eDiscovery and Legal Hold Readiness

TL;DR: This skill inspects your Microsoft Purview eDiscovery cases, legal holds and collection sources, then produces a prioritised readiness report so you can prove evidence is preserved, searchable and exportable before a matter escalates.

What does Microsoft Purview eDiscovery legal hold readiness involve?

Microsoft Purview eDiscovery lets your organisation preserve, search and export content from Exchange Online, SharePoint, OneDrive and Microsoft Teams in response to litigation, regulatory requests or internal investigations. A legal hold suspends retention and deletion so custodian data stays defensible. This skill reads the configuration of cases, holds, custodians and collection sources across Microsoft Entra identities so you can confirm preservation is genuinely in force. It surfaces gaps such as inactive holds, unscoped locations or missing custodian mappings before they become a discovery failure.

When should you run this skill?

• “We have just received a litigation notice and need to confirm holds are actually preserving data.”
• “Are any of our eDiscovery legal holds disabled, expired or scoped to the wrong locations?”
• “Show me which custodians have no preservation applied across mailboxes and OneDrive.”
• “Can we still search and export collected content for this matter today?”
• “Our legal team wants assurance that retention and deletion are suspended for in-scope users.”
• “We are preparing for an external audit and need evidence of defensible eDiscovery readiness.”
• “Has anyone changed or released a hold without the matter being formally closed?”

How this skill works, step by step

1. Connect read-only to Microsoft Purview eDiscovery and enumerate all eDiscovery (Premium) and Standard cases and their current status.
2. For each case, retrieve every associated legal hold and record whether the hold is enabled, disabled or in an error state.
3. Inspect each hold’s content locations across Exchange Online, SharePoint, OneDrive and Microsoft Teams to confirm in-scope sources are actually covered.
4. Map custodians to their Microsoft Entra identities and flag custodians with no hold applied or with locations that fail to resolve.
5. Review collection and search definitions for each case to confirm queries return results and have not silently errored.
6. Check export and review-set readiness, noting any pending, failed or stale exports that would block evidence production.
7. Detect risk signals such as expired hold durations, recently released holds on open matters and mailboxes excluded from preservation.
8. Derive a risk score per case from hold coverage, custodian completeness, collection health and export readiness, weighting active matters with gaps highest.
9. Compile the findings into a prioritised report with clear remediation guidance for the compliance and legal teams.

Output format

The skill returns a per-case readiness summary followed by a prioritised findings table.

Summary highlights:

• Total cases assessed and the count flagged High, Medium or Low risk.
• Holds that are disabled, in error or released against an open matter.
• Custodians with no preservation applied across one or more locations.
• Collections or exports that are failed, stale or returning no results.

Scope and safety

This skill is read-only by default and makes no changes to your Microsoft Purview, Microsoft Entra or Microsoft 365 configuration. It only reads case, hold, custodian, collection and export metadata to assess readiness.

This skill does NOT:

• Create, modify, enable, disable or release any legal hold or eDiscovery case.
• Run, export or alter collections, searches or review sets that touch custodian content.
• Change retention policies, custodian assignments or content locations.
• Read or extract the body of preserved messages, files or chats.

Licensing and permissions

Licences and add-ons

Least-privilege roles

• Compliance Data Administrator or Global Reader for read-only visibility of cases, holds and configuration.
• eDiscovery Manager (read-only members are scoped to their assigned cases) where case-level access control is required.

Microsoft Graph permissions (read-only)

• Microsoft Purview eDiscovery is administered through the Microsoft Purview portal and Security and Compliance PowerShell (for example Get-CaseHoldPolicy, Get-ComplianceCase and Get-ComplianceSearch) rather than Microsoft Graph, so no Graph scopes are required for the core hold and case inspection.
• Where eDiscovery (Premium) case, custodian, search and review-set metadata is read via the Graph eDiscovery APIs, the read-only scope eDiscovery.Read.All applies.

Related skills

• Retention and Records Management Audit: run before this to check how content is kept and disposed of, so held material is not lost.
• Audit Log Retention and Coverage Validator: run before this to confirm the audit configuration is on and retained.
• Insider Risk Management Coverage Review: run alongside this when a matter involves risky user activity.
• Agent Audit Trail and Forensics Investigation: run after this when a matter needs a Copilot or agent action timeline.
• Governing Microsoft 365 Copilot with Microsoft Purview: pillar guide to the Purview controls for Microsoft 365 Copilot, including eDiscovery.

Sources and compliance

• Microsoft Purview eDiscovery 
• Create eDiscovery holds 
• Aligns with ISM guidance on event logging, data retention and integrity of records held for legal and regulatory purposes.

Licensed under CC BY 4.0  by EDUC4TE .

Last reviewed 2026-06-02