The classic experience was retired in 2025. If your process document still describes it, your process does not exist.
Microsoft retired all classic eDiscovery experiences on 31 August 2025, including classic Content Search. The current experience is case-centric, indexes automatically, folds Content Search into a system-generated case, and adds Security Copilot for drafting queries. Most organisations here have not looked since the change.
- Six servicesExchange, Teams, Groups, OneDrive, SharePoint, Viva Engage
- Case-centricCases replaced custodians as the organising unit
- Auto-indexedAdvanced indexing runs on every search
- DecryptionLabelled and rights-protected content handled
Five differences from the version most process documents describe.
Microsoft retired all classic eDiscovery experiences on 31 August 2025, including classic Content Search, classic eDiscovery Standard and classic eDiscovery Premium. If nobody has run a matter since, expect these.
- Collections are gone. Statistics in searches replace them, showing insights about the items in the results. And searches are no longer immutable, even after results are added to a review set, so you can update a search at any time rather than starting again.
- Custodians are no longer the organising unit. Cases are. You still add people, groups and data sources, but the workflow is built around the case, which changes how a matter is set up from the first step.
- Reindexing is no longer a separate task. Advanced indexing runs automatically during searches scoped for statistics and when adding to a review set or exporting, which removes one of the most common causes of incomplete results in the old model.
- Content Search is no longer a separate solution. It lives in a system-generated eDiscovery case available by default to eDiscovery managers and administrators, with full case capability including holds and review sets.
- Jobs are now called processes, and there is a process report covering cases, searches, review sets and holds, plus tracking for long-running activities. Small change in wording, and it is the one that makes an old runbook read as though the feature has disappeared.
Eight capabilities, and several of them changed in the last two years.
Content Search is now inside eDiscovery
All Content Search functionality is included in a system-generated eDiscovery case, available by default to members of the eDiscovery manager and administrator role groups. That case has the same capability as any other, so holds and review sets can be created in it. If you need to limit who can see those searches, case settings control membership, which is worth checking because the default is broader than people expect.
Cases replaced custodians as the organising unit
In previous versions custodians were the primary component of the workflow. Now the case is the central organising unit, and you add people, groups and data sources to it. That is a genuine change to how a matter is set up, and process documentation written against the old model produces steps that no longer exist in the interface.
Indexing happens automatically, which removes a common failure
Previously you had to separately reindex partially indexed or error-state content before searching, and stale indexes were a routine cause of incomplete results. Advanced indexing now runs automatically during each search scoped for statistics, and when adding results to a review set or exporting. Running or rerunning a search updates all indexes, so the sequential reindex step is gone.
Decryption of your own protected content
Email and attachments encrypted with Microsoft Purview Message Encryption, and documents protected with sensitivity labels or Azure Rights Management, are automatically decrypted when added to search results or review sets. For organisations that have deployed labelling and encryption, this is what stops your own data protection from obstructing your own investigation.
Teams conversations reconstructed, not fragmented
Conversation threading collects the entire chat conversation containing items that matched the search, so reviewers see the back and forth rather than isolated messages. As more substantive discussion moves out of email and into Teams, this is what makes a Teams review comprehensible to a lawyer rather than a stack of context-free lines.
Search and delete, including AI application data
You can search for and delete email messages, Microsoft Teams chat messages, and Copilot and AI application data across the organisation, which Microsoft frames as finding and removing content that is potentially harmful or high-risk. The inclusion of Copilot and AI application data is new territory and increasingly the thing an organisation actually needs to be able to do.
Security Copilot for query drafting and summarising
Copilot translates natural language into Keyword Query Language without the user needing to know operators or supported metadata fields, and provides contextual summaries of most review set items, covering documents, meeting transcripts and attachments. For organisations without a dedicated eDiscovery specialist, this materially lowers the skill barrier to running a competent search.
External reviewers, in preview
Guest user access, currently in preview, allows external reviewers to be invited into a case with the Reviewer role group permission, seeing only the content shared with them. For a matter run with outside counsel, that removes the awkward step of exporting large volumes of material out of the tenant simply so a lawyer can look at it.
Four things that decide whether eDiscovery works when it is needed.
We are clear about where our role ends
We are not lawyers and do not advise on legal obligations, scope of preservation or what must be produced. Your counsel directs the matter. What we do is make the platform capable of executing what they ask for, quickly and defensibly, which is a technical job that lawyers should not have to learn to do themselves.
We rewrite the runbook against the current experience
Microsoft retired all classic eDiscovery experiences on 31 August 2025, and most organisations here have documentation describing custodian-centric workflows, collections and separate reindexing steps that no longer exist. A runbook that does not match the interface is worse than none, because somebody follows it under time pressure and concludes the capability is missing.
We rehearse a hold and an export before anybody needs one
Placing a hold is the step where delay creates real exposure, and exporting in a format your counsel can actually work with is the step where an unrehearsed process fails at the last moment. We walk both through with a real scenario and confirm the export format with your legal advisers in advance rather than discovering it at production time.
We check the permissions and the default case membership
Content Search now lives in a system-generated eDiscovery case available by default to everybody in the eDiscovery manager and administrator role groups. In several tenants we have looked at, that is a wider audience than anybody intended for sensitive searches, and case settings are how you narrow it. It is a five minute check that nobody does.
Six UAE situations where eDiscovery capability gets tested.
A litigation hold arrives from counsel
The immediate obligation is preservation, and the exposure is the gap between receiving the notice and holds actually being in place. Holds secure electronically stored information from inadvertent or intentional deletion, and the practical requirement is a named person who can place one today without a procurement step or a training session.
A regulatory enquiry with a production deadline
For firms under Central Bank, DFSA, FSRA or sector supervision, an enquiry comes with a timescale. Base capability covers search, hold and export. Premium adds review sets, analytics and decryption, which is what turns a large collection into something that can be reviewed within the deadline rather than after it.
An internal investigation into an employee
Frequently escalated from an insider risk case, which the platform supports directly. What matters here is scoping the search precisely, keeping access to the case narrow, and handling any encrypted or labelled content, since a labelled document that cannot be read is a gap in the investigation rather than a security success.
A commercial dispute where the evidence is in Teams
What was agreed, when, and by whom, in a channel or a chat rather than in email. Conversation threading adds the entire conversation containing the matching items, which is what makes a Teams record intelligible as evidence. Without it a reviewer receives fragments and cannot establish sequence or context.
A data subject request under UAE PDPL
Where somebody asks what personal data you hold about them, the search problem is the same even though the legal framework is different. Search across the six supported services with keyword queries and conditions, statistics to establish scope, and export. The obligation is legal, the mechanics are the same platform.
A matter where the evidence is in images or scans
Signed documents photographed on a phone, scanned contracts, screenshots of chats. Optical character recognition extracts text from images and includes it with the content added to a review set, so it becomes searchable. Without it, exactly the material most likely to matter is the material a keyword search cannot see.
What organisations could actually do if a legal matter landed tomorrow.
| Feature | Rehearsed and current | Licensed, never used | Base tier only |
|---|---|---|---|
Can place a hold within hours | Yes | Probably | Yes |
Somebody has done it before | Yes | No | No |
Runbook matches the current interface | Yes | Unlikely | Unlikely |
Can review content in place | Yes | Yes | No |
Encrypted and labelled content readable | Yes | Yes | No |
Teams conversations reconstructed | Yes | Yes | No |
Volume reduced by analytics before review | Yes | Yes | No |
External counsel can review without bulk export | Yes | Preview | No |
Export format agreed with counsel in advance | Yes | No | No |
Frequency in the UAE market | Rare | Common on E5 | Common |
What you can do without E5, and what you cannot.
| Capability | Base eDiscovery | Premium eDiscovery | |
|---|---|---|---|
| Search for content across the six services | Yes | Yes | |
| Keyword queries and search conditions | Yes | Yes | |
| Search statistics and samples | Yes | Yes | |
| Export search results | Yes | Yes | |
| Case management and role-based permissions | Yes | Yes | |
| Place content locations on hold | Yes | Yes | |
| Search and delete data | Yes | Yes | |
| Review sets | No | Yes | |
| Conversation threading for Teams and Viva Engage | No | Yes | |
| Decryption of labelled and rights-protected content | No | Yes | |
| Optical character recognition on images | No | Yes | |
| Cloud attachments and SharePoint versions | No | Yes | |
| Analytics, near duplicates, email threading, themes | No | Yes | |
| Tagging and review set filtering | No | Yes | |
| Import external data into a review set | No | Yes | |
| Guest user access for external reviewers, preview | No | Yes | |
| Security Copilot query drafting and summaries | No | Yes | |
| Graph API authentication | Delegated | Delegated and app-only |
Five steps, all of them completed before a matter arrives.
- 1
Establish what you actually have
Whether premium eDiscovery is available, which requires an E5 subscription or a related add-on, who holds eDiscovery permissions, and who can currently see the system-generated Content Search case. That last item is frequently a wider group than anybody intended.
- 2
Narrow permissions and case access
Role-based permissions configured deliberately, using built-in role groups or custom ones, and case settings used to control membership where searches are sensitive. Broad default access to a case containing an investigation into a named employee is the kind of thing that causes a second problem.
- 3
Rehearse a hold with a realistic scenario
A named person places a hold on real content locations, under a scenario your counsel would recognise, and we time it. This is the step where delay creates exposure, and it is the one that most reliably reveals a missing permission or an out of date instruction.
- 4
Rehearse a search, a review and an export
A keyword query with conditions, statistics to establish scope, and where premium is available a review set with conversation threading, decryption and analytics applied. Then an export, in the format your legal advisers have confirmed they can work with, agreed in advance rather than at production time.
- 5
Write the runbook against the current interface
Documented for the experience as it exists now, not the classic one retired in August 2025, naming who does what, who authorises, who deputises when they are unavailable, and what the escalation path from an insider risk case looks like. Then reviewed annually, because this product keeps changing.
What organisations ask about Purview eDiscovery.
Fifteen questions worth answering now.
Capability
- Do you have premium eDiscovery available?It requires an E5 subscription or related add-on.
- Has anybody run a matter since the classic retirement?Retired 31 August 2025.
- Who holds eDiscovery manager permissions?They see the system-generated Content Search case by default.
- Have you tested a hold?The step that actually preserves anything.
- Have you tested an export?The export flow changed in the new experience.
Process
- Who authorises a hold, and how fast?Delay between notice and hold is the exposure.
- Is your runbook written against the classic experience?If it mentions custodians as the unit, yes.
- Does outside counsel need access?Guest user access is in preview.
- Do you know what your audit retention allows?A separate question with a separate answer.
- Is there an escalation path from insider risk?Cases can be escalated directly.
If it happened this week
- Could you place a hold today?Named person, tested process, no procurement step.
- Would encrypted content be readable?Decryption is a premium capability.
- Could you reconstruct a Teams conversation?Conversation threading is premium.
- Could you export in a format counsel can use?Ask them which, in advance.
- Who runs it if the usual person is away?A single point of failure in most organisations.
The pages around this one.
Purview Audit
The other half of an investigation: who did what and when, with its own separate retention rules.
Insider risk management
Where many internal investigations begin, and which can escalate a case directly into eDiscovery.
Sensitivity labels
The labelling and encryption that premium eDiscovery decrypts, and which without it would obstruct a review.
Ask whether anybody has placed a hold since August 2025.
That is when Microsoft retired the classic experiences. If the answer is no, your process document describes an interface that no longer exists, and the person who has to follow it will be doing so under a deadline set by somebody else.
Related Services
Explore more solutions that work great with this service
Purview Audit
How far back you can actually search, decided before the incident
Insider Risk Management
Data theft by departing staff, detected with users pseudonymised
Sensitivity Labels
Classification that travels with the file, and governs what Copilot sees
Microsoft Purview
Data governance and compliance solutions
UAE PDPL Compliance
Federal Decree-Law 45 of 2021 readiness and operations
Microsoft Security Dubai
Entra, Defender, Purview, Sentinel, and what you already own
IT General Controls
What your external auditor tests, and the evidence they sample
Microsoft 365 Security Audit
Tenant review, and how far back your evidence really goes