Microsoft Purview eDiscovery for Financial Institutions

A subpoena lands on a Tuesday. A regulator asks for every message between two loan officers over an eighteen-month window. An employee resigns and someone needs to know what left with them. In each case the clock starts immediately, and the question your team has to answer is a practical one: can we find it, freeze it, and hand it over without stopping the rest of the business? Microsoft Purview eDiscovery is the tool inside Microsoft 365 that answers yes. It searches Exchange Online, SharePoint, OneDrive, Teams, Microsoft 365 Groups, and Viva Engage from one place, preserves what it finds, and packages it for whoever asked.

The productivity story is the real one. An institution that has eDiscovery configured and staffed answers a records request in days using people it already employs. An institution that has not spends the first week discovering which mailboxes exist, the second week arguing about who is allowed to search them, and the third week explaining the delay to counsel. Same tenant, same data, very different month.

What trips up credit unions, banks, and mortgage companies is not the search syntax. It is the licensing, because Microsoft's eDiscovery licensing contains a genuine reversal that almost nobody catches on first read. Get it backwards in one direction and you buy licenses you never needed. Get it backwards in the other and you create a gap that surfaces at true-up, or worse, in the middle of a matter. This guide walks the whole thing: what the tool does, what each tier costs you in licenses, where the traps are, and how to size it for an institution rather than for a law firm.

What Purview eDiscovery Actually Does

Electronic discovery is the process of identifying and producing electronically stored information as evidence. Microsoft Purview eDiscovery does that job across the Microsoft 365 services your institution already runs. According to Microsoft's documentation, supported sources include Exchange Online, Microsoft Teams, Microsoft 365 Groups, OneDrive, SharePoint, and Viva Engage. One search reaches mailboxes and sites together.

The work happens inside a case. A case holds the searches, the holds, and the review sets for one matter, and it has members who are the only people who can open it. That structure matters more than it sounds. It is what lets you run an internal HR investigation without the subject's department knowing, and what lets you prove later who touched the evidence.

Four things happen in almost every matter, in roughly this order.

Step 2 is the one with legal teeth. Under Federal Rule of Civil Procedure 37(e), if electronically stored information that should have been preserved for anticipated or pending litigation is lost because a party failed to take reasonable steps to preserve it, a court can order measures to cure the prejudice. If the court finds the party acted with intent to deprive another party of the information, it can go considerably further: instruct the jury to presume the lost material was unfavorable, dismiss the action, or enter default judgment. A documented litigation hold is the most direct evidence that you took reasonable steps, though the standard is fact-specific and a hold by itself is not a safe harbor. It is still cheap insurance against an expensive finding.

Retention and preservation get conflated constantly, and the distinction is worth holding onto. If you want the retention side in depth, our guide to Microsoft 365 data retention for financial institutions covers the schedules and the policies. This article is about the other half: what happens when a specific matter demands specific evidence, now.

Standard Versus Premium: What Each Tier Buys

Microsoft splits eDiscovery into two feature sets. The plain tier, still widely called eDiscovery (Standard), covers the workflow most institutions actually need. The premium tier adds the machinery of large-scale document review.

Standard gives you content search across the Microsoft 365 estate, keyword queries with conditions, statistics and samples so you can size a matter before committing to it, holds on content locations, role-based permissions, case management, export of search results, and the ability to search for and delete messages. For a records request, an examiner inquiry, or a garden-variety employment matter, that is the whole job.

Premium adds the machinery of large-scale review: review sets, which are static snapshots reviewers can tag and analyze; advanced indexing; optical character recognition so text inside images becomes searchable; conversation threading that pulls an entire Teams exchange rather than the one matching message; decryption of content protected by sensitivity labels; and analytics such as near-duplicate detection and predictive coding that exist to cut review volume down to something a human can read. Every one of those features is aimed at the same problem: too many documents and not enough lawyers.

The honest test for an institution: are you culling tens of thousands of documents for a legal team, or are you answering a defined question? If it is the second, Standard is very likely the right tier, and the rest of this article matters a great deal to your budget. Most financial institutions run Standard-shaped matters. Premium is built for large-scale document review, not for answering an examiner, and buying it to feel prepared is how institutions end up paying for capability that never gets used.

The licensing rule reverses by tier: eDiscovery Standard licenses the person doing the work, while premium features license the custodian whose data is analyzed. The shared mailbox row is the one most institutions miss.

The Licensing Rule That Reverses

Here is the part that catches people. In eDiscovery, the license does not always attach to the same person. It depends on which tier you are using, and the two rules point in opposite directions.

For the baseline, Microsoft is direct. Its getting-started guidance states that both admins and users working with eDiscovery cases require a Microsoft 365 Enterprise E3 or E5 license. That is a rule about the people doing the work. Your compliance officer, your investigator, the administrator running the search: they need the license.

For premium features, the rule flips to the other side of the table. Microsoft's eDiscovery permissions documentation states that to analyze a user's data when premium eDiscovery features are enabled, the user whose data is analyzed must be assigned an Office 365 E5 or Microsoft 365 E5 license, or alternatively an Office 365 E1 or E3 license plus a qualifying add-on such as Microsoft Purview Suite or Microsoft 365 eDiscovery and Audit. Treat that as the shape of the rule rather than a closed list; Microsoft's plan and add-on lineup moves, and the eligible routes for your tenant are worth confirming against current guidance before you buy anything. And then the sentence that surprises everyone: administrators, compliance officers, or legal personnel who are assigned to cases as members and use premium eDiscovery features to collect, view, and analyze data do not need an E5 license.

Read those together and the shape is clear. Standard licenses the person doing the work. Premium licenses the person whose data is being analyzed. The custodian, in Microsoft's own words, is the individual whose content is subject to search, hold, or review, and that is explicitly distinct from the administrators or compliance officers who perform searches or manage cases.

One clarification worth making before anyone budgets against it, because the compressed version of this rule invites an expensive misread. Premium does not mean the case team needs nothing. The baseline still applies: your case team needs E3 or E5 to work cases at all. What Premium adds is a second, separate requirement pointed at the custodian. So a Premium matter needs both, aimed at two different groups of people.

Laid out side by side, the whole rule fits in one table. It is worth reading the middle two rows together, because they are the pair that trips people up.

The practical consequence is money in both directions. An institution that assumes everyone needs E5 buys a tenant-wide upgrade for a capability three people use. An institution that assumes nobody but the case team needs anything runs premium analysis against custodians who are not licensed for it. Both are common. Neither is necessary.

None of this makes E5 or Premium a legal requirement. No regulator mandates a Microsoft license tier, and no license by itself establishes compliance. The rules above are Microsoft's product licensing terms, not a regulator's. What a regulator cares about is whether you preserved and produced what you were obliged to.

Sizing the tier is a licensing conversation with real dollars attached, and it connects directly to the broader plan question. If you are weighing the plans themselves, our breakdown of Microsoft 365 E3 versus E5 versus Business Premium for financial institutions covers the whole decision rather than just the eDiscovery slice.

The Shared Mailbox Nobody Licensed

This gap is easy to miss by design, and it stays invisible until the moment it is not.

Now consider where financial institutions put shared mailboxes. Wire requests. Loan operations. Member services and customer service. Vendor management. Fraud reporting. Payoff requests. Those are not incidental inboxes. They are frequently the first place a subpoena or an examiner request goes, because that is where the institution actually transacts. And because shared mailboxes normally cost nothing, they are easy to leave unlicensed, and you should not assume an alert will fire when you place one on hold.

The remedy is unglamorous: inventory your shared mailboxes before you need them, decide which ones are foreseeably discoverable, and license those. For most institutions that is a short list and a small number.

Who Counts as Benefiting From the Service

Microsoft's licensing terms turn on a phrase that reads like boilerplate and is not: any user benefiting from the service requires a license. In the Purview service description, Microsoft spells out who that includes, and the list is wider than most people expect.

Custodians who are part of a case that is placed on hold, or who are custodians of data sources in a search, collection, or review set. Owners and members of a SharePoint site that is on hold or contains in-scope content. Owners of Exchange mailboxes on hold or containing in-scope content. Owners and members of Teams chats, channels, or private channels on hold or containing in-scope content.

Read that last one twice. A hold on a Teams private channel reaches its members, not only the one person you were looking at. In an institution where a lending team, a branch, or a committee lives in a channel, the licensed population implied by a single hold can be considerably larger than the custodian list you wrote down.

Microsoft is also candid about enforcement. The service description notes that eDiscovery features are enabled at the tenant level for all users when an admin assigns eDiscovery permissions, and that although some tenant services cannot currently limit benefits to specific users, appropriate subscription licenses are still required for use of each online service. In plain terms: the product will not stop you. The obligation persists anyway.

That is an uncomfortable combination, because it means the control has to be procedural. You should not expect the portal to flag an under-licensed hold for you. Somebody has to know the rule and check.

What eDiscovery Costs to Run

Beyond licensing, eDiscovery has an operating-cost model, and the good news for financial institutions is how much of it is already paid for.

Per Microsoft's eDiscovery billing documentation, data storage for Microsoft 365 content in your cases, meaning Exchange, SharePoint, OneDrive and the rest, is included in your enterprise subscription and is not subject to pay-as-you-go billing. Microsoft 365 AI data, including Microsoft 365 Copilot interactions, is likewise included. And Microsoft lists all search processes, all hold processes, and all case management processes as included in your enterprise subscription rather than metered, even where they touch the otherwise-billable data class below.

What does carry a charge is narrower: data from AI applications outside Microsoft 365, which Microsoft groups as non-Microsoft 365 AI data. That bucket covers Copilot in Microsoft Fabric, Microsoft Security Copilot, and connected or cloud AI applications, and it is billed pay-as-you-go against an Azure subscription when you export it or add it to a review set. Separately, tenants using the Microsoft Graph APIs for eDiscovery on E3 licensing pay for export volume, with an included allowance each month, while the non-export API calls do not contribute to billing. Deleting a case stops its storage charges.

For a typical institution running Microsoft 365 workloads and no external AI applications wired into eDiscovery, the recurring cost of the tool is effectively the licensing, not the metering. That is worth knowing before someone budgets for a per-gigabyte line item that will not materialize.

Who Should Hold the Keys

eDiscovery is one of the few capabilities in Microsoft 365 where the permission itself is the risk. Somebody with the wrong role can read anything.

The main role group is eDiscovery Manager, and it has two tiers. An eDiscovery Manager can search, create and manage cases, place holds, and access case data, but only for the cases they are a member of. An eDiscovery Administrator can do all of that plus access every case in the organization, configure eDiscovery settings, and add themselves to any case. Microsoft's own guidance is blunt: because eDiscovery Administrators can access potentially sensitive information in the results of a compliance search, you should limit the number of people who are eDiscovery Administrators.

There is a failure mode buried in that design worth planning around. Microsoft notes that if the only member of a case leaves your organization, nobody can access that case, including Organization Management, because case access runs through membership rather than through org-wide admin rights. Only an eDiscovery Administrator can recover it by adding themselves as a member. So the same role you want to keep scarce is the role that keeps a matter from becoming unreachable when someone resigns. That is a real tension, and for most institutions the workable answer is a small, named group rather than a single point of failure at one end or an open roster at the other. It also connects to departures generally, which we cover in our guide to Microsoft 365 employee offboarding for financial institutions.

Two more controls are worth knowing. Compliance boundaries limit which content locations and cases a given eDiscovery manager can reach, which matters for a holding company, a multi-charter institution, or any structure where one division should not be able to search another. Microsoft notes they carry no separate licensing requirement beyond the eDiscovery licensing you already have. And role scoping lets you split the work: case management plus search for one person, case management plus hold for another, review only for outside counsel. If you are already thinking about standing privilege, the same logic we apply to just-in-time admin access belongs here too.

One piece of housekeeping. Microsoft retired all classic eDiscovery experiences on August 31, 2025, including classic Content Search, classic eDiscovery (Standard), and classic eDiscovery (Premium). Everything now runs in the unified experience in the Microsoft Purview portal, and Content Search functionality lives inside a system-generated case there. If your incident response runbook still tells someone to open the old Security and Compliance Center and run a content search, that runbook sends them to a door that no longer exists. Worth fixing before the day you need it rather than during.

Six checks worth making on a quiet afternoon rather than on the day a subpoena arrives. Preservation and retention are different obligations, and an institution needs both.

How ABT Right-Sizes This

Everything above is knowable. It is in Microsoft's documentation, and you could assign someone to work it out. The reason institutions call ABT is not that the rules are secret. It is that the rules are scattered across four documents that contradict each other's emphasis, the expensive mistakes are invisible until they are not, and the answer is different for a 90-person credit union than for a 600-person bank.

ABT manages Microsoft 365 tenants for more than 750 credit unions, banks, and mortgage companies as the largest Tier 1 Microsoft Cloud Solution Provider primarily dedicated to financial services. What that vantage point buys you here is pattern recognition rather than a checklist, because institutions of the same size and shape tend to land in the same places. The discoverable mailboxes are rarely a surprise once you know what the institution does. The eDiscovery Administrator list tends toward one of two failure shapes: a single administrator who is one resignation away from an unreachable case, or a long roster of people who can all read everything. And the right-sized Purview footprint for a given seat count is usually knowable before anyone opens the tenant. That is the difference between a vendor telling you what the documentation says and a partner telling you what it means for you.

Concretely, an eDiscovery readiness engagement maps your case roster against your custodian exposure, inventories and licenses the shared mailboxes that matter, sizes Business Premium plus a targeted add-on against the blanket upgrade so you can see both numbers, and sets the role groups and compliance boundaries deliberately. Where an institution wants ongoing monitoring of privileged roles and configuration drift on top of that, M365 Guardian is the operating model that runs alongside the tenant management.

None of that is a compliance guarantee, and we would not offer one. Your obligations belong to you and to your counsel, and no license or service establishes compliance by itself. What ABT does is make sure the Microsoft 365 environment those obligations run through is configured, licensed, and staffed so that a records request is answered with a workflow instead of a fire drill. Those are decisions you can make on a quiet afternoon. They are considerably more expensive to make on a Tuesday with a subpoena on the desk.

Frequently Asked Questions