Table of Contents
New UX Returns Content Searches to their Original State
The announcement in message center notification MC1216266 (9 January 2026) of a change to the content search feature in the Purview eDiscovery solution didn’t come as a surprise. In a nutshell, Microsoft is restricting the functionality of content searches to make them a simple find and export mechanism. If eDiscovery administrators want to use full eDiscovery features, like creating review sets and holds, they must create full-blown eDiscovery cases. The change is effective from February 16, 2026.
The History of Content Searches
Some history can explain why Microsoft is making the change. Originally, following the transition from the workload-specific eDiscovery systems in Exchange Online and SharePoint Online, three separate eDiscovery components existed in Microsoft 365: eDiscovery standard (E3), eDiscovery Premium (a high-end eDiscovery product bought from Equivio in 2015 and included in Office 365 E3), and content searches. Clearly, this was a recipe for overlap and wasted engineering effort.
Microsoft’s solution was to modernize eDiscovery by creating a single eDiscovery framework to support the three existing mechanisms. The functionality differences for the standard and premium solutions could be controlled by the user interface, which only reveals features if a user has the right license. Although this approach works well for standard and premium eDiscovery, content searches didn’t fit into the new framework.
To solve the problem, Microsoft created a special eDiscovery case and added the existing content searches as case searches. In other words, if you look at the special content search case, you see multiple searches – one for every previous standalone content search. This isn’t an issue for the eDiscovery framework because its architecture has always supported multiple searches per case. The idea worked and the transition of content searches to the new eDiscovery occurred in May 2025.
How Administrators Use Content Searches
Purview eDiscovery is a highly functional solution intended to meet the needs of eDiscovery investigators who might have to process millions of emails and files. Content searches have traditionally been used by administrators for much simpler purposes, such as finding messages that an organization wishes to purge with a compliance search action or (as in Figure 1), finding if a user sent a specific Teams chat message.
However, because content searches had become eDiscovery case searches, they gained a heap of functionality that isn’t needed for simple searches that just gets in the way. For example, adding a review set (of items found by a search) is inappropriate. If investigators want to perform deep-dive analysis on items, they should use a full eDiscovery case. The same is true for eDiscovery in-place holds.
Microsoft is therefore introducing a simplified interface that reflects how administrators use content searches. You’ll still be able to search and find items, and export those items if necessary (for instance, to create an archive for all items owned by a specific user). That’s enough for most content searches. If any more features are needed, create an eDiscovery case.
Applying an Expiration Period to Exports of Search Results
Speaking of eDiscovery cases, another change (MC1217141, 13 January 2026) happening on February 2026 will see a 14-day expiration period applied to the Azure blob containers used to hold export data found by searches, including content searches. The limit doesn’t apply to the containers used for review set exports.
The idea behind the change is simple. The results of searches performed against a dynamic environment like Microsoft 365 change over time. If you download export results some days after a search completes, the results are likely to be incomplete and will become increasingly incomplete over time. Applying a 14-day expiration period is a balance between usefulness and accuracy. However, my advice is to export data as soon as possible after searches complete, just to be sure that any review is conducted against current information (or as close as you can get to it).
Learn how to use Purview eDiscovery and to exploit the data available to Microsoft 365 tenant administrators through the Office 365 for IT Pros eBook. We love figuring out how things work.