Microsoft Purview eDiscovery Is Changing Again: What Legal Teams Need to Do Before 16 February 2026

Microsoft has announced two changes to Purview eDiscovery that will affect how legal, investigation and compliance teams search, review and export Microsoft 365 evidence.

From 16 February 2026, the Content Search area of Microsoft Purview eDiscovery will become a more limited search-and-export tool. It will no longer support review sets or case-level data sources. Microsoft is also reducing the availability period for direct export packages. These packages will expire 14 days after they are created.

The changes do not prevent organisations from searching or exporting Microsoft 365 content. However, they make it important to select the correct type of eDiscovery case, download exports promptly and document the collection process.

Content Search Is Becoming a Simpler Tool

Microsoft brought its previous Content Search, eDiscovery Standard and eDiscovery Premium experiences into a unified eDiscovery interface during 2025. Within that interface, Content Search has continued to provide a relatively quick way to search across Exchange Online, Microsoft Teams, SharePoint, OneDrive and other supported Microsoft 365 locations.

From 16 February 2026, Content Search cases will no longer support:

review sets; or
case-level data sources.

Organisations that use Content Search only to locate and directly export information should still be able to continue with that workflow. However, users who need to collect material into a review set, examine documents within Purview, apply tags, filter results, analyse content or manage a more structured investigation will need to use a dedicated eDiscovery case.

Why Review Sets Matter

A direct export delivers search results for examination outside Microsoft Purview. This may be suitable for a small, clearly defined collection where the search criteria are already well understood. A review set supports a more controlled process inside the eDiscovery environment. Relevant material can be collected into a defined dataset and then searched, filtered, reviewed, tagged and analysed.

Review sets may be useful where:

the initial search returns a large volume of information;
relevance cannot be determined from filenames or search terms alone;
multiple reviewers need to classify documents;
potentially privileged material must be identified;
duplicate or near-duplicate content needs to be managed;
conversations and related items need to be examined together; or
the investigation is likely to develop as new facts emerge.

Legal and investigation teams should not wait until after completing a Content Search to decide whether a review set is required. From 16 February, the intended review workflow should be considered when the case is first created.

Direct Export Packages Will Expire After 14 Days

Microsoft is also changing how long direct export packages remain available for download.

From 16 February 2026, a direct export package created from an eDiscovery search will expire 14 days after it is created. After that period, the package and the data contained within it will be automatically deleted from the export location and cannot be recovered from that package. The expiry does not delete the original email, Teams message or document from its source location.

However, the export job may need to be run again if the package was not downloaded in time. Running the export again may not always produce an identical collection. Source information could have been edited, deleted or affected by retention settings after the original search, particularly where no hold was in place. The 14-day expiry applies to direct search exports. Microsoft’s guidance distinguishes these from exports created from review sets.

Downloading Is Only the First Step

Downloading an export does not, by itself, create a complete evidential record. The exported data should be transferred promptly into an approved and appropriately secured evidence location. The organisation should also retain information showing:

the eDiscovery case and search used;
the data sources and custodians included;
the search terms, conditions and date ranges;
when the search and export were run;
who created and downloaded the export;
any errors, partially indexed items or excluded content;
the export settings selected; and
where the downloaded material was stored.

Hash values may be calculated after download to help demonstrate that the exported files have not changed during later handling or examination. A hash confirms continuing file integrity from the point at which it was calculated. It does not, by itself, prove that the source information was accurate, complete or authentic.

What Organisations Should Do Before 16 February

Organisations using Microsoft Purview eDiscovery should review their procedures before the changes take effect.

1. Identify active Content Search matters

Check whether any current investigations are relying on Content Search but are likely to require review sets, document tagging, analysis or a more structured review process. Where necessary, create a dedicated eDiscovery case before continuing the collection.

2. Review internal instructions and templates

Update investigation plans, legal hold procedures and eDiscovery guidance so that staff understand the difference between a simple Content Search and a dedicated eDiscovery case.

3. Record export deadlines

Treat the 14-day expiry as a firm operational deadline. Assign responsibility for monitoring completed exports, downloading them and confirming that the files can be opened.

4. Validate downloads promptly

Do not assume that a completed export is usable. Check the downloaded package, review any error reports and confirm that the expected content and metadata are present.

5. Preserve the collection record

Retain the search configuration, processing reports, export information and chain-of-custody records alongside the exported evidence.

6. Check preservation separately

An eDiscovery search does not necessarily preserve the underlying information. Confirm that appropriate holds or retention controls have been applied where evidence must be protected against deletion or alteration.

The Takeaway

The February changes reinforce a useful distinction within Microsoft Purview eDiscovery.

Content Search is intended for straightforward searching and direct export. Dedicated eDiscovery cases should be used where the matter requires defined data sources, review sets or a structured investigation workflow.

The new 14-day export period also means that completed exports cannot be left unattended. Legal and investigation teams will need a clear process for downloading, validating, securing and documenting collected evidence.

A missed download can usually be recreated. Evidence that has changed or disappeared from the source system may not be so easily recovered.

How Forensic Tech Can Help

Forensic Tech assists legal teams and organisations with the identification, preservation, collection and review of Microsoft 365 evidence.

This includes Microsoft Purview eDiscovery searches, review-set preparation, Exchange Online and Teams collections, SharePoint and OneDrive preservation, export validation, evidence scoping and the preparation of defensible collections for litigation, workplace investigations and regulatory matters.

Managing a Microsoft 365 collection or review? Contact us or call 0800 WITNESS (0800 948 637).

Related services: Forensic Collection · Cloud Hosted Review · eDiscovery Processing · Review Solutions