Microsoft eDiscovery vs. Content Search: A Comparison

26 Oct 2021

4 min read

Ahana K.B.

Article at a glance

Microsoft 365 offers both eDiscovery and Content Search, but they serve different purposes:

eDiscovery is designed for legal and compliance needs, allowing for in-depth search, hold, and export capabilities.

Content Search is a more general tool for locating and exporting data across Microsoft services but lacks the legal and administrative features of eDiscovery.

What is the solution?

Use eDiscovery for legal cases and compliance, and Content Search for broader data retrieval needs.

According to ZDNet, on average, every enterprise business is expected to manage about 498 TB of cloud data by end of 2022. This means, identifying specific content will get difficult, even if the data is organized efficiently.

Microsoft’s Content Search and eDiscovery search features help administrators quickly identify the content they need. Although both these features serve the same purpose, the eDiscovery search feature comes with a few additional capabilities than a Content Search tool.

1. What is eDiscovery search?

Microsoft eDiscovery search is available with the eDiscovery tool in the Compliance Center. This feature allows administrators to run searches within Core and Advanced eDiscovery cases using keywords and conditions to identify specific content.

Note: Searches are referred to as “Collections” within an Advanced eDiscovery case.

1.1. What is the license requirement for eDiscovery search?

Organizations need a Microsoft 365 E3 license to access the core eDiscovery and E5 license to use the advanced eDiscovery tool.

1.2. What are the data sources that are included in eDiscovery search?

Administrators can use eDiscovery search to identify data stored in Exchange mailboxes and public folders, SharePoint sites, OneDrive for business, Microsoft Groups, Yammer, Teams Channel (stored in SharePoint Sites) and 1:1 chat message (stored in OneDrive folders).

Data sources covered by eDiscovery Search

Additionally, administrators can also click the “Locations on hold” radio button in the “Locations” section while creating the search to look for content stored in locations that were placed on hold.

1.3. eDiscovery search criteria

To run an eDiscovery search, administrators can set a name, description, add query keyword, and list specific conditions. Once the search is created, they can review the search, and export the results.

1.4. How to run an eDiscovery Search in a Core eDiscovery case?

Step 1: Navigate to the Security and Compliance center. Click “Core eDiscovery” under the eDiscovery drop-down on the navigation menu bar on the left-hand side of the screen.
Step 2: Click “Searches'' from the top menu bar. Click “+New Search”.
Step 3: Type a name and description (optional) for the new search. Click “Next”
Step 4: Choose the location to search for content. Example:
-Specific users, groups, or teams under Exchange mailboxes.
-Specific sites and OneDrive accounts or add the URL for a Microsoft Team, Office 365 Groups, or Yammer Groups SharePoint site.
- Locations on hold.
Click “Next”.
Step 5: Add conditions for the search if needed. This could include specific keyword(s) and add conditions to search for the keyword. Click “Next”.
Step 6: Review the search and click “Submit”. Once the content search run is complete, administrators can take further action like “Edit search,” “Rerun search,” etc. They can also export the search results as a .csv or a compressed .zip file by clicking “Export results”.

2. What is Content Search?

Content Search is the search tool that is available on the compliance center. It’s completely independent of the eDiscovery tool.

2.1. What Is the license requirement for Content Search in Microsoft 365?

The Content Search tool can be accessed by organizations using Microsoft 365 E1 and above licenses.

2.2. What are the data sources that are included in Microsoft 365 Content Search?

Content Search can be used to identify content stored in Yammer, OneDrive (includes Teams 1:1 chats and media), SharePoint (includes Teams channel chats and media), Groups, and Skype for Business messaging conversations.

2.3. Content Search criteria

While creating the search, administrators can add a name, description, choose specific locations to search in. Administrators can also build search queries, and add conditions to further narrow down the search, run an ID list (with a .csv file) to search for specific email messages, etc.

Once the content search is created, administrators can:

- Export the results of the search, and download it to a local computer

- Export a report about the results (not the actual results)

- Search for and delete items (works only for email messages)

2.4. How to run a Content Search?

Step 1: Navigate to the Security and Compliance center. Click “Content Search” from the menu bar on the left-hand side of the screen.
Step 2: Click “Search from the top menu bar. Click “+New Search”.
Step 3: Type a name and description (optional) for the new search. Click “Next”.
Step 4: Choose the location to search for content at. Example:
-Specific users, groups, or teams under Exchange mailboxes
-Specific sites and OneDrive accounts or add the URL for a Microsoft Team, Office 365 Groups, or Yammer Groups SharePoint site.
Click “Next”.
Step 5: Add conditions for the search if needed. This could include specific keyword(s) and add conditions to search for the keyword. Click “Next”.
Step 6: Review the search and click “Submit”. Once the content search run is complete, administrators can take further action like “Edit search,” “Rerun search,” etc. They can also export the search results as a .csv or a compressed .zip file by clicking “Export results”.

3. When to use eDiscovery search and Content Search?

The eDiscovery search tool is available for Core and Advanced eDiscovery features, making it easier to store, access, and manage searches relevant to a specific legal case. Therefore, an eDiscovery search feature is generally used to identify content (including content on hold) to be exported and presented to a legal counsel as potential evidence.

A content search tool, however, does not provide any legal or administrative capabilities like eDiscovery. Hence, the feature is used to simply identify content stored in different Microsoft services (excluding content placed on hold) and export the search results.

Start enjoying faster and easier backups, today

Avoid costly data retention gaps and minimize time to recovery with SysCloud's cloud backup.Start 30-Day Free Trial