Microsoft 365 litigation hold and content search for law firms and legal teams

Microsoft retired the classic eDiscovery experiences, including classic Content Search, eDiscovery (Standard) and eDiscovery (Premium), on August 31, 2025. Everything now runs from eDiscovery in the Microsoft Purview portal, where the case is the central organizing unit and Content Search lives inside a system-generated case. Older guides and screenshots that refer to the compliance portal are out of date.

Which features you can use depends on licensing. Microsoft's documentation describes core search, hold and export, with premium features (such as review sets, analytics and certain query-based or custodian-scoped holds) requiring E5-level licences or add-ons. Check your licences before relying on any particular feature.

Retention is for running the organization; holds are for matters. When both apply to the same content, Microsoft's principles of retention keep it for the longest applicable period, so a hold wins over a retention policy that would otherwise delete. Microsoft recommends retention policies and eDiscovery holds over older mechanisms, while noting that mailbox Litigation Hold remains supported.

1. 01

   Permissions

   Assign the people running the matter to the eDiscovery Manager role group in Purview. Keep membership small; case contents are sensitive.

2. 02

   Create the case

   In the Microsoft Purview portal, open the eDiscovery solution, select Cases, and create a case named for the matter. Add case members.

3. 03

   Create the hold policy

   In the case, open the Hold policies tab and select Create policy. Name it, then add data sources: users (their mailbox and OneDrive), groups and Teams, and SharePoint sites.

4. 04

   Choose the scope

   Either hold all content in those locations or define a query and date range. For encrypted or partially indexed items, Microsoft advises limiting query conditions to date, participants and type.

5. 05

   Apply and verify

   Select Apply hold, then check the Details tab for each location's hold status. Allow up to 24 hours for the hold to take effect, and recheck.

Searches are created from the case's Searches tab. Build them with the condition builder or Keyword Query Language (KeyQL), and use Generate statistics to see hit counts per location and per keyword before you export anything.

Scoping is where proportionality, as described in the Sedona Canada Principles, becomes practical. Agree the custodians, date range and key terms with counsel, run statistics, and adjust. Keep each version of the query and the statistics it produced; they explain later why the final search looks the way it does.

• Search for exact phrases in quotation marks, and test term variants
• Check partially indexed items (encrypted files, unusual formats) separately; they can be missed by keyword searches
• Remember Teams chats, meeting recordings and cloud attachments linked from email
• Note that the SharePoint Recycle Bin is not indexed and cannot be searched

From a search, select Export. Options include PST files per mailbox or a single PST, individual .msg messages, which SharePoint and OneDrive document versions to include, cloud attachments, and how packages are organized and sized. The export generates reports such as an items.csv file listing each item with its metadata and source location.

Microsoft stages exports in Microsoft-managed Azure storage before download. Once downloaded, compute your own hash values (for example SHA-256) for each package and record them with the export name, date, operator and search query. That record, and the reports Microsoft produces, are your evidence that the production matches what was collected.

If a hold or retention policy applies to a mailbox before the user's account is deleted, the mailbox becomes an inactive mailbox and its content is retained and searchable. If the account is deleted first with no hold, the mailbox is soft-deleted and eventually removed. Make 'check for holds' a step in every offboarding, and consider placing departing employees in relevant matters on hold before their accounts are touched.

OneDrive content for deleted users follows separate retention settings, so check those too.

• Case name, members and creation date
• Each hold: data sources, query, date applied, verification of status
• Each search: query versions, statistics, date run
• Each export: options chosen, date, operator, hash values, and the reports produced
• Holds released: date and counsel's written instruction