Microsoft Purview eDiscovery Checklist for Small Business

A legal complaint can turn an ordinary Microsoft 365 account into a source of evidence overnight. Microsoft Purview eDiscovery helps small businesses identify, preserve, search, review, and export content, but the tool won't decide what must be kept or produced.

Use this checklist to organize the technical work before a dispute or investigation grows. Coordinate every preservation and disclosure decision with qualified legal counsel. IT can configure Microsoft 365 and document actions, but this checklist isn't legal advice.

Phase 1: Define the matter and confirm licensing

Before anyone searches a mailbox or file site, create a clear record of what triggered the matter. A defined scope helps limit unnecessary access and reduces irrelevant search results.

Record the matter details

  • Give the matter a unique name and internal case number.
  • Ask counsel to identify the people, topics, systems, and date range involved.
  • Record whether the matter involves litigation, an internal investigation, a regulatory request, or an employment dispute.
  • Note deadlines for preservation, review, production, and responses.
  • Identify who can approve changes to the scope.

Avoid searching the entire tenant without a reason. Broad searches may expose unrelated employee data and create a much larger review workload.

Match the license to the workflow

Microsoft currently separates the service into Microsoft Purview eDiscovery (Standard) and Microsoft Purview eDiscovery (Premium) .

Standard supports the basic case workflow, including case creation, assigning eDiscovery managers, searches, holds, and exports. Premium adds a broader preserve, collect, analyze, review, and export process. It also includes review sets and a legal hold notification workflow.

Microsoft's current licensing guidance generally connects Standard capabilities with eligible Microsoft 365 Enterprise E3 subscriptions. Premium capabilities usually require Microsoft 365 E5, Office 365 E5, or a qualifying E5 add-on. Licensing can apply to both the administrator performing Premium work and the users whose data is analyzed.

Microsoft's commercial product page currently lists a Purview eDiscovery offering at $12 per user per month when paid yearly. Treat that figure as a starting point, not a final quote. Your tenant, agreement, region, and user licensing may change the cost. A provider that handles Microsoft 365 business support can help review your current entitlements before a case begins.

Phase 2: Assign roles and preserve information

A small company may have one person handling several tasks, but legal decisions and technical actions should remain clearly documented.

Give each person a defined responsibility

A practical case team may include:

  • Counsel or a designated legal lead, who sets the preservation scope and approves hold or release decisions.
  • A Microsoft 365 administrator, who creates the case, assigns permissions, applies holds, runs searches, and records technical actions.
  • A business owner or department manager, who confirms custodians and helps identify business terms.
  • Custodians, who preserve relevant information and answer questions about names, projects, and communication habits.

Don't give every administrator access to every case. Use case-level permissions where available, and review access before adding a new person.

Protect the tenant before searching

  • Use named administrator accounts instead of shared credentials.
  • Require multifactor authentication for administrators and reviewers.
  • Assign only the Purview roles needed for the person's task.
  • Record who created the case, changed permissions, applied a hold, or started an export.
  • Make sure a departing employee's account and files aren't deleted before counsel reviews the preservation plan.

Preservation comes before investigation. If relevant information disappears while the business is still deciding what to search, later results may be incomplete.

Phase 3: Microsoft Purview eDiscovery checklist for legal holds

Microsoft 365 stores business information in several locations. A mailbox search alone may miss relevant files stored in a user's OneDrive or a SharePoint site.

Identify custodians and data sources

Start with people and locations, then build search terms. Microsoft Purview eDiscovery supports core Microsoft 365 sources such as Exchange Online mailboxes, OneDrive sites, and SharePoint sites. Administrators can select users or groups, or add SMTP addresses and site URLs in bulk.

  • List current and former employees connected to the matter.
  • Identify shared mailboxes, team sites, project sites, and OneDrive accounts that may contain relevant records.
  • Record aliases, alternate email addresses, and department names.
  • Confirm the start and end dates with counsel.
  • Ask whether Teams or other connected workloads need review, then confirm current support and search behavior before relying on those results.

Include only sources tied to the matter. A smaller, accurate collection is easier to protect and review than a tenant-wide copy of unrelated information.

Apply and verify the hold

An eDiscovery hold preserves content connected to a specific case. It isn't the same as a general retention policy. Retention policies manage records according to broader organizational rules, while an eDiscovery hold preserves information for a particular investigation or dispute.

  • Create the case before applying the hold.
  • Add the approved custodians and locations.
  • Record when the hold became active and who applied it.
  • Confirm that the hold covers the correct mailboxes, OneDrive sites, and SharePoint sites.
  • Ask counsel whether custodians need a written legal hold notice.

Content deleted by a user while covered by a hold can remain preserved in a hidden hold location. Still, don't assume that a hold covers a source that was never added to the case. Premium includes tools for managing legal hold notifications, but counsel should control the wording, recipients, deadlines, and follow-up process.

Phase 4: Search with a tested plan

A defensible search is reproducible. Someone else should be able to see what terms, sources, filters, and dates produced the results.

Build focused searches

Use known facts rather than guessing at every possible phrase. Search terms may include project names, customer names, contract numbers, subject-line phrases, and relevant participants.

  • Search date ranges that match the approved scope.
  • Include sender, recipient, and custodian filters when appropriate.
  • Account for spelling variations, aliases, abbreviations, and common file names.
  • Run separate searches when different custodians or locations need different terms.
  • Save the final query, filters, data sources, date, administrator, and result count.

Keep the original search definitions. If you broaden a query later, save it as a new search instead of overwriting the first version.

Validate the results

Run a known-item test when possible. A known email or document that should appear in the results gives the administrator a way to check dates, aliases, permissions, and source selection.

Review a sample for false positives and missing content. A result count of zero doesn't prove that no relevant information exists. It may indicate an incorrect date boundary, an unrecognized alias, an omitted site, or a search that is too narrow.

Microsoft Purview eDiscovery can export search results, but search output still needs human review. Counsel should decide what is relevant, privileged, confidential, responsive, or subject to another restriction.

Phase 5: Review and export evidence safely

The right review process depends on the case size and your license. Standard may be enough for a small, focused search. Larger matters may need Premium's collection and review tools.

Use review sets when Premium is available

Premium adds collections and review sets to the case workflow. A review set is a static group of documents that authorized users can query, view, tag, analyze, and export.

Use it when the matter includes many documents or requires several reviewers. Keep an agreed tagging structure, and document decisions about duplicates, privileged material, personal information, and responsive records.

If your business has Standard only, you can still run searches, place holds, and export results. However, a document-by-document review may require Premium or a separate review platform. Confirm the need with counsel before purchasing or changing licenses.

Export and secure the files

Microsoft supports mailbox exports as PST files or individual messages. SharePoint and OneDrive content exports as native copies. In Premium, exports run from the review set and can be tracked in Process manager.

  • Confirm the export scope and filters before starting.
  • Save the export name, case name, operator, and completion time.
  • Download completed export content within 30 days, because Microsoft gives that retrieval window after the process finishes.
  • Store the original export in a restricted location.
  • Record who received a copy and when.
  • Follow counsel's instructions for metadata, hashes, load files, and chain-of-custody records.

Don't edit, rename, or reorganize the original export before handing it to counsel. Create working copies for review. Store a protected backup according to the case instructions, using a service that supports business backup and disaster recovery, but don't let a backup replace an eDiscovery hold.

Phase 6: Close the case and keep the record

A case file should show what happened, not only the final export. Good records help the business explain its actions months later.

Document the full activity history

  • Save the approved scope and custodian list.
  • Keep hold details, notices, search queries, result counts, and export records.
  • Record errors, changed searches, permission changes, and decisions to exclude sources.
  • Limit access to the case record after the active review ends.
  • Store counsel's instructions with the matter documentation.

Microsoft 365 audit records can help confirm administrative actions and account activity. A separate Microsoft 365 audit log review checklist can help administrators organize that review. Audit logging doesn't replace the case log, so keep both where appropriate.

Release holds only with approval

Don't remove a hold because the search or meeting is finished. Obtain written approval from counsel, confirm that no related hold or matter remains active, and document the release date and administrator.

After release, follow the business's retention and deletion rules. Keep case records and exports for the period counsel approves, then remove access and dispose of copies securely.

Common mistakes small businesses should avoid

  • Searching before identifying custodians can leave relevant sources unprotected.
  • Giving every global administrator access increases the chance of accidental changes or unnecessary exposure.
  • Assuming an E3 or E5 label automatically includes every eDiscovery feature can create delays during an urgent matter.
  • Treating Microsoft 365 synchronization or ordinary backups as a legal hold can leave gaps in preservation.
  • Waiting several weeks to download an export can cause the 30-day retrieval window to expire.
  • Relying on one broad keyword search can miss aliases, alternate locations, and relevant date ranges.

When a case involves sensitive employee, customer, health, financial, or privileged information, bring in counsel before collecting or sharing content.

Conclusion: Keep the eDiscovery process controlled

Microsoft Purview eDiscovery works best when the business defines scope, confirms licensing, limits access, preserves information, tests searches, and documents every major action. Standard may fit a focused case, while Premium provides the review and legal hold workflow needed for larger matters.

A small business doesn't need a large legal department to begin responsibly. It does need qualified counsel for legal decisions and a Microsoft 365 administrator who can preserve evidence without changing it.

ASK AN IT PRO