About This Article
This article was created using an automated generation workflow leveraging generative AI. It reviews current Microsoft Learn eDiscovery documentation to outline the differences between E3 and E5 and the initial workflow to verify in practice.Validation Status: 📘 Microsoft Official Information Confirmed / Actual Hardware Not Verified
Microsoft Purview eDiscovery is a mechanism for searching, holding, and reviewing electronic information—such as emails, Teams, SharePoint, and OneDrive—on a case-by-case basis, as required for litigation, internal investigations, and audits.
What to Know First as of 2026
Microsoft retired the legacy classic Content Search, classic eDiscovery (Standard), and classic eDiscovery (Premium) on August 31, 2025. You should now base your approach on the new eDiscovery experience in the Microsoft Purview portal.
Additionally, current eDiscovery treats E3 and E5 as case license levels. Microsoft 365 Enterprise E3 or E5 is required for administrators and target users, and E5 enables advanced case features equivalent to Premium. The setting to make E5 the default level will not appear in organizations with E3 only.
| Perspective | Microsoft 365 E3 | Microsoft 365 E5 |
|---|---|---|
| eDiscovery Case | Eligible for use | Eligible for use |
| Search & Hold | Basic features | Basic features + Advanced features |
| Premium-equivalent features | Not applicable or requires additional license verification | Applicable |
| Case default level | E3 | E5 can be set as default |
Please verify actual availability by checking user license assignments, roles, target data, and pay-as-you-go features.
What Is It Used For?
Investigating emails of departed or relevant employees
Searching across Teams conversations and SharePoint/OneDrive documents
Preserving data under investigation
Handing over search results to the legal department
Narrowing down review targets in an E5 environment and conducting more advanced investigations
If You Are Trying It Out First, Stop at 'Verify Search Criteria'
Instead of immediately placing a hold on production data and exporting it, build your search criteria in a test case.
Case: eDiscovery-Test 対象: 検証用ユーザー1名 期間: 過去7日 Keyword: project-alpha
Check This
Verify the number of search results and target data sources. Ensuring that unexpected mailboxes or sites are not included confirms success.
Change One Thing
Change only the time range to 'Past 30 Days.' By observing the difference in the number of results without changing keywords, you can understand how date range criteria affect the results.
Search, Hold, and Review Are Separate Processes
調査目的を定義 ↓ ケース作成 ↓ 対象データソースを決める ↓ 検索 ↓ 必要なら保全 ↓ レビュー / エクスポート
Just because you were able to search does not mean you need to immediately execute a hold or export. Align these actions with the procedures of your legal and compliance departments.
Points for Administrators to Check
Roles such as eDiscovery Manager / Administrator
Licenses for administrators themselves and target users
Administrator-side licenses handling SharePoint
E3/E5 case levels
Operation restrictions via Conditional Access
Organizational rules for holding and exporting
Pay-as-you-go requirements for certain features
Watch Out for Articles Depicting Retired Screens
When searching for older procedures, you may encounter classic Content Search or legacy Standard/Premium screens. Since Microsoft retired classic eDiscovery experiences on August 31, 2025, you should prioritize procedures for the new Purview portal.
Official Microsoft Information
eDiscovery features and components: https://learn.microsoft.com/en-us/purview/edisc-features-components
Configure general settings in eDiscovery: https://learn.microsoft.com/en-us/purview/edisc-settings-general
Legacy eDiscovery retirement guidance: https://learn.microsoft.com/en-us/purview/ediscovery
eDiscovery is not just a 'search tool,' but a mechanism for managing investigation targets, permissions, holds, and the handling of evidence as a case. It is safest to start by verifying search criteria and the scope of results.
