Topic 6 of 6
eDiscovery and auditing
When a lawsuit, a regulatory investigation, or an incident arrives, the organization needs to find evidence and know who did what. eDiscovery finds and preserves content; auditing logs actions. The exam asks which tier of each one is needed for each case.
Contents
What is eDiscovery?
eDiscovery (electronic discovery) is the process of identifying and delivering electronic information that can be used as evidence in legal cases. It's also used in internal investigations, regulatory audits, and incident response.
Litigation
A lawsuit requires handing over related emails and documents.
Internal investigations
HR or security investigate misconduct or a leak.
Regulatory requests
A regulator asks for communications from a given period.
Purview offers a unified eDiscovery experience; premium features depend on licensing (Microsoft 365 E5 or an add-on). It covers Exchange Online, Teams, Microsoft 365 Groups, OneDrive, SharePoint, and Viva Engage.
The flow of a case
Escalate from an event
A lawsuit, a complaint, or an alert (for example, from Insider Risk) prompts a new case.
Create and manage the case
The case groups an investigation's searches, holds, and review sets, and who can access them.
Search and refine
You search content locations and refine queries until you have what's relevant.
Act
Export results, create review sets, or apply holds to preserve content.
Review
Analyze, tag items, and export the final set for the legal team.
Searches and holds
Search
Queries with keywords and conditions (sender, dates, file type) in KeyQL (Keyword Query Language). You first review statistics and a sample to refine.
eDiscovery hold
Preserves mailbox and site content in place for the duration of the case, even if users delete it. It can cover the whole location or only what matches a query.
eDiscovery hold vs. DLM retention
An eDiscovery hold is tied to a case and lasts as long as the case does. A Data Lifecycle Management retention policy or label responds to the organization's policy and has a fixed period. Both preserve, but for different purposes.
Core and premium features
Core features
- Search for content
- Export results
- Holds on locations
- Search for and delete harmful content, including Copilot data
Premium features
- Review sets with analytics and predictive coding
- OCR: extracts text from images
- Conversation threading for Teams and Viva Engage
- Decryption of protected content
Review sets and AI
A review set is a static copy of search results, stored in Azure Storage, that the legal team works on without touching the originals. That's where analytics (duplicate and near-duplicate detection, email threading), predictive coding (a model learns what's relevant from the reviewer's decisions), and review tags are applied.
- With Security Copilot: summaries of review set items and KeyQL queries generated from natural language.
- Microsoft 365 Copilot interactions can also be searched, held, and deleted with eDiscovery.
- Insider Risk Management cases can be escalated to eDiscovery (Premium).
Auditing in Purview
Auditing answers who did what, when, and where. It's used to investigate security incidents, prove compliance to a regulator, and support legal investigations. Purview centralizes events from many services in the unified audit log.
What it logs and how to query it
Exchange
Mailbox access, forwarding, sending on behalf of someone else.
SharePoint and OneDrive
File downloads, edits, deletions, and sharing.
Teams
Messages, meetings, and team changes.
Entra ID
Sign-ins, role changes, and user changes.
Copilot
Microsoft 365 Copilot prompts and responses, as a CopilotInteraction event.
Administration
Configuration and policy changes.
| Tool | What for |
|---|---|
| Search in the Purview portal | Interactive queries, exportable to CSV |
| Audit Search Graph API | Programmatic searches |
| Search-UnifiedAuditLog | Exchange Online PowerShell cmdlet |
| Office 365 Management Activity API | Send events to a SIEM such as Sentinel |
Microsoft 365 Copilot is audited automatically; for Security Copilot, a Copilot owner has to turn the option on.
Audit (Standard) and Audit (Premium)
| Audit (Standard) | Audit (Premium) | |
|---|---|---|
| Enablement | On by default | Includes everything in Standard |
| Retention | 180 days | 1 year by default for Entra ID, Exchange, OneDrive, and SharePoint; everything else, 180 days |
| Audit log retention policies | No | Up to 1 year, or up to 10 years with an add-on license |
| Intelligent insights | No | When an email was accessed (MailItemsAccessed), when it was replied to or forwarded, and what was searched in Exchange and SharePoint |
| API bandwidth | Standard | Higher |
Why MailItemsAccessed matters
In an email breach, the key question is which messages the attacker read. That event only exists with Audit (Premium); with Standard you know someone signed in, but not which emails they opened.
eDiscovery vs. auditing
| eDiscovery | Auditing | |
|---|---|---|
| Answers | What content exists about this matter? | Who did what, and when? |
| Works with | Emails, documents, chats | Events and actions |
| Result | Preserved and exported evidence | Activity log |
Exam scenarios
| Situation | Answer | Why |
|---|---|---|
| A court requests all of an employee's emails about a contract | eDiscovery: search and export | It identifies and delivers electronic evidence. |
| Stop relevant content from being deleted during litigation | eDiscovery hold | It preserves content in place. |
| Delete an already-delivered phishing email from every mailbox | Search and purge (eDiscovery) | It deletes harmful content it finds. |
| Extract text from scanned images during a review | OCR in eDiscovery (Premium) | A premium feature. |
| Review millions of documents and prioritize the relevant ones | Review set with predictive coding | eDiscovery (Premium). |
| Find out who deleted a SharePoint file last week | Audit log (Audit Standard) | It logs user operations. |
| Find out whether an attacker read emails in a compromised mailbox | Audit (Premium): MailItemsAccessed | Intelligent insights into email access. |
| Keep audit logs for 10 years | Audit (Premium) with an add-on license | Audit log retention policies. |
Common exam traps
❓ You need to know whether an attacker read emails in a compromised mailbox. Standard or Premium?
Audit (Premium): intelligent insights log when email items were accessed.
❓ You look for 9-month-old audit records of a Teams activity with no custom policies. Are they there?
No. Outside Entra ID, Exchange, OneDrive, and SharePoint, default retention is 180 days even with Premium.
❓ Do you have to turn on Audit (Standard)?
No. It's on by default.
❓ Are review sets with OCR core eDiscovery features?
No. Review sets, OCR, conversation threading, and decryption are premium.
❓ Are an eDiscovery hold and a retention policy the same thing?
No. The eDiscovery hold is tied to a case; the policy reflects the organization's rules with a fixed period.
❓ Which language do eDiscovery searches use?
KeyQL (Keyword Query Language). Don't confuse it with KQL from Sentinel and Defender.
❓ Can audit logs be sent to a SIEM?
Yes, with the Office 365 Management Activity API.
Did you get this topic?
Test what you just learned
During litigation, the legal team must make sure the emails and files of three employees aren't lost even if they delete them. What does it use?
Ready to test "eDiscovery and auditing"?
Original questions, each with a full explanation.
Start a mock examSign in to save your progress.
You finished the last topic of this deep dive.
Back to the index →