eDiscovery Standard vs Premium

eDiscovery (electronic discovery) is the process of identifying, preserving, collecting, processing, reviewing, and producing electronically stored information (ESI) in response to legal or regulatory requests. In Microsoft 365, eDiscovery tools help organizations meet legal hold obligations, respond to discovery requests, and manage investigations. The two tiers—Standard and Premium—offer different levels of capability.

eDiscovery Standard (formerly called In-Place eDiscovery & Hold) is a native feature in Exchange Online and SharePoint Online. It provides basic search and hold capabilities across mailboxes, SharePoint sites, OneDrive accounts, and Microsoft Teams. It is included in most Microsoft 365 subscriptions (E1, E3, E5, and some Business plans).

Key capabilities: - Content Search: Search across Exchange Online mailboxes, SharePoint Online sites, OneDrive for Business, Microsoft Teams, and Yammer groups. Supports keyword queries, property restrictions (e.g., date range, sender), and searchable file types. - eDiscovery Hold: Place a legal hold on content in mailboxes and sites to preserve it immutably. Holds prevent deletion and modification of content until released. Holds are placed using a case-based approach. - Export: Export search results to PST files or individual messages/documents. Exports include metadata like item ID, location, and date. - Case Management: Create cases to organize searches and holds. Cases are scoped to specific permissions (eDiscovery Manager role).

Limitations:

eDiscovery Premium (formerly Advanced eDiscovery) builds on Standard by adding an end-to-end workflow for managing complex investigations. It is available only with Microsoft 365 E5 or E5 Compliance add-on. It includes all Standard features plus:

Advanced Processing and Analytics: - Text Extraction: Extract text from images using OCR (Optical Character Recognition). - Near-Duplicate Detection: Group similar documents to reduce review volume. - Email Threading: Reconstruct email conversations to show the full thread, including attachments. - Themes: Automatically cluster documents by topic using machine learning. - Predictive Coding (Relevance): Train a model by tagging a sample set; the model then scores remaining items for relevance, reducing the number of documents needing human review.

Review and Analysis: - Review Sets: Dedicated storage containers where search results are added for collaborative review. Review sets support advanced filtering, tagging, and annotation. - Redaction: Permanently hide sensitive content within documents (text or image areas). Redactions are saved as part of the review set. - Tagging: Create custom tags (e.g., "Privileged", "Responsive") and apply them to items for categorization. - Advanced Filtering: Filter by metadata, content, or analytics results (e.g., near-duplicate groups, relevance score).

Workflow and Automation: - Communication Workflow: Send hold notifications to custodians and track acknowledgments. - Custodian Management: Identify and manage custodians (people who may have relevant data). Automatically map their data sources. - Legal Hold Notifications: Automate the process of issuing, reminding, and escalating holds. - Export and Production: Export review set items with redactions intact, produce load files for external review platforms.

When you create an eDiscovery case in the Microsoft 365 compliance portal (https://compliance.microsoft.com), you define a case with a name, description, and members. For Standard, you then create a search (e.g., query across mailboxes and sites). The search queries the Exchange Search index and SharePoint Search index. Results are returned as a list of items with metadata. You can then place a hold by selecting the search and applying a hold to the locations. The hold is enforced by the mailbox or site through retention policies (e.g., the Recoverable Items folder).

For Premium, after creating a case, you add custodians and define their data sources. You can then create a search, but instead of exporting directly, you add results to a review set. The review set is an Azure Blob Storage container where items are processed: text extraction, OCR, and indexing. Analytics run asynchronously. Once processed, reviewers can filter, tag, and redact. Redactions are stored as overlays; the original file is not modified. Predictive coding requires a sample of at least 500 items for training, and the model is validated through iterative rounds.

- eDiscovery Roles: - eDiscovery Manager: Can create cases, add members, and manage searches/holds. - eDiscovery Administrator: Full access to all cases, can manage other members. - Case Limits (Standard): Maximum 1 TB of data per case; maximum 50 cases per tenant (default, can be increased). - Hold Limits: A single hold can cover up to 10,000 mailboxes and 100 sites. Total holds per tenant: 10,000. - Search Limits: Maximum 1,000 search queries per tenant per day via UI; 10,000 via API. - Review Set Limits (Premium): Up to 100 GB per review set; up to 10 review sets per case. - Retention Period: Holds are indefinite until released. No default expiration. - Export: Standard exports to PST or individual files. Premium exports to a production format with load files (e.g., CSV).

To enable eDiscovery, you need appropriate licenses. Standard is available with E3; Premium requires E5 or E5 Compliance. In the compliance portal, navigate to eDiscovery > Standard or Premium. Create a case, then search or add custodians. Use PowerShell cmdlets for automation:

# Create a Standard case
New-ComplianceCase -Name "Case123" -CaseType Standard

# Create a Premium case
New-ComplianceCase -Name "Case456" -CaseType Advanced

# Create a search
New-ComplianceSearch -Name "Search1" -Case "Case123" -ExchangeLocation All -SharePointLocation All -ContentMatchQuery "subject:confidential"

# Start search
Start-ComplianceSearch -Identity "Search1"

# Add to review set (Premium only)
Add-ComplianceSearchToReviewSet -SearchName "Search1" -ReviewSetName "ReviewSet1"

eDiscovery integrates with: - Microsoft Purview Data Lifecycle Management: Holds override retention policies; content on hold is preserved even if a deletion policy would remove it. - Microsoft Purview Communication Compliance: eDiscovery can search communications flagged by Communication Compliance policies. - Microsoft Purview Audit (Standard/Advanced): Audit logs track eDiscovery actions (e.g., search run, hold placed) for compliance. - Microsoft Purview Information Protection: Sensitivity labels are preserved during export; redactions can remove sensitive content.

Enterprise Scenario 1: Internal Investigation for Intellectual Property Theft

A large pharmaceutical company suspects an employee has exfiltrated trade secrets. The legal team uses eDiscovery Premium to conduct a forensic investigation. They create a case and add the employee as a custodian, automatically mapping their mailbox, OneDrive, and Teams chats. They run a search for keywords related to the project. The search returns thousands of documents. They add results to a review set and run analytics. Near-duplicate detection groups similar files; email threading shows the full conversation chain. Predictive coding helps prioritize relevant documents. Redaction is used to hide personally identifiable information (PII) before producing to external counsel. This scenario requires Premium because of the need for analytics, custodian management, and redaction.

Scenario 2: Regulatory Compliance for Financial Firm

A financial firm must respond to a regulatory request for all communications related to a specific trade. The volume is moderate (5000 emails). They use eDiscovery Standard to search across all mailboxes for the trade number. They place a hold on the relevant mailboxes to preserve data. They export the results to PST files and hand them to the regulator. Standard suffices because no advanced analytics or redaction is needed. The cost is lower (E3 licenses).

Common Pitfalls: