eDiscovery Standard or Premium in Purview: Which Do You Need?

When counsel or compliance calls to say content has to be held and searched, you will be asked whether the tenant can do it, who is licensed, and whether anyone has tested it. Older guides answer that by comparing two products, eDiscovery (Standard) and eDiscovery (Premium). Since August 31, 2025, according to Microsoft, there is one eDiscovery experience in the Microsoft Purview portal, and “premium” is a set of features your license includes and a setting turns on for new cases. Microsoft also says that when premium features are used, the person whose data is analyzed and the administrator doing the analysis both need the appropriate license or add-on.

What to preserve, and when, is for counsel to decide. This page covers what the platform can do, who has to be licensed for it, and how to tell which tier your matters need.

Standard and Premium Are No Longer Separate Tools

If the guide you are reading compares eDiscovery (Standard) and eDiscovery (Premium) as two separate tools, it describes tools Microsoft has retired. Microsoft’s Microsoft Purview eDiscovery legacy solutions page, read on 2026-10-20, says “Microsoft retired all classic eDiscovery experiences on August 31, 2025.” and that its guidance “only applies to organizations hosted in Microsoft 365 operated by 21Vianet (China).” The retirement covered the classic eDiscovery (Standard) and eDiscovery (Premium) tools.

The current experience is organized differently. Microsoft’s Learn about eDiscovery page says “In previous versions of eDiscovery, custodians (users) were the primary component of the eDiscovery workflow.” and now “In eDiscovery, cases are the primary component of the eDiscovery workflow. You still add people, groups, and data sources to cases, but the case is the central organizing unit.” It adds: “Depending on the licensing and subscriptions for your organization, you have access to specific eDiscovery or premium eDiscovery features in the Microsoft Purview portal.”

Microsoft’s licensing page still uses the older names. The Microsoft Purview service description lists “eDiscovery (standard)” and “eDiscovery (premium)” as licensed features, so when this page says Standard or Premium, it means the features each license includes in the one tool.

What Every eDiscovery-Licensed Tenant Can Do

Before you buy anything, check what the tenant already has. The Learn about eDiscovery page puts it plainly: “Use eDiscovery cases to identify, hold, and export content found in mailboxes and sites.” Its capability table, with the columns “eDiscovery feature support” and “Premium eDiscovery feature support”, marks these rows as supported in both columns: Search for content; Keyword queries and search conditions; Search statistics and samples; Export search results; Role-based permissions; Case management; Place content locations on hold; Search and delete data; and Graph API delegated authentication.

The service description defines the same tier in licensing terms: “eDiscovery (standard) enables you to create eDiscovery cases and assign eDiscovery managers to specific cases. eDiscovery managers can only access the cases of which they’re members. eDiscovery (standard) also lets you associate searches and exports with a case and lets you place an eDiscovery hold on content locations relevant to the case.”

A hold at this level is on content locations. The Learn about eDiscovery page describes it as “Preserve content relevant to your investigation by placing a hold on the content locations in a case.” The search experience has also absorbed the old Content Search tool: “All Content Search features are now included within the search experience in eDiscovery”.

What Premium Features Add

When your team has to read, cull and analyze content before it leaves Microsoft 365, the premium column is where the work happens. The rows the Learn about eDiscovery table marks only in the premium column include Review sets, Import external data to review sets, Support for cloud attachments and SharePoint versions, Optical character recognition, Conversation threading, Decryption, Review set filtering, Tagging and Analytics.

The review set is the center of it. Microsoft says “A review set is a secure, Microsoft-provided Azure Storage location in the Microsoft cloud. When you add data to a review set, the collected items are copied from their original content location to the review set.” Around it, Microsoft describes analytics this way: “Near duplicate detection groups textually similar documents together” and “Email threading identifies specific email messages that give a complete context of the conversation in an email thread.” For protected content, it says “Email messages and attachments encrypted with Microsoft Purview Message Encryption, and documents protected with sensitivity labels or Azure Rights Management, are automatically decrypted when added to search results or review sets.”

Holds get narrower tools too. Microsoft’s Create holds in eDiscovery page says “The eDiscovery (Premium) hold capabilities required for query-based, time-bound, and custodian-scoped holds are included only in higher tiers (for example, Microsoft 365 E5 / A5 / G5 or the Microsoft 365 E5 Compliance and E5 eDiscovery & Audit add-ons).” The service description defines a custodian: “In Microsoft Purview eDiscovery, a custodian refers to the individual whose content is subject to search, hold, or review as part of a legal, regulatory, or investigative process.”

On hold notices, Microsoft’s service description says of premium eDiscovery: “It also lets legal teams manage the entire legal hold notification workflow to communicate with custodians involved in a case.” We found no current Microsoft page describing how those notices are sent in the new portal, so confirm the workflow in your own tenant before you promise it to counsel.

Licensing as Microsoft States It

If you own the license mix, this is the section to take to procurement. In the service description’s eDiscovery licensing table, the “eDiscovery (premium)” row reads “Yes” in the column for “E5/A5/F5/G5, Microsoft Purview Suite/EDU/GOV/FLW, Microsoft 365 E5/A5/F5/G5 eDiscovery and Audit, Office 365 E5/A5/G5” and “No” in the column for “Microsoft Office 365 E3/A3/G3/F3, Microsoft 365 E3”. The “eDiscovery (standard) for sites and files” and “eDiscovery (standard) for email” rows read “Yes” in both. The Learn about eDiscovery page says the same in prose: “If your organization has an Office 365 E5 or Microsoft 365 E5 subscription (or related E5 add-on subscriptions), you can further manage cases and analyze content by using premium eDiscovery features.”

Microsoft ties premium licensing to people, not only to the tenant. The service description says “When eDiscovery (premium) features are used, both the user whose data is being analyzed and the administrator performing the analysis must have the appropriate license or add-on.” Microsoft’s Get started with eDiscovery page says “Both admins and users working with eDiscovery cases require a Microsoft 365 Enterprise E3 or E5 license.”

Before your team places the next legal hold, confirm which license covers it, because holds have their own license line. The Create holds page says “eDiscovery holds require an eligible license on every user whose content you preserve” and “Frontline subscriptions such as Office 365 F1 and F3 don’t include the rights required to be the target of an eDiscovery hold.” It adds: “Placing a user on hold without proper licensing isn’t supported.” For shared mailboxes, the service description says “Placing a shared mailbox on hold using Microsoft Purview eDiscovery (standard or premium) is subject to the same licensing requirements as placing a hold directly in Exchange Online”, which it names as Exchange Online Plan 2, or Exchange Online Plan 1 with the Exchange Online Archiving add-on.

Some costs sit outside the license. Microsoft’s Billing in eDiscovery page says “eDiscovery uses a billing model based on the combination of your enterprise subscription and pay-as-you-go billing for certain features.” It lists “Pay-as-you-go billing for data storage for non-Microsoft 365 enterprise and cloud AI application data in eDiscovery cases.” and “Pay-as-you-go billing for using Microsoft Graph APIs for tenants with E3 eDiscovery licenses.” It also says “Usage of Export API is billed based on the volume of data exported.” For what the license step itself costs, see Microsoft 365 E3 vs E5 cost.

The Questions That Decide the Tier

If you cannot say today which tier your next matter needs, answer these about your own organization. None of them is a legal question; each asks what the platform has to do.

• Where does review happen: inside Microsoft 365, or on outside counsel’s review platform after export?
• Do holds need to follow people, queries or date ranges, rather than whole mailboxes and sites?
• Could content encrypted with Microsoft Purview Message Encryption or protected by sensitivity labels be in scope?
• Could Teams conversations be evidence in eDiscovery, where the surrounding thread matters as much as the matching message?
• Is part of the workforce on frontline licenses such as Office 365 F1 or F3?
• How many matters and investigations arrive, and who on your side runs them?

If outside counsel reviews your exports, holds are location-wide, protected content is rare and matters are few, the eDiscovery features in E3 may be enough. Each other answer is a reason to license premium features for the people it touches. The frontline answer is a licensing gap on either tier, because Microsoft says F1 and F3 users cannot be the target of an eDiscovery hold.

Before the First Matter

If the first time anyone opens an eDiscovery case is the day a matter arrives, the setup work lands on the worst possible day. The Get started with eDiscovery page lists the setup in order. Step 1 assigns permissions, and “The easiest way to assign roles is to add the user to the appropriate role group on the Role groups page in the Microsoft Purview portal.” Step 2 verifies that the required Enterprise apps are enabled, because “If you don’t enable these apps, you can’t access all eDiscovery view, filter, and search features.” Step 3 reviews global settings, including “General: Turn on or off premium eDiscovery features for new cases.” Step 4 creates a case, and “The user who creates the case is automatically added as a member.”

Add two steps of your own. Assign the premium license to the people who could be custodians and reviewers before a matter names them, since Microsoft ties premium use to both. Then run a test case end to end on test mailboxes and sites: a search, a hold, a review set if you have premium features, and an export, so the first real case is not the first run.

Groups need care on holds. The Create holds page says “Group membership is captured as a point-in-time snapshot when the hold policy is created.” and “Members added to the group later are not automatically placed on hold”. Put a check for new group members into the hold procedure.

Who Does This Work

If no one on your team owns the eDiscovery setup and the license question keeps moving between IT, legal and procurement, a senior, US-based i3solutions architect can settle it before the next matter.

The work you can hire for this is project and advisory work: the tier and licensing decision, roles and permissions, the global settings, a hold and search procedure, and a full test run before the first real case. Your legal team and counsel run the matters. The readiness offer itself is described on Purview technology readiness services.

For the wider practice, see governance, compliance and security solutions. i3solutions maps governance to named control families, enforces it in the platform through Entra ID, Purview, and Azure Policy, and evidences it continuously rather than reconstructing it at audit. Delivery is senior and US-based.