The shape of eDiscovery here
Microsoft Purview eDiscovery (Standard, and the richer Premium/eDiscovery graph tier) searches, holds, reviews and exports content across Microsoft 365 — including SharePoint sites and OneDrive accounts. The workflow: define a case, add data locations (or custodians), place a hold, run searches (KQL over content + metadata), review, and export.
Custodian-to-location mapping (the core question)
The mapping that makes or breaks a collection:
| Custodian's data | eDiscovery location |
|---|---|
| A person's personal files | Their OneDrive (/personal/…), keyed by UPN |
| Team/departmental documents | The SharePoint site(s) those files live in |
| Files shared into a chat | The sender's OneDrive (one-content-system concept) |
| Files posted in a Teams channel | The team's SharePoint site |
In Premium, adding someone as a custodian auto-associates their mailbox AND OneDrive; SharePoint sites are added as non-custodial data locations by URL because a site has no single "owner" to key on. Getting this right means knowing where the content actually lives — which is again a site question.
Holds preserve regardless of user action
Placing a hold makes the location immutable for discovery: edits and deletes still appear to work for users, but preserved copies are captured (via the Preservation Hold Library, retention concept) so nothing is lost mid-case. A hold overrides retention deletion and recycle-bin expiry.
The failure modes
- Partially indexed items. eDiscovery searches the index (search concept), so content the crawler couldn't read — image-only PDFs, encrypted files it lacks rights to, unsupported formats, oversized files — returns as partially indexed / unindexed and can be missed by a keyword search. Premium can include and process these; ignoring them is a defensibility gap.
- OneDrive keyed by UPN — if a custodian's UPN changed (rename, re-licensing) or their account was deleted, their OneDrive may not resolve without the retained personal site (leaver concept) — collect before the orphan window closes.
- Guest/external content sits in your sites but the external user isn't a custodian you control — capture via the site, not the person.
- Encrypted-label content — eDiscovery can decrypt for review with the right configuration; without it, encrypted files export unreadable.
- Standard vs Premium — advanced processing, custodian management and review-set analytics are Premium capabilities; assuming Standard has them causes scoping mistakes.
What to watch (proofs)
- Locations in the case: the eDiscovery case's data locations list — every relevant OneDrive (by UPN) and site (by URL) accounted for.
- Hold report: the case hold's status and statistics — locations on hold and the volume preserved (the preservation proof).
- Indexing coverage: the search statistics' partially indexed items count — the number that must be reviewed separately for a defensible collection.
- Leaver readiness: the departed custodian's OneDrive still present
(
Get-SPOSite -IncludePersonalSite $true) within the retention window before collection.