Microsoft Purview eDiscovery
Case-based legal investigation, multi-workload KQL content search and evidence export across Microsoft 365.
Difficulty
Intermediate
Environment
Microsoft 365 / Purview
Deployment
Production
Est. Implementation
1–2 weeks
Executive Summary
This project implements Microsoft Purview eDiscovery (Standard) for legal and compliance investigations, covering case creation, multi-workload data source configuration, KQL-based content search, results review and structured evidence export.
A Finance Investigation case was created end to end — spanning Exchange Online, SharePoint Online, OneDrive and Microsoft Teams — demonstrating the full case-based investigation lifecycle required for legal holds, HR investigations and regulatory requests.
Business Problem
Legal and HR teams had no centralised way to search Exchange, SharePoint, Teams and OneDrive together, no legal hold mechanism to preserve a departing employee's communications, and no structured, exportable evidence workflow for external auditors.
When legal, HR or regulatory requests arrive with tight deadlines, a manual, per-workload search process is slow, inconsistent, and risks missing evidence — exposing the organisation to sanctions or adverse findings.
Business Risks
- No centralised search capability across Exchange, SharePoint, Teams and OneDrive
- No legal hold mechanism — account deletion could destroy evidence
- Manual, inconsistent collection risking missed evidence
- No documented, repeatable investigation process for regulators
Compliance Concerns
- Legal hold and litigation-readiness requirements
- Regulatory evidence production requirements
- Auditable investigation and export workflow
Solution Overview
Microsoft Purview eDiscovery (Standard) organises every investigation activity inside a named case, providing role-based access, search history and export jobs in one auditable container.
A Finance Investigation case was created, data sources across Exchange Online, SharePoint Online, OneDrive and Microsoft Teams were added, and a KQL query combining sender, subject, date range and file-type conditions was built, executed and reviewed before exporting a structured evidence package.
Architecture
Architecture diagram placeholder
Technology Stack
Microsoft Purview eDiscovery (Standard)
Case management, KQL search and export
KQL (Keyword Query Language)
Precise multi-condition search across workloads
Exchange Online / SharePoint / OneDrive / Teams
Searched Microsoft 365 data sources
Unified Audit Log
Records all case activity for audit evidence
PowerShell
Case creation, inventory and export automation
Lab Environment
- Tenant
- Microsoft 365 E5 Trial
- eDiscovery Tier
- eDiscovery Standard
- Case Name
- Finance Investigation
- Data Sources
- Exchange Online, SharePoint Online, OneDrive, Microsoft Teams
- Search Type
- KQL (Keyword Query Language)
- Export Format
- Evidence package (PST / CSV)
Implementation
A phased, expandable walkthrough. Screenshots and evidence can be attached to each phase.
Confirm eDiscovery access and the investigator's role assignment.
- Navigate to compliance.microsoft.com → Solutions → eDiscovery
- Confirm eDiscovery (Standard) is available
- Assign the eDiscovery Manager role — not granted automatically to Global Admins
Screenshots for this phase can be added here.
PowerShell
Illustrative example snippets — copy or download each script. Production values are placeholders.
Create an eDiscovery case
# Illustrative scaffold based on New-eDiscoveryCase.ps1
.\New-eDiscoveryCase.ps1 `
-CaseName "Finance Investigation" `
-Description "Finance-related emails and documents investigation" `
-Members "investigator@yourtenant.onmicrosoft.com"List eDiscovery cases
# Illustrative scaffold based on Get-eDiscoveryCases.ps1
Get-ComplianceCase | Select-Object Name, Status, CreatedDateTimeConfiguration Screenshots
Click any tile to open the lightbox. Real screenshots will replace these placeholders.
Phase 1 · Overview
Phase 2 · Create Case
Phase 3 · Content Search
Phase 4 · Export Results
Validation
eDiscovery Accessible
Solution accessible at compliance.microsoft.com with the Manager role assigned.
Case Created
Finance Investigation case created and visible in the cases list.
Data Sources Added
Exchange, SharePoint, OneDrive and Teams added to the search.
KQL Search Executed
Search configured and executed successfully.
Results Reviewed
0 items returned — expected behaviour in a low-activity test tenant.
Export Accessible
Export screen accessed with configuration options available.
Challenges
eDiscovery Manager role not automatic
Global Administrators are not automatically granted the eDiscovery Manager role — it must be assigned explicitly before a case can be created.
Empty results in a test tenant
The content search returned 0 matching items, which is expected behaviour in a newly provisioned tenant with minimal sample data — the workflow itself is unaffected.
Lessons Learned
- Always run content searches inside a case — searching outside a case provides no investigation audit trail.
- KQL precision (sender, subject, date range, file type) prevents scope creep from broad keyword-only searches.
- Use Microsoft Edge for the eDiscovery export function; some export integrations are unreliable in other browsers.
- Test tenants with minimal activity will legitimately return 0 results — this does not indicate misconfiguration.
Business Impact
4 workloads, 1 case
Unified Investigation
Structured export
Litigation Readiness
Case-based activity log
Audit Trail
Repeatable process
Reduced Risk
Skills Demonstrated
Related Certifications
Certifications this project maps to are highlighted.
Related Blog Articles
Placeholder cards — future TechCertGuide integration.
GitHub Repository
lokeshm-it/Microsoft-Purview-eDiscovery
PublicCase-based eDiscovery investigation — KQL content search and evidence export implementation.
Download Center
Project Case Study
PDF · Available soon
Architecture Diagram
PDF · Available soon
PowerShell Scripts
ZIP · Available soon
Technical Documentation
PDF · Available soon