Microsoft Purview eDiscovery has become a core tool for legal, compliance, and investigation teams working inside Microsoft 365. It can interrogate data across Exchange, SharePoint, OneDrive, and Teams without first moving it into a separate system.
As valuable as that capability is, however, it doesn’t mean Microsoft Purview eDiscovery is the right choice in every case. Knowing where its capabilities begin and end can be what separates an efficient, defensible matter from a costly one.
What is Microsoft Purview eDiscovery?
Microsoft Purview eDiscovery is Microsoft’s native investigation and data discovery capability for identifying, preserving, reviewing, and exporting content from across Microsoft 365 services. It supports a wide range of work: legal matters, regulatory responses, internal investigations, and privacy requests such as data subject access requests (DSARs).
For organisations already invested in Microsoft 365, that native integration makes Purview a strong starting point for eDiscovery – there is no separate platform to license, deploy, or move data into. Whether it’s the right choice for a given matter, though, depends on the complexity and scope involved, and that is where the differences between its capability tiers begin to matter.
What's the difference between eDiscovery (Standard) and eDiscovery (Premium)?
eDiscovery (Standard) and eDiscovery (Premium) – once separate products – are now two tiers within a single platform: Microsoft Purview eDiscovery. Which tier an organisation can use is determined by its Microsoft 365 licensing.
Standard covers the essentials: search, legal hold, case management, and export. For straightforward matters with a contained scope, that’s often all a team needs.
Premium adds the capabilities that make larger or contested investigations workable: custodian management, advanced indexing, review sets, analytics, conversation threading, near-duplicate detection, and predictive coding.
Capability | eDiscovery (Standard) | eDiscovery (Premium) |
|---|---|---|
Search and export | Yes | Yes |
Case management and legal hold | Yes | Yes |
Custodian management | No | Yes |
Advanced indexing | No | Yes |
Review sets and filtering | No | Yes |
Analytics, threading and near-duplicate detection | No | Yes |
Tagging and predictive coding | No | Yes |
Which Purview eDiscovery features support complex investigations?
Four Premium capabilities do most of the work once an investigation outgrows a routine search.
- Custodian management links data sources to named individuals, so evidence is organised around the people involved rather than around raw locations. This makes the scope of a collection easier to explain and to stand behind later.
- Advanced indexing re-processes content that was only partially indexed at first pass (e.g. large attachments or unusual file types) so the full item is searchable and appears properly in search and review rather than slipping through unnoticed.
- Threading and near-duplicate detection reduce review volume by grouping repetitive content and surfacing the most complete version of a conversation, rather than forcing a reviewer through every near-identical copy.
- Review sets and analytics give teams a single workspace to filter, prioritise, and analyse high volumes of data, which is where time is won or lost once a matter reaches real scale.
How does Purview support DSARs and internal investigations?
Purview helps most in privacy and investigation work by narrowing what gets collected in the first place. Keyword, date-range, and sender or recipient parameters let teams target relevant material at source, which lowers the risk of over-collection and the review burden that follows it.
Review efficiency matters especially in DSAR work, where deadlines are fixed and volumes are unpredictable. Threading and duplicate reduction speed up the read-through, and a tidier review set makes systematic redaction far more manageable.
None of this removes the need for a sound process, however. Strong tooling does not, on its own, make a search defensible: the queries, the review decisions, and the eventual disclosure still have to be ones the organisation can justify if challenged.
Where do native Microsoft 365 eDiscovery tools reach their limits?
Purview is built around Microsoft 365, and that’s where it’s strongest. It’s possible to ingest data from other platforms such as Slack, Zoom, and Google Workspace, but this requires specialised connectors, adding cost, setup, and more layers to manage. The further a matter reaches outside the Microsoft estate, the more that overhead builds.
Microsoft Purview eDiscovery can support large-scale investigations, but it still has practical limits. The volume of material that can be held for review is capped, and its analytics capabilities may not be advanced enough for complex matters.
Access to Purview eDiscovery is also not the same as the expertise to use it. Constructing a defensible search, and handling sensitive or volatile data without altering metadata, calls for forensic-grade knowledge that most internal teams are not staffed to provide day to day.
High-volume, time-sensitive, or high-risk matters tend to expose this quickly. A regulatory deadline or a contested dispute is exactly the kind of pressure that brings gaps in capacity, workflow, and cross-platform collection to the surface.
Do you need a partner if you already have Purview?
t’s a common misconception that you either leverage Purview and handle eDiscovery in-house, or you bring in a specialist partner with their own tools. In reality, a hybrid approach is often the best choice for complex matters.
A partner like Salient isn’t there to replace the tool you already own, but to help you get more from it through hands-on support during an investigation and – where it’s useful – training your team to handle more of the work themselves.
External experts can also bridge the gaps in Purview’s process and coverage, supporting cross-platform collection, forensic handling, defensible methodology and end-to-end review management.
The real question, then, isn’t whether Purview is capable – it is. It’s whether your team has the time, the experience, and the workflow maturity to use it well when a matter is complex, contested, or moving fast.
