Treat Microsoft 365 as several potential collections: mailbox records, conversations, files and meeting-related records. They may cover different people, periods and workflows. Begin with a bounded inventory question, then inspect the export route and references needed to describe that collection. The tenant’s age is not evidence of retained history.
The documented search-export boundary
Microsoft Purview eDiscovery can export search results. Search-export packages expire 14 days after creation; that package deadline is different from the retention of the underlying mailbox or file records. Licensing and access conditions apply to the export account.
Sources: Microsoft
Separate the source locations
A project may span email, Teams conversation and SharePoint files. Inventory those locations separately, including the actual scope selected for inspection. A search result set is defined by its locations and query, so keep those details with the collection description.
Fictional change CH-14 is discussed in a message, approved by email and reflected in document DOC-8. The useful relationship is the change reference and the relevant document version, not simply membership in the same tenant.
| Group | Reference to inspect | Scope question |
|---|---|---|
| Mailbox records | Message/conversation identity | Which mailboxes and dates? |
| Teams conversation | Thread or work reference | Which conversation context survives? |
| SharePoint/OneDrive files | File and version identity | Content, versions or references? |
| Meeting-related records | Event/recording reference | Which media or action records exist? |
Keep the query with the inventory
Record the selected locations, date filters and the reason they were chosen. A narrow project search can be useful, but it should not be described as the company’s complete operating archive. If the query changed between exports, keep separate collection versions so counts and contents remain interpretable.
Inspect a known cross-location event
Pick one decision whose email and document are known to the team. Can you locate both in the output and identify the relationship? Check whether file content is present or only a reference, whether the intended version is included and whether conversation context is sufficient to understand the decision.
Record missing or skipped items rather than assuming search statistics equal downloaded content. A report count can help reconcile the package, but the inventory should describe what was actually available to inspect.
Keep the export moment separate
Save the export date alongside the event dates. It identifies the version of the result set inspected, rather than extending the historical period covered by the records.
Describe the resulting collection
Use a label such as selected project email and file records for a verified period. Add the references checked and any unresolved history or version question. Provider-interest evidence belongs beside that description, not inside a claim that Microsoft 365 data has been accepted.
- Source locations and selected scope
- Observed dates for each group
- Query and export date
- Stable work/file/conversation references
- Actual file and attachment availability
- Package downloaded and locally inspected
Questions about this comparison
Is the 14-day package expiry a retention period for all Microsoft 365 records?
No. It applies to the generated search-export package, not the underlying record history.
Can a search result count describe the whole collection?
Keep the count, scope and query, then inspect what the downloaded output actually contains.
Should Teams and SharePoint be one group?
Separate them when they contain different records or relationships, even when they describe the same project.
Sources
- Export search results in eDiscoveryMicrosoft · Checked 2026-10-04