes
- Premium eDiscovery
- Yes
Capability
Review sets
- Base eDiscovery
- No
- Premium eDiscovery
- Yes
Capability
Conversation threading for Teams and Viva Engage
- Base eDiscovery
- No
- Premium eDiscovery
- Yes
Capability
Decryption of labeled and rights-protected content
- Base eDiscovery
- No
- Premium eDiscovery
- Yes
Capability
Optical character recognition on images
- Base eDiscovery
- No
- Premium eDiscovery
- Yes
Capability
Cloud attachments and SharePoint versions
- Base eDiscovery
- No
- Premium eDiscovery
- Yes
Capability
Analytics, near duplicates, email threading, themes
- Base eDiscovery
- No
- Premium eDiscovery
- Yes
Capability
Tagging and review set filtering
- Base eDiscovery
- No
- Premium eDiscovery
- Yes
Capability
Import external data into a review set
- Base eDiscovery
- No
- Premium eDiscovery
- Yes
Capability
Guest user access for external reviewers, preview
- Base eDiscovery
- No
- Premium eDiscovery
- Yes
Capability
Security Copilot query drafting and summaries
- Base eDiscovery
- No
- Premium eDiscovery
- Yes
Capability
Graph API authentication
- Base eDiscovery
- Delegated
- Premium eDiscovery
- Delegated and app-only
Five steps, every one of them finished before any matter arrives.
- 1
Establish what you actually have
Whether the premium tier is even available to you, which needs an E5 subscription or a related add-on, who currently holds discovery permissions, and who can see the system-generated content search case today. That last question turns up a wider group than anybody intended with some regularity.
- 2
Narrow permissions and case access
Permissions configured on purpose, whether through the built-in role groups or custom ones, with case settings used to control membership wherever a search is sensitive. Wide default access to a case containing an investigation into a named individual is exactly the sort of thing that generates a second problem on top of the first.
- 3
Rehearse a hold with a realistic scenario
Somebody named places a hold on real content locations, working from a scenario your counsel would recognize, and we time how long it takes. This is the step where delay becomes exposure, and it is the one that most reliably surfaces a missing permission or an instruction nobody has updated in three years.
- 4
Rehearse a search, a review and an export
A keyword query with conditions on it, statistics to establish how much there is, and where the premium tier exists, a review set with threading, decryption and analytics applied. Then an export in whichever format your legal advisers have confirmed they can actually work with, agreed beforehand rather than negotiated on the day of production.
- 5
Write the runbook against the current interface
Written against the interface as it exists today rather than the classic one retired in August 2025, naming who does what, who authorizes it, who stands in when that person is on vacation, and how an insider risk case escalates into a matter. Then reviewed once a year, because this product does not stand still.
What US businesses ask about Purview eDiscovery.
Fifteen questions worth answering now.
Capability
- Do you have premium eDiscovery available?It requires an E5 subscription or related add-on.
- Has anybody run a matter since the classic retirement?Retired August 31, 2025.
- Who holds eDiscovery manager permissions?The system-generated content search case is visible to them by default.
- Have you tested a hold?The step that actually preserves anything.
- Have you tested an export?The export flow changed in the new experience.
Process
- Who authorizes a hold, and how fast?Delay between notice and hold is the exposure.
- Is your runbook written against the classic experience?If it mentions custodians as the unit, yes.
- Does outside counsel need access?Guest user access is in preview.
- Do you know what your audit retention allows?A separate question with a separate answer.
- Is there an escalation path from insider risk?Cases can be escalated directly.
If it happened this week
- Could you place a hold today?Named person, tested process, no procurement step.
- Would encrypted content be readable?Decryption is a premium capability.
- Could you reconstruct a Teams conversation?Conversation threading is premium.
- Could you export in a format counsel can use?Ask them which, in advance.
- Who runs it if the usual person is away?A single point of failure in most organizations.
The pages around this one.
Purview Audit
The other half of any investigation. Who did what, and when, with retention rules entirely of its own.
Microsoft Purview
The wider governance platform this sits inside, including classification, labeling and retention.
DLP solutions
The preventive layer that reduces how much sensitive content ends up in scope for a matter at all.
Ask whether anybody here has placed a legal hold since August 2025.
That is when the classic experiences were switched off. If the answer comes back no, then your written process describes an interface that stopped existing, and whoever has to follow it will be doing so under a deadline set by opposing counsel.
Related Services
Explore more solutions that work great with this service
Microsoft Purview Audit
Purview Audit configuration and readiness for US businesses:
Learn moreMicrosoft Purview
Data governance and compliance solutions
Learn moreDLP Solutions
Data Loss Prevention implementation for US businesses via Microsoft
Learn moreMicrosoft Purview Endpoint DLP
Endpoint data loss prevention for US organizations: device onboarding
Learn moreIT Compliance
HIPAA, SOC 2, NIST, CMMC, CCPA readiness
Learn more