top of page

What is eDiscovery and Content Search in Office 365

Updated: Jul 10

Electronic discovery, or eDiscovery, identifies and delivers electronic information that can be used as evidence in legal cases. You can use eDiscovery in Office 365 to search for content in Exchange Online mailboxes, Office 365 groups, Microsoft Teams, SharePoint Online sites, and Skype for business conversations.

If you only need to search mailboxes, you can use In-Place eDiscovery in the Exchange admin centre.

If you need to search mailboxes and sites in the same eDiscovery search, you can use Content Search in the Office 365 Security & Compliance Center. In both cases, you can identify, hold, and export content found in mailboxes and sites.

Microsoft eDiscovery search is available with the eDiscovery tool in the Compliance Center. This feature allows administrators to run searches within Core and Advanced eDiscovery cases using keywords and conditions to identify specific content.

License requirement for eDiscovery search

Organizations need a Microsoft 365 E3 license to access the core eDiscovery and an E5 license to use the advanced eDiscovery tool.

Data sources that are included in the eDiscovery search

Administrators can use eDiscovery search to identify data stored in Exchange mailboxes and public folders, SharePoint sites, OneDrive for business, Microsoft Groups, Yammer, Teams Channel (stored in SharePoint Sites) and 1:1 chat messages (stored in OneDrive folders).

eDiscovery & Content search in office 365

Additionally, administrators can also click the “Locations on hold” radio button in the “Locations” section while creating the search to look for content stored in locations that were placed on hold.

eDiscovery search criteria

To run an eDiscovery search, administrators can set a name and description, add query keywords, and list specific conditions. Once the search is created, they can review the search, and export the results.

What is Content Search?

Content Search is the search tool that is available on the compliance centre. It’s completely independent of the eDiscovery tool.

License requirement for Content Search in Microsoft 365

The Content Search tool can be accessed by organizations using Microsoft 365 E1 and above licenses.

Data sources that are included in Microsoft 365 Content Search

Content Search can identify content stored in Yammer, OneDrive (includes Teams 1:1 chats and media), SharePoint (includes Teams channel chats and media), Groups, and Skype for Business messaging conversations.

Content Search criteria

While creating the search, administrators can add a name and description and choose specific locations to search in. Administrators can also build search queries and add conditions to further narrow the search, run an ID list (with a .csv file) to search for specific email messages, etc.

When to use eDiscovery search and Content Search

The eDiscovery search tool is available for Core and Advanced eDiscovery features, making it easier to store, access, and manage searches relevant to a specific legal case. Therefore, an eDiscovery search feature is generally used to identify content (including content on hold) to be exported and presented to a legal counsel as potential evidence.

However, A content search tool does not provide legal or administrative capabilities like eDiscovery. Hence, the feature is used to simply identify content stored in different Microsoft services (excluding content placed on hold) and export the search results.

What is Advanced eDiscovery?

Advanced eDiscovery in Office 365 goes deeper with features designed to enhance the eDiscovery process:

Predictive Coding

It uses machine learning to more accurately predict which documents are relevant to a case based on decisions made on a smaller document set.

Near-duplicate Detection

Identifies documents that are nearly identical, helping to reduce the volume of data reviewed and ensuring that all unique information is considered.

Email Threading

Presents emails in a conversational context, allowing reviewers to see the entire email chain, which helps in understanding the flow of discussions and reducing redundant content.


Automatically organizes documents into thematic groups, making it easier to navigate and review large sets of data.

Advanced Analytics

Provides insights into communication patterns and data relationships, which can be critical in complex cases.

Exploring the Layers: Core vs. Advanced eDiscovery

Office 365 facilitates two levels of eDiscovery functionality:

Core eDiscovery

The core eDiscovery (Standard) foundational level allows organizations to identify, preserve, and export content housed within their Office 365 ecosystem. It's designed for routine legal inquiries where basic data handling suffices.

Advanced eDiscovery

This extends beyond the core functionalities by incorporating sophisticated tools for data analysis, review, and redaction, which are essential for addressing complex litigation scenarios that involve large volumes of data or require detailed examination.

Why eDiscovery Matters

The strategic implementation of eDiscovery tools, particularly Advanced eDiscovery, can substantially benefit organizations by:

Streamlining Compliance and Litigation Readiness

Enhances the ability to respond swiftly and effectively to legal requests, minimizing the risk of penalties for non-compliance.

Reducing Costs and Time

Automates and optimizes the review process, which can significantly cut down the hours spent by legal teams in manual data sorting and analysis.

Improving Accuracy and Outcomes

Ensures more precise and relevant data retrieval, which directly impacts the quality of evidence and the outcomes of legal proceedings.

4,387 views0 comments


bottom of page