Microsoft 365 eDiscovery Support — built-in tools, Microsoft support and third‑party services

Microsoft 365 eDiscovery support is available through three channels: the built‑in Microsoft Purview tools inside Microsoft 365, paid Microsoft Support plans and specialist third‑party providers who handle complex legal holds and collections. Most small teams use a mix of these three options to meet legal and regulatory duties.

What Microsoft supplies and when it’s enough

Microsoft includes eDiscovery features in the Microsoft Purview compliance suite (formerly eDiscovery in the Compliance Centre). For many SMEs the built‑in tooling covers common needs: content searches, legal holds, basic case management and export. These features integrate with Exchange Online, SharePoint and OneDrive which keeps the process inside your tenancy and avoids exporting sensitive data to unknown tools.

When it’s usually sufficient:

  • Routine subject access requests (SARs) or straightforward internal investigations.
  • Single or small numbers of custodians where search scopes are clear.
  • When you have a named admin who can follow Microsoft’s documented steps.

Limitations to watch for: the Microsoft UI prioritises administrators, so legal teams often need IT help to run precise searches or preserve volatile data. Advanced analytics, integrated review workflows or bulk eDiscovery workspaces can be limited unless you license Purview Advanced features. If your situation involves multiple jurisdictions, large custodian counts or required audit‑grade chain of custody, expect to need extra controls.

Practical steps UK SMEs should take now

Start by establishing a simple, repeatable process that separates identification, preservation and collection. Keep roles and a playbook: who raises a hold, who runs searches, who exports evidence. This saves billable hours if the ICO or a solicitor asks. Use retention labels in Microsoft 365 to reduce accidental deletion and document where data sits.

Three checklist items to implement quickly:

  1. Assign an eDiscovery owner and document the process for a legal hold (names, contact steps, expected timelines).
  2. Use Purview search & hold for initial preservation; map critical mailboxes, SharePoint sites and OneDrive accounts to the search scope.
  3. Log actions and exports to preserve audit trails — keep exported evidence in a secure, access‑controlled location.

For legal obligations and when to retain or delete, consult the ICO’s guidance on data protection and retention to ensure your retention labels and holds meet UK rules: ICO guidance for organisations. If you already subscribe to Microsoft 365 E3/E5, check which Purview capabilities are included before buying add‑ons — licensing influences what’s practical to run in‑house.

When to bring in paid Microsoft support or a specialist

Escalate beyond in‑house handling when legal complexity, scale or fixed deadlines increase risk. Consider paid Microsoft Support if you need certified Microsoft engineers to troubleshoot technical problems with search results, hold application or exports. Choose a specialist eDiscovery provider when you need managed collection, defensible processing, review platforms or assistance with solicitor requests.

Practical triggers to outsource:

  • More than a handful of custodians, or uncertain custodianship across many accounts.
  • Regulatory investigations or litigation with strict chain‑of‑custody requirements.
  • Need for document review platforms, redaction, privileged‑tag workflows or where internal capacity is limited.

Outsourcing is not only about technical capability; it’s about predictable cost and defensibility. A specialist will provide documented workflows, secure evidence handling and often faster turnaround. If you prefer an intermediary who knows Microsoft tooling but handles the legal lift, check a provider’s Microsoft partner credentials and ask for examples of work with UK regulators.

If you’d rather not run this yourself, Aurora can manage the technical side so your legal or HR team keeps ownership of decisions — see our Microsoft 365 support for business page for how we slot into existing processes.

When to ask for help: if you face a regulator notice, litigation hold or a SAR with tight deadlines, get external help immediately to avoid costly mistakes. A short advisory engagement can save hours and reduce risk, preserving time, money and credibility while getting you a calm, documented outcome.

Related reading