Microsoft Purview eDiscovery: Legal Holds, Search, and Defensible Collection

General counsel calls IT on a Friday afternoon. Litigation hold notice arrived. The legal team needs preservation across 14 custodians — their Exchange mailboxes, OneDrive accounts, SharePoint sites they contribute to, and Teams channels they participate in. IT opens the Purview portal and discovers the eDiscovery configuration was never completed beyond initial setup. Custodian identification requires manual research because the HR system isn't mapped. Hold placement requires permissions nobody has configured. The compliance boundary between business units that should restrict search scope doesn't exist. The search query syntax the legal team needs (date ranges, participants, keyword proximity) requires KQL expertise nobody on the team has. The Friday afternoon hold becomes a Monday morning scramble, and the legal team's confidence in the organization's preservation capability is damaged for every future matter.

eDiscovery done right is configured before the first hold notice arrives. Custodian identification workflows connected to HR data so custodians map to their M365 content sources automatically. Preservation hold templates for common matter types (litigation, regulatory inquiry, internal investigation) so hold placement takes minutes, not days. Compliance boundaries between business units and jurisdictions so searches respect organizational structure. Search query libraries with tested KQL patterns for common evidence types. Review set workflows with analytics (near-duplicate detection, email threading) configured and tested. Export procedures with chain-of-custody documentation that outside counsel accepts. Done before the first matter, eDiscovery becomes a reliable operational capability. Done during the first matter, it becomes a crisis that damages legal team confidence and potentially creates spoliation risk.