Electronic discovery, or eDiscovery, is the process of identifying and delivering electronic information that can be used as evidence in legal cases. You can use eDiscovery in Office 365 to search for content in Exchange Online mailboxes, Office 365 groups, Microsoft Teams, SharePoint Online sites, and Skype for business conversations.
If you only need to search mailboxes, you can use In-Place eDiscovery in the Exchange admin center.
If you need to search mailboxes and sites in the same eDiscovery search, you can use Content Search in the Office 365 Security & Compliance Center. In both cases, you can identify, hold, and export content found in mailboxes and sites.
Microsoft eDiscovery search is available with the eDiscovery tool in the Compliance Center. This feature allows administrators to run searches within Core and Advanced eDiscovery cases using keywords and conditions to identify specific content.
License requirement for eDiscovery search
Organizations need a Microsoft 365 E3 license to access the core eDiscovery and E5 license to use the advanced eDiscovery tool.
Data sources that are included in eDiscovery search
Administrators can use eDiscovery search to identify data stored in Exchange mailboxes and public folders, SharePoint sites, OneDrive for business, Microsoft Groups, Yammer, Teams Channel (stored in SharePoint Sites) and 1:1 chat messages, (stored in OneDrive folders).
Additionally, administrators can also click the “Locations on hold” radio button in the “Locations” section while creating the search to look for content stored in locations that were placed on hold.
eDiscovery search criteria
To run an eDiscovery search, administrators can set a name, and description, add query keywords, and list specific conditions. Once the search is created, they can review the search, and export the results.
What is Content Search?
Content Search is the search tool that is available on the compliance center. It’s completely independent of the eDiscovery tool.
License requirement for Content Search in Microsoft 365
The Content Search tool can be accessed by organizations using Microsoft 365 E1 and above licenses.
Data sources that are included in Microsoft 365 Content Search
Content Search can be used to identify content stored in Yammer, OneDrive (includes Teams 1:1 chats and media), SharePoint (includes Teams channel chats and media), Groups, and Skype for Business messaging conversations.
Content Search criteria
While creating the search, administrators can add a name, and description, and choose specific locations to search in. Administrators can also build search queries, and add conditions to further narrow down the search, run an ID list (with a .csv file) to search for specific email messages, etc.
When to use eDiscovery search and Content Search
The eDiscovery search tool is available for Core and Advanced eDiscovery features, making it easier to store, access, and manage searches relevant to a specific legal case. Therefore, an eDiscovery search feature is generally used to identify content (including content on hold) to be exported and presented to a legal counsel as potential evidence.
A content search tool, however, does not provide any legal or administrative capabilities like eDiscovery. Hence, the feature is used to simply identify content stored in different Microsoft services (excluding content placed on hold) and export the search results.