Microsoft 365 eDiscovery: Purview Workflows, Holds, and Export Guide

Role-Based Access Control and Case Membership

Before any user can create a search or place a legal hold, compliance administrators must configure role-based access control in the Microsoft Purview portal. Purview separates eDiscovery duties into distinct roles to maintain administrative boundaries:

1. eDiscovery Manager: Users in this role group can create, edit, search, and manage only the specific eDiscovery cases that they create or where an administrator explicitly adds them as a member. They cannot view or manage cases where they lack explicit membership.
2. eDiscovery Administrator: This administrative tier includes all eDiscovery Manager permissions, plus global visibility across every eDiscovery case in the tenant. An eDiscovery Administrator holds tenant-wide visibility across all cases and only an eDiscovery Administrator can remove members from a case.
3. Reviewer: A specialized role designed for internal reviewers or litigation support staff. Reviewers can only access and review documents within designated review sets in eDiscovery Premium cases to which they are assigned.

Assigning these roles follows the principle of least privilege. In practice, legal ops managers and lead paralegals should hold the eDiscovery Manager role and receive explicit case invitations for their assigned matters. The eDiscovery Administrator role should be reserved for compliance leads and senior IT administrators who supervise cross-case operations.

Evaluating Standard Versus Premium Workflows

Choosing between eDiscovery Standard and eDiscovery Premium depends on the volume of collected data and the complexity of the matter. For small internal investigations or single-custodian collections, eDiscovery Standard provides sufficient capability to place holds, run keyword queries, and export results directly to a local workstation.

When a matter involves dozens of custodians, multiple gigabytes of email, and overlapping communication threads, eDiscovery Standard introduces operational friction. Because Standard lacks review sets and deduplication, every search export produces raw, duplicated items. If multiple custodians received the same company-wide email with a large PDF attachment, a Standard export yields separate copies of that message and attachment across different PST files.

eDiscovery Premium resolves this collection bloat by ingesting data into a managed review set within the Purview boundary. The platform performs optical character recognition on image files, extracts text from container files, identifies near-duplicates, and reconstructs email conversations into cohesive threads. Legal teams can conduct early case assessment, cull non-responsive items using predictive coding, and export only the refined production set to outside counsel.

Preservation Mechanics in Exchange and SharePoint

Understanding preservation storage mechanics prevents unexpected quota exhaustion during active litigation. When a hold attaches to an Exchange Online mailbox, the DiscoveryHolds subfolder expands as users edit or delete messages. Microsoft 365 provides an auxiliary archive and auto-expanding archiving capabilities for the Recoverable Items folder, increasing preservation capacity beyond standard primary mailbox limits.

In SharePoint Online and OneDrive, the Preservation Hold Library shares the overall storage allocation of the site collection. If custodians under hold routinely modify large engineering drawings, database backups, or video files, the Preservation Hold Library captures a full binary copy for every modification event. IT administrators must monitor site storage consumption to ensure active holds do not push document libraries past site quota thresholds.

Step-by-Step Procedure to Create a Legal Hold

To place a legal hold within Microsoft Purview, follow this operational sequence:

1. Access the Case: Open the Microsoft Purview compliance portal, select eDiscovery, and open your target matter.
2. Open the Holds Tab: Within the case dashboard, select the Holds tab and click Create to launch the hold wizard.
3. Name the Hold Policy: Enter a standardized naming convention, such as Hold_Matter2026_Smith_Custodian, and record the assigned legal lead and matter number.
4. Select Content Locations: Choose the specific data sources to preserve. You can select individual Exchange mailboxes, SharePoint site collections, OneDrive accounts, and Microsoft 365 groups.
5. Define Hold Conditions: Choose between an infinite hold and a query-based hold. An infinite hold preserves all existing and future content in the selected locations. A query-based hold applies specific filter criteria, such as date boundaries or keywords.
6. Review and Submit: Confirm your configuration settings and submit the policy. Purview initiates policy distribution across the underlying workloads, which can take up to twenty-four hours to propagate fully across all tenant locations.

Scoping Queries with Keyword Query Language

Keyword Query Language (KQL) forms the foundation of all Purview search queries. KQL supports free-text keywords, Boolean operators, and property-value pairs that target specific document attributes:

• Boolean Logic: Combine terms using uppercase operators (AND, OR, NOT). Lowercase operators are treated as search words rather than logic gates.
• Date Restrictions: Scope communications to relevant time windows using property syntax, such as received:2025-01-01..2025-12-31 for Exchange or lastmodifiedtime:2025-01-01..2025-12-31 for SharePoint.
• Sender and Recipient Scoping: Target custodian communications using from:custodian@company.com or participants:contractor@partner.com.
• File Type Filters: Restrict document discovery to specific extensions, such as filetype:pdf OR filetype:docx OR filetype:xlsx.

KQL queries must account for unindexed items. Files that are password-protected, encrypted, corrupted, or formatted in unsupported file types cannot be parsed by the indexing engine. Purview flags these as partially indexed items. In high-stakes litigation, legal defensibility requires exporting both indexed search results and partially indexed files to ensure potential evidence is not omitted.

Exporting PST Packages and Unindexed Items

When search results are validated, the administrator initiates the export job. Purview offers three primary packaging options for Exchange content:

1. One PST file for each mailbox: Creates an independent PST archive for each custodian. This is the preferred format for legal review because it preserves custodian boundaries.
2. One PST file containing all messages: Merges messages from all selected mailboxes into a single archive file. This option complicates multi-custodian organization and increases the risk of PST file corruption.
3. Individual loose messages (.msg): Exports every email as an individual file in a folder tree. While this eliminates PST corruption risks, it dramatically increases file counts and directory depth.

SharePoint and OneDrive files export as native documents within a structured folder hierarchy reflecting the original site library layout.

To download the exported package, administrators must copy the unique Export Key from Purview and launch the Microsoft Office 365 eDiscovery Export Tool. This ClickOnce application connects directly to Microsoft Azure blob storage endpoints to download the encrypted archive packages to a designated local drive or network share.

The Post-Export Review Bottleneck

Litigation teams face several technical challenges when handling raw Purview exports:

• PST File Fragility: Outlook PST files frequently corrupt when they exceed twenty gigabytes or when multiple users attempt to access them across network file shares. Mounting PST files into desktop Outlook instances is slow, exposes email archives to accidental modification, and prevents concurrent review.
• Transmission Friction: Email attachments cannot handle multi-gigabyte litigation archives. Shipping encrypted physical hard drives introduces shipping delays, courier costs, and physical chain-of-custody risks. Consumer cloud drives lack matter-centric access controls and legal audit logs.
• Loss of Context: When files are extracted from SharePoint and Teams, they lose their relational context unless outside counsel has a workspace structured around the original matter framework.

Structuring Matter Workspaces and Scoped Shares

To bridge the gap between Purview collection and litigation review, firms establish dedicated matter workspaces using platforms like Fast.io Workspaces. A matter-centric workspace serves as the central repository where litigation teams ingest, organize, and control discovery data.

A defensible matter architecture uses a standardized directory structure:

Matter_2026_Acme_Litigation/
├── 01_Purview_Raw_Exports/
│   ├── Custodian_Smith_PST/
│   ├── Custodian_Jones_PST/
│   └── Unindexed_Items_Archive/
├── 02_Extracted_Document_Exhibits/
│   ├── Contracts_and_Agreements/
│   ├── Internal_Financial_Records/
│   └── Technical_Specifications/
├── 03_Attorney_Work_Product/
│   ├── Chronologies_and_Summaries/
│   └── Deposition_Outlines/
└── 04_Production_Sets/
    ├── Production_2026-04-15_Vol001/
    └── Production_2026-05-20_Vol002/

Within this structure, administrators apply granular permissions at the workspace, folder, and file level. Internal legal staff retain editing rights across the matter, while specialized review vendors receive access restricted to specific exhibit folders.

When delivering discovery sets to outside counsel or co-counsel, teams use branded Fast.io Shares. Rather than emailing unencrypted links or mailing drives, administrators configure scoped Send, Receive, or Exchange shares with password protection and strict expiration dates. External attorneys access and download documents directly through their browser without consuming paid organization seats, keeping client delivery fast, branded, and strictly access-controlled.

Structured Document Extraction with Metadata Views

Raw discovery exports often leave attorneys sorting through thousands of unstructured PDFs, scanned exhibits, and office documents. Manually indexing contracting parties, execution dates, governing law clauses, and monetary amounts consumes hundreds of paralegal hours.

Legal teams can turn these unstructured discovery archives into organized, queryable databases using Fast.io Document Data Extraction with Metadata Views. Instead of writing rigid OCR templates or building complex database schemas, legal ops professionals describe the fields they need in plain English. The platform automatically identifies relevant documents in the workspace and populates a filterable, sortable view containing extracted values, such as counterparty names, effective dates, Bates numbers, and contract totals. Attorneys can filter across hundreds of exhibits in seconds, isolating critical trial documents without tedious manual review.

Defensible Audit Trails and Version Records

Defensibility requires verifying every document touchpoint. In a dedicated matter workspace, every action must be recorded in an append-only audit log. The audit trail logs when a file was uploaded from a Purview export, who previewed the document, which attorney downloaded the archive, and when a production share link was created.

Coupled with per-file version history, litigation teams can prove that an exported document remained unchanged throughout the review process. If an attorney annotates or updates a file, the platform preserves prior versions, ensuring original evidentiary files remain pristine.

When structuring compliance and eDiscovery workflows, firms must always consult their own counsel and internal records management policies regarding specific statutory retention periods and jurisdictional preservation obligations. For teams seeking a structured, secure collaboration layer for litigation records, exploring Fast.io Legal Solutions provides a proven blueprint for managing matter lifecycles from initial collection to final production.