Part of Revamp of Purview eDiscovery to Embrace a Unified Framework

Microsoft is in the middle of a campaign to modernize the Purview eDiscovery solution. Previously, I wrote about the announcement and the possible impact on tenants and eDiscovery investigators. The big idea here is that Purview eDiscovery is moving to a unified framework covering all types of eDiscovery activities with the functionality available to users being determined by the license they hold. In a nutshell, E3 means standard eDiscovery, and E5 means access to premium eDiscovery.

The nature of these things is that the devil is in the detail, which only comes out as Microsoft introduces changes to implement the grand plan. An example is in message center notification MC1055528 (14 April 2025), which explains a set of component retirements to implement some big changes from May 26, 2025.

Content Searches Presented in an eDiscovery Case

First, the Content Search option in the Classic eDiscovery (i.e., the eDiscovery UI that Microsoft revamped (badly) in 2021) will disappear. Its replacement is a new Content Search option that displays the set of content searches within the new eDiscovery UI. Be aware that the new UI (which is also used with old cases) is very different to what’s available in classic eDiscovery. The query and locations (search targets) are moved over, but the process of running searches and examining samples of results found by searches is very different.

Essentially, there’s one big eDiscovery case (called Content Search) that holds all the content searches. As you can see from Figure 1, I have content searches going back to January 2015. Someday soon I must clean out the old searches.

Note the two little icons above the list of searches. TR is for me, and EM indicates that my account holds the eDiscovery Manager role.

Removal of Classic eDiscovery Option

Today, the eDiscovery section of the Purview compliance portal includes a Classic eDiscovery option. This option is going away and is replaced by the Cases option. Essentially, all the old eDiscovery cases become standard eDiscovery cases in the new framework. The Content Search case that holds all the old content searches is one of the new cases.

Removal of Export Capability from PowerShell Cmdlets

The compliance PowerShell module contains a set of cmdlets to manage eDiscovery content searches and cases. Microsoft says that they will disable (remove) the export-related parameters from the cmdlets that manage content search actions:

• New-ComplianceSearchAction -Export parameter
• Get-ComplianceSearchAction -Export parameter
• Set-ComplianceSearchAction -ChangeExportKey parameter

All other eDiscovery cmdlets are unaffected, so you might ask why Microsoft is focusing on the export feature. I assume that two factors are in play:

1. Microsoft wants to remove content searches eventually. Removing the ability to export the results of content searches with PowerShell forces standard users to export search results via the Purview portal.
2. Different export mechanisms are used. Content searches move the results of full searches (not estimate searches) to a protected location in Azure and exports the data from there using the content download tool. Users must have the correct export key to download data. In the new eDiscovery, the export process creates export packages that are downloaded from the Purview compliance portal.

Removing the ability to export search results via PowerShell might impact some scripts. Going forward, the only way to programmatically control eDiscovery exports is with the eDiscovery Graph API (the reviewSet export API). The downside here is that the Graph API only supports premium eDiscovery cases, so if your license only allows standard eDiscovery, you can’t use the API.

A Potentially Disruptive Change

The takeaway is that processes that use content searches for various kinds of investigations must be revised before Microsoft pulls the plug on the older eDiscovery mechanism on May 26, 2025. The steps to find material through eDiscovery are different, the UI is different, and some of the terms used in the GUI and documentation are different. All in all, this is a big change that will also affect tenant administrators who use content searches for different reasons, like finding SharePoint Online files without retention labels. Prepare for some disruption!

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.