In plain English
When your organisation becomes involved in litigation or a regulatory investigation, you may be legally required to produce electronic records — emails, documents, chat logs. eDiscovery tools in Microsoft Purview allow legal and IT teams to search and preserve relevant data across the entire Microsoft 365 environment without disrupting ongoing operations.
Full definition
When litigation starts, or when a regulator asks for records, your obligation to produce relevant documents kicks in immediately. eDiscovery is the process of finding, preserving, and exporting that electronically stored information in a format that holds up legally. Get it wrong and you may be seen as destroying or withholding evidence, which is a far worse position than whatever the original dispute was about.
In , handles this. Legal or compliance teams can search across Exchange mailboxes, Teams messages, sites, and files simultaneously, filtering by sender, date range, keyword, or custodian. When relevant content is identified, a freezes it. The data can't be deleted or modified by the user, even if normal retention policies would otherwise remove it. Exports are formatted to meet chain-of-custody requirements.
Consider a practical scenario. An employee raises a workplace complaint in March, and by April the matter is heading toward Fair Work. The legal team needs every Teams conversation and email that person sent or received over six months. Without eDiscovery tooling, that means manually contacting IT, hoping backups are intact, and attempting to reconstruct threads across multiple systems. With Purview, the search runs in minutes and the hold is applied the same day. The Australian Privacy Act also factors in here: eDiscovery processes need to account for the of third parties captured in the same search results, not just the primary custodian.