22.2 Perform Searches by Using eDiscovery

The July 28, 2026 SC-401 changelog made a minor wording change in Manage information security alerts and activities: the skill is now Perform searches by using eDiscovery. Older outlines talked about Content Search as if it were a separate product. Teach the current Microsoft Purview eDiscovery search experience. Do not study or recommend the retired standalone Content Search tool in the classic compliance portal / eDiscovery (classic).

Microsoft’s current model: all Content Search functionality is included in the search experience in eDiscovery. In the Purview portal, members of eDiscovery Manager and eDiscovery Administrator get a system-generated eDiscovery case that holds those searches. You can also select Content Search in eDiscovery to create a Content Search case that contains all new and existing content searches. That case has the same capabilities as other user-created cases (you can add holds and review sets depending on subscription). The Content Search option in eDiscovery (classic) is retired. The User Data Search case tool is also retired; GDPR data subject requests (DSRs) are fulfilled with the same eDiscovery search across supported locations.

SC-401 is an information security administrator exam, not a litigation-support specialist exam. You must be able to open a case, pick locations, write a query, read statistics, preview, and export. You must know that a hold is a different action. You do not need to operate premium review-set analytics as a daily job, but you should recognize that review sets, advanced indexing, OCR in the review set, and tagging sit behind premium eDiscovery feature support and E5 / Purview Suite / eDiscovery and Audit add-on licensing.

Cases, members, and who can see a search

A case contains the searches, holds, and review sets for one investigation (legal, regulatory, HR, or a DSR). Assign members so only that team sees the case. Two built-in subgroups matter:

• eDiscovery Manager can search content locations, preview and export (those roles are in the group), create and manage their cases, add and remove users on a case they created, create holds, and run searches. They cannot access cases created by other managers.
• eDiscovery Administrator can do everything a manager can and access all cases, configure eDiscovery solution settings, access process and hold reports across cases, add themselves to a case, and remove members. Only an administrator can remove members. If the only member of a case leaves the company, a manager cannot open it; an administrator can add themselves and recover access. Limit how many administrators you create because they can see potentially sensitive search results in every case.

You need Organization Management or the Role Management role to assign these groups in Purview > Settings > Role groups. Add-eDiscoveryCaseAdmin can promote a user, but that user must already have Case Management. You can add a mail-enabled security group to the Managers subgroup (Add-RoleGroupMember "eDiscoveryManager"); distribution lists and Microsoft 365 Groups are not supported for that membership. You cannot make a mail-enabled security group an eDiscovery Administrator, and you cannot add that group as a case member.

Search-related RBAC (Microsoft’s table, Purview portal roles):

Microsoft documents a two-week grace period: a user with Compliance Search but without Preview can still preview after someone who has Preview starts the preview; the same pattern exists for Export. That grace does not apply when premium eDiscovery features are enabled — then the user must have Preview and Export assigned. Run Diag:edisRBACdiag in the Purview Help pane if an admin cannot preview or export.

Create a search, pick sources, write KeyQL

In the Microsoft Purview portal, open the eDiscovery solution, select a case (or the Content Search case), and Create a search. Search name is required and must be unique in the organization. Add an optional description. Then add data sources:

• Exchange Online mailboxes
• SharePoint sites
• OneDrive accounts
• Microsoft Teams
• Microsoft 365 Groups
• Viva Engage

You can expand a person to frequent collaborators, manager, direct reports, groups they own, and groups they are in. For a group source, you can include members. Sync refreshes sources against the directory. Tenant-wide All people and groups can optionally include unlicensed and on-premises users, guests, shared Teams channels, and departed users — those options make searches slower. Microsoft’s recommended cap for a targeted search you build by picking locations is 1,000 locations. A tenant-wide “All people and groups” process supports up to 500,000 locations. For large tenants, Microsoft tells you to batch with compliance boundaries (region, business unit) instead of one all-mailbox query.

Queries use the condition builder and/or Keyword Query Language (KeyQL). Security Copilot can draft KeyQL from natural language (preview). Published query rules:

• Time zone is UTC. You cannot change the organization time zone for searches.
• Keywords are always case-insensitive. cat and CAT match the same items. The only case-sensitive tokens are Boolean operators: AND, OR, NOT, and NEAR must be uppercase or they are not operators. Put those operators in the KeyQL field. In the Keyword condition field they are treated as literal words.
• An empty keyword condition returns all content in the selected sources, not zero items. For a broad case, generate statistics first so you see the blast radius.
• A space between two keywords is OR. Quoted phrases disable wildcards inside the quotes. Prefix wildcards only (cat*); suffix and infix are not supported. Prefix wildcards need at least three alphabetic characters.
• property:value has no space after the colon. Recipients accept SMTP, alias, or display name. Minus (-from:"Sara Davis") excludes. kind:email, kind:im, kind:microsoftteams filter type. Site path: needs a trailing / or similarly named sites are included.
• Sent-folder searches do not match the sender SMTP; Sent items store display names.

Run query offers Statistics (estimates by people, SITs, item types, errors; optional keyword report; optional partially indexed investigation) or Sample (1, 10, or 100 items per location from 10, 100, 1,000, or 10,000 locations). Sample items remain valid 24 hours; regenerate after that. Include partially indexed items at search time affects statistics and preview only. Export has its own partial-index checkbox. Advanced indexing of partial items is a premium-oriented option and is not available for limited format cases.

You can Duplicate a search (name becomes Copy of … plus a timestamp) or Create search from an existing hold (requires Compliance Search). You cannot delete a search while processes are running. Deleting a search leaves export/review history in Process Manager and the audit log.

Statistics, preview, and export are not a hold

After the query finishes, statistics replace the old “collections” concept. They are estimates: item count, size, hottest locations, query hits. Export counts often differ from statistics because content changes, holds/retention keep extra copies, or you included different partial-index options. Microsoft’s troubleshooting list starts with a trap you must not fail: a hold preserves content but does not surface it in search results until you run a search across the held locations. Indexing lag is next: newly ingested items may not be searchable yet.

Preview (Preview role) opens items so you can confirm the query is on-target before you pull terabytes. Export copies mailbox items as PST or individual messages and SharePoint/OneDrive as native files. Monitor the job in Process manager. Published export limits include 500,000 items or 100,000 locations per export, 2 TB per search / per day for eDiscovery feature support (5 TB with premium), 5 GB max individual file, 10 GB PST split size, 40 GB per package, about 2 GB per hour per mailbox, and automatic cancel after seven days. The daily export cap resets at 12:00 AM UTC. If results exceed 200 GB, Microsoft suggests date or other filters. The old Office 365 eDiscovery Export Tool is retired in favor of the current export package flow.

Hold is a separate case tab. Owners can still edit or delete the live item; the preserved copy remains until the hold is released or expires. Group membership on a hold is a point-in-time snapshot; search re-resolves group membership each run. For SC-401, if the stem is “make sure the CFO cannot destroy email during the investigation,” the answer is hold, not export. If the stem is “give outside counsel a copy of last quarter’s Teams chats about Project Helios,” the answer is search then export (or add to a review set when premium features and process require it).

Search versus Audit versus Activity explorer

Published search limits (do not invent others)

Microsoft also recommends no more than 1,000 searches, holds, or exports per case for performance. List more than 1,000 objects with Get-ComplianceCase, Get-ComplianceSearch, and Get-ComplianceSearchAction in Security & Compliance PowerShell.

When you can open eDiscovery (not classic Content Search), scope sources, write KeyQL that does not accidentally collect the whole tenant, read statistics, preview with the right role, export copies, and refuse to call that export a hold, you have the July 28, 2026 search bullet.

Official resources

• Learn about eDiscovery — Content Search folded into eDiscovery; cases and search statistics
• Create a search for a case in eDiscovery — sources, KeyQL rules, statistics vs sample (updated 2026-06-29)
• Assign permissions in eDiscovery — Manager vs Administrator; Compliance Search, Preview, Export (updated 2026-06-19)
• Limits in eDiscovery — published search and export ceilings (updated 2026-06-08)
• Export search results in eDiscovery — PST/native export and process manager