Microsoft Purview eDiscovery: Legal Holds and Content Search for Small Businesses in Berlin

Legal holds, regulatory investigations, employment disputes, and contract litigation share a common IT requirement: the ability to identify, preserve, collect, and export electronic communications and documents relevant to the matter. In a Microsoft 365 environment, this means Exchange emails, Teams messages, SharePoint documents, OneDrive files, and Viva Engage posts. Microsoft Purview eDiscovery provides the legal hold, content search, and export tooling to handle these requirements without requiring third-party software or manual data extraction.

eDiscovery Tiers: Standard vs. Premium

Microsoft Purview eDiscovery exists in two tiers, and understanding the distinction is essential for scoping your implementation:

eDiscovery (Standard): Available with Microsoft 365 E3 and Business Premium (via Microsoft Purview compliance add-on). Provides legal holds, content searches across Exchange, SharePoint, OneDrive, and Teams, and export of search results. The core workflow — place a hold on a custodian’s mailbox and SharePoint sites, run a search, review results, export — is fully supported. For most Berlin SMBs facing a labor dispute, regulatory audit, or contract litigation, Standard is adequate.

eDiscovery (Premium): Available with Microsoft 365 E5 or as an add-on. Adds custodian management with legal hold notification workflows, advanced processing of non-Microsoft file formats, near-duplicate detection, email threading, keyword expansion with themes, built-in review set annotation and tagging, and the ability to export review sets in EDRM XML format for ingestion into third-party review platforms (Relativity, Nuix). Premium is oriented toward matters where volume or complexity warrants dedicated review infrastructure.

Core Workflow: Standard eDiscovery

The typical eDiscovery workflow for a Standard case:

1. Create a case: In the Microsoft Purview compliance portal, create an eDiscovery case. Cases are isolated containers — holds, searches, and exports associated with one matter do not affect others.
2. Place a legal hold: Add custodians (specific users) or locations (SharePoint sites, shared mailboxes) to a hold. Held content is preserved from deletion or modification even if a user empties their Deleted Items folder or a retention policy would otherwise delete the content. Holds are silent — users are not notified by the hold mechanism itself.
3. Build a content search: Define a search query (keywords, date ranges, senders, recipients, file types) targeting the custodians and locations on hold. Preview results before committing to collection. The search index covers email bodies and metadata, document content in SharePoint/OneDrive, and Teams chat messages.
4. Review and refine: Review search results for relevance. Adjust queries to narrow scope. For Standard eDiscovery, review happens on exported content or through the built-in preview; there is no dedicated in-place review set.
5. Export: Export search results as PST files (email), individual message files, or documents. Export includes a manifest linking exported items to their original locations. The export package is suitable for delivery to outside counsel or review by internal legal teams.

Legal Holds: What They Preserve and What They Don’t

Understanding what eDiscovery holds actually preserve is operationally important:

• Exchange mailboxes: When a hold is placed on a mailbox, items deleted by the user are moved to the Recoverable Items folder rather than permanently deleted. Items in the Recoverable Items folder are preserved even if the folder exceeds its quota. Items in-place (not deleted) are preserved regardless of any MRM/retention policies that would otherwise delete them.
• SharePoint and OneDrive: When a hold is placed on a site, documents deleted by users are preserved in the site’s Preservation Hold library. Version history is preserved — older versions of documents cannot be purged while the hold is active.
• Microsoft Teams: 1:1 and group chat messages are stored in Exchange mailboxes (the user’s mailbox for 1:1, a hidden group mailbox for channels). Placing a hold on the relevant mailboxes preserves Teams messages. Channel posts are stored in the associated SharePoint site’s document library.
• What holds don’t cover: Third-party chat applications (Slack, WhatsApp), email in personal accounts used for business purposes, documents stored in personal cloud storage. Holds only cover Microsoft 365 content locations.

Practical Considerations for Berlin SMBs

Several operational points relevant to small businesses in Germany:

GDPR and eDiscovery tension: Legal holds preserve data beyond its normal retention period, which can create tension with GDPR data minimization principles. German data protection authorities have generally recognized legitimate legal obligations as a basis for extended retention, but the hold should be scoped as narrowly as possible and lifted promptly when the matter concludes. Document the legal basis for the hold in your case notes.

Betriebsrat considerations: If your organization has a works council (Betriebsrat), monitoring or searching employee communications may require works council involvement. eDiscovery searches of employee mailboxes are not exempt from German works council codetermination rights around employee monitoring.

Permissions model: eDiscovery Manager and eDiscovery Administrator roles in Purview control who can create cases, place holds, and run searches. These roles should be restricted to legal/compliance staff, not general IT administrators. Audit logging of eDiscovery activity is automatically enabled.

Licensing

eDiscovery (Standard) is included in Microsoft 365 Business Premium via the Microsoft Purview compliance capabilities included in that license. eDiscovery (Premium) requires Microsoft 365 E5 or the Microsoft Purview eDiscovery add-on. For most Berlin SMBs, the Standard tier covers routine litigation holds and regulatory audit responses without additional licensing cost.