For IT & Collaboration Owners
Deliver safe, secure collaboration while satisfying the needs of stakeholders across the business

For Security
Improve your risk posture with a purpose-built solution for collaboration

For Legal
Scale, orchestrate and streamline your eDiscovery process for employee collaboration
For Compliance
Establish a proactive approach to collaboration compliance and information governance

For Employee Experience
Harness insights from surveys and collaboration data to transform the employee experience

AWR-2023_human-behavior-risk-analysis-report_cover art_small
Download the Resource

The Human Behavior Risk Analysis

Learn More →


Connect Aware to the tools you already use to have all your company messaging in one place.

Our Platform

Contextual Intelligence Platform

Aware is a contextual intelligence platform that identifies and reduces risk, strengthens security and compliance, and uncovers real-time business insights from digital conversations at scale.

LEARN MORE → Learn About our AI →
Our Applications


Protect your data and your people with complete, real-time visibility and centralized control of collaboration.

Learn More →

Data Management

Take centralized control and make smarter decisions about what to keep and what to purge.

Learn More →

Search & Discover

AI-powered universal search purpose-built for collaboration. Find information and surfaces the full story—faster.

Learn More →


Automatically capture authentic human signals from modern collaboration to support your most valuable asset.

Learn More →

What's in your data?

Calculate my results →


About Aware

Our leadership, our company


Explore open roles with our remote-friendly, global team


Driving customer value, together

Press Releases

Digital workplace news and insights


How Aware customers streamline operations, reduce risk, and boost productivity


Data security partners & certifications


Get in touch with us


10 Reasons Why Aware is a Top Place to Work

Learn more →


Access reports, webinars, checklists and more.

Explore →


Explore articles devoted to enterprise collaboration, employee engagement, research & more

Explore →
Case Study Promo_2023

How Aware customers streamline operations, reduce risk, and boost productivity

Read More →

What is eDiscovery in Microsoft Office 365?

by Aware

Electronic discovery is the process of identifying, collecting, and presenting electronically stored information (ESI) for litigation, regulatory compliance, or other investigations. In this post, we’ll explore the tools available for legal teams to perform eDiscovery in Microsoft Office 365, the challenges they may face, and how to overcome them quickly and effectively.


What is the difference between Content Search and eDiscovery?

Microsoft Office 365 encompasses many data types, including calendars, documents, email, Microsoft Teams, OneDrive files, SharePoint sites, and more. The result is a complex web of ESI data points that, when eDiscovery is necessary, can be tricky to navigate.

There are several ways to find data source information and user-generated content within the Office 365 apps. The most basic is Content Search. This tool is available in Microsoft’s compliance center and can be used by accounts with E1 licenses or higher. Using Content Search, users can look for relevant content across their Office 365 workspace. It can rapidly search through Exchange mailboxes, SharePoint sites, and OneDrive locations and retrieve up to 1,000 results per search.

Identifying content for review is the first stage of an eDiscovery investigation. However, the eDiscovery process also encompasses data cataloging and governance tasks required for legal cases and regulatory compliance or investigations. Content Search is limited in its ability to support these broader eDiscovery processes.

Read more: Top eDiscovery challenges and how to overcome them

Who can use eDiscovery?

Legal professionals, compliance officers, and IT administrators are all parties who may be interested in eDiscovery processes and require the ability to search and review ESI from Office 365. HR leaders may also need eDiscovery tools during legal or compliance investigations. Therefore, while eDiscovery may fall primarily under the purview of legal teams, other stakeholders can also benefit from eDiscovery capabilities.


Read the case study: How a major restaurant chain resolved a lawsuit using Aware

How do I do an advanced eDiscovery search in Office 365?

Microsoft Office 365’s eDiscovery solution is called Purview. Purview gathers data from the entire O365 ecosystem into one core source, providing a starting point for legal officers to analyze their data.

With Purview, companies can identify custodians’ communications data across all of Office 365’s programs, preserve relevant ESI, and conduct more efficient collection and review.

Related: How to do eDiscovery in Google Drive

How to use eDiscovery in Microsoft Purview?

Access to the eDiscovery features in Purview typically requires E3 or E5 licenses to get started. Additional subscriptions then determine the depth of ESI investigators can obtain through Purview. Companies may need to acquire a premium subscription service to fully unlock all of Purview’s eDiscovery capabilities.

After configuring licenses and subscriptions to ensure all Microsoft Purview users have the necessary access, the next step is to manage permissions to the data itself. This involves determining the categories of ESI for the intended search and identifying who will be responsible for parsing the data when the search is completed. Those parties will need permissions to view the datasets. For eDiscovery administrators not privy to the entire dataset, restrictions should be in place before the search query results are returned.

Microsoft Purview allows users to configure advanced settings before running the search to index the data. Users can then create legal holds to preserve the results in an immutable archive, ensuring its integrity for a court of law. Finally, Purview provides review sets, which are documents that can be tagged, analyzed, queried, viewed, and exported during early case analysis.

Hero_Legal Operations Checklist- Social

Webinar: Your legal ops checklist for collaboration tools

What are the different eDiscovery plans that Microsoft Purview offers?

Microsoft Purview offers 3 tiers of eDiscovery solutions: Content Search, eDiscovery (Standard), and eDiscovery (Premium).

Content Search

  • Enables searching across the Microsoft Office 365 suite, including Teams, Exchange, OneDrive, SharePoint, and more
  • Provides keyword queries and search parameters to narrow search functions
  • Displays search statistics like quantity and size of files found
  • Allows exporting of search results
  • Requires a Microsoft 365 or Office 365 license

 eDiscovery (Standard)

Includes everything in Content search, plus:

  • Enables creation of eDiscovery cases and assignment to specific case managers
  • Allows placing legal holds on content locations to preserve data integrity
  • Facilitates the linking of searches and exports to specific cases
  • Requires an Office 365 or Microsoft 365 E5 license or related E5 add-on subscription

eDiscovery (Premium)

Includes everything in eDiscovery (Standard) plus:

  • End-to-end eDiscovery workflow for identifying, preserving, collecting, reviewing, analyzing, and exporting content
  • Allows managing custodians and the legal hold notification process
  • Includes advanced analytics and machine learning-based predictive coding models
  • Supports features like review set filtering, tagging, and error remediation
  • Requires an Office 365 or Microsoft 365 E5 license or related E5 add-on subscription

What are some limitations of using Microsoft Purview for eDiscovery?

Purview gives stakeholders the power to perform eDiscovery queries and gather necessary ESI for legal and compliance investigations. However, Purview’s complexity and lack of transparency may cause frustration for some users.

For a comprehensive investigation, not only is an eDiscovery Premium subscription required, but each custodian involved must have an E5 license. Additionally, Microsoft charges processing fees to run the search and a storage fee for the data when the search returns results. Depending on the number of custodians and length of investigation, plus the number of touch points for each custodian, it could be terabytes of relevant information to store.

Hero_Governance Checklist- Social-1

Download the checklist to secure your collaboration tools now

Although Purview is capable of running large-scale searches, it only collects data for an index when the search is initiated. It doesn’t ingest data in real-time. As a result, Purview may require days to complete an eDiscovery query, especially if the request is particularly large or complex.

Purview is also limited to searching only across the Microsoft 365 suite of programs. For a company that may also use popular productivity and collaboration tools like Zoom, Google Drive, and Slack, Purview’s eDiscovery solution cannot comprehensively search all their ESI.

Searches within Purview are also limited by the number of custodians, topics, and size they can process, requiring multiple runs and queries to build the necessary eDiscovery data sets. Search parameters have to be queried one at a time and then blended together. This lack of granular customization for complex eDiscovery workflows limits analytics capability as well.


Case study: This nonprofit used Aware's eDiscovery tools to avoid fines and penalties

Once the search is complete, Purview converts all data types into MS Outlook file formats for storage, which may complicate the search and management of the data set. It also limits export content capabilities, since exports can’t be made directly from the search.

Perhaps one of the biggest limitations is that Purview does not allow for role-based access controls and data visibility, reducing who can manage the data sets and work with the results. During indexing, when large amounts of metadata are collected and visible within the ESI, this problem is magnified.

Whitepaper: Aligning Legal & IT on collaboration tool data

Integrate Aware with Office 365 for more powerful eDiscovery

Purview is a powerful eDiscovery tool for Microsoft Office 365, but there are gaps in its capabilities that make it harder to quickly get to data and export it into existing workflows. The Aware platform complements Purview by filling those gaps to strengthen your risk posture within Microsoft collaboration tools.

Aware connects to Microsoft via native APIs and continuously ingests data in real time, creating a search-ready archive that saves legal teams time otherwise lost in indexing data prior to search, and delivers results in user-friendly formats protected by robust, enterprise-grade security.

  • Get the results you need in minutes, not days.
  • Easily create an immutable archive of all data with one-click legal holds.
  • Use Aware’s proprietary NLP and AI-ML models to surface more results with fewer false positives than the leading competitors.
  • Secure your data with RBAC and comprehensive audit logs.
  • Return a user-friendly format that’s easily exported to third-party tools like Relativity.

With Aware, legal teams have the ability to perform full forensic searches and surface results—including deletions and edits—in their complete context, simplifying and accelerating eDiscovery in complex data sets. Contact us today to learn how Aware supports your eDiscovery needs across all your collaboration tools.

Aware demo request

Topics:Google Drive SecurityeDiscovery