eDiscovery in Purview: controlling an investigation tool as powerful as an administrator
eDiscovery lets you search, preserve and export content across every mailbox, site and Teams conversation in the tenant. It is a valuable tool for internal investigations and litigation. In practice it is also read access to the company's entire mailbox estate, which we often find granted with no oversight.
Read access to the whole tenant
An eDiscovery search can cover every mailbox, every SharePoint and OneDrive site, and Teams conversations. It lets you preview results and export them. In other words, whoever holds these rights can read the mail of the chief executive, HR or the legal department, without leaving any trace in the mailboxes concerned.
Microsoft has merged the former "Content search", "eDiscovery (Standard)" and "eDiscovery (Premium)" experiences into a unified eDiscovery experience in the Purview portal. Advanced features (review, analytics, custodian management) still depend on licensing; check the current state in your tenant.
Roles and their scope
The eDiscovery Manager role group has two subgroups:
- eDiscovery Managers: they create and manage their own cases and only see the cases they are members of;
- eDiscovery Administrators: they can access every case in the organisation and add themselves to any of them.
Other roles, such as "Compliance Search", "Export", "Preview" or "Hold", can also be assigned in custom role groups. That is where forgotten permissions tend to hide: a provider who ran a migration, an administrator who troubleshot a search two years ago.
Treat it as a privileged role. Members of eDiscovery groups should be few, named individuals, protected by phishing-resistant authentication and, where possible, activated just in time. A compromised eDiscovery account exposes as much data as an Exchange administrator.
Cases, holds and scope
A properly run investigation goes through a case, which brings together searches, holds, exports and authorised members. Working outside a case, with standalone searches, makes follow-up almost impossible.
Holds preserve the content of the custodians concerned, even if they delete their messages. Two risks to watch: holds that are never released, keeping personal data indefinitely, and holds released by mistake during litigation. Every hold should be tied to an active case and reviewed when the case closes.
To limit the reach of searches, search permissions filters let you restrict what a group of investigators can search, for example to the mailboxes of one subsidiary or region. This is useful in multi-entity groups.
Separation of duties and internal framework
Technology is not enough. An internal investigation touches on employees' privacy and must follow a defined framework:
- a written request from an authorised function (legal, HR, management) with a precise purpose;
- approval by someone other than the person running the search;
- a limited scope: custodians, date range and keywords proportionate to the purpose;
- traceability of exported results and who received them;
- formal closure: holds released, exports that are no longer needed deleted.
In France, content that an employee has identified as personal enjoys specific protection, and the proportionality of investigations is assessed strictly. Have the procedure validated by your legal department or counsel, and involve your data protection officer.
Auditing eDiscovery itself
eDiscovery actions are recorded in the unified audit log: case creation, members added, searches created and run, previews, exports, holds. These events should be monitored just like changes to administration roles. A search run outside a case, a large export or a new eDiscovery Administrator being added all warrant an alert and a check with the requester.
Finally, decide who oversees the investigators: the person reviewing the eDiscovery activity log should not be the one running the searches.
What an audit checks
- Members of eDiscovery role groups, especially eDiscovery Administrators.
- Custom role groups containing search, preview or export roles.
- Protection of these accounts: strong authentication, just-in-time activation.
- Open cases, their holds and how old they are.
- Whether a written request and approval procedure exists.
- Monitoring of eDiscovery activity in the audit log.
- Use of search permissions filters where scope needs to be limited.