Retirement of legacy eDiscovery tools
Tip
eDiscovery (preview) is now available in the new Microsoft Purview portal. To learn more about using the new eDiscovery experience, see Learn about eDiscovery (preview).
Important
The functionality of the legacy eDiscovery tools described in this article has either been removed from the Microsoft 365 service or is still available, but no longer supported. Any functionality that's still available may be removed without notice. If you're still using any of these legacy tools, consider migrating to the eDiscovery tools in the Microsoft Purview compliance portal or one of the alternatives described in this article.
Over the years, Microsoft has provided eDiscovery tools that let you search, preview, and export email content from Exchange Online. However, these tools no longer offer an effective way to search for non-Exchange content in other Microsoft 365 services, such as SharePoint and Microsoft 365 Groups.
To address this, Microsoft offers other eDiscovery tools that help you search for a wide variety of Microsoft 365 content. And we've been working hard to incorporate the most current and powerful eDiscovery functionality in the compliance portal. This allows organizations to respond to legal, internal, and other document requests for content across many Microsoft 365 services, including Exchange Online.
As a result of this new and improved eDiscovery functionality in the compliance portal, the following eDiscovery-related features and functionality related to searching for email content in Exchange Online and Microsoft 365 are retired:
In-Place eDiscovery and In-Place Holds in the Exchange admin center.
The Exchange Online PowerShell cmdlets that support In-Place eDiscovery and In-Place Holds (these cmdlets are collectively identified as *-MailboxSearch cmdlets). This includes the following cmdlets:
Note
The Remove-MailboxSearch cmdlet will be available after the other *-MailboxSearch cmdlets are retired so that you can use it to help in your transition to other eDiscovery and hold tools. However, after a certain date (cited below) Microsoft Support will no longer supports this cmdlet.
The Search-Mailbox cmdlet in Exchange Online PowerShell.
The following operations in the Exchange Web Services API:
Microsoft Purview eDiscovery (Premium) v1.0, which is the first version of eDiscovery (Premium) that's accessed through a Microsoft Purview eDiscovery (Standard) case in the compliance portal. The retirement of eDiscovery (Premium) v1.0 doesn't impact your ability to create and manage eDiscovery (Standard) cases.
Note
The eDiscovery functionality being retired only applies to cloud-based versions of Microsoft 365 and Office 365. eDiscovery functionality in on-premises versions of Exchange and SharePoint will still be supported until further notice.
The following sections in this article provide guidance about each feature being retired. This information including timelines and alternative tools that you can use instead of the retired tool.
Tip
If you're not an E5 customer, use the 90-day Microsoft Purview solutions trial to explore how additional Purview capabilities can help your organization manage data security and compliance needs. Start now at the Microsoft Purview trials hub. Learn details about signing up and trial terms.
In-Place eDiscovery and In-Place Holds in the Exchange admin center
As per the original announcement on July 1, 2017, the In-Place eDiscovery & Hold functionality in the Exchange admin center (EAC) is being retired. The In-Place eDiscovery & Holds page in the EAC allowed you to search, hold, and export content from Exchange Online. In-Place eDiscovery also let you copy search results to a discovery mailbox so that you or other eDiscovery managers could review content and make it available for legal, regulatory, and public requests.
Because all of these capabilities (except for copying search results to a discovery mailbox) are now available in the content search, eDiscovery and eDiscovery (Premium) tools in the compliance portal (with improved functionality, reliability, and support for a wide range of Microsoft 365 services), we recommend that you start using these tools as soon as possible. To help you in the transition to these other eDiscovery tools, the table below lists the tools you can use instead of In-Place eDiscovery and In-Place Hold.
Scope of affected organizations
- Office 365 and Microsoft 365 Enterprise organizations
- Office 365 and Microsoft 365 Education organizations
- Office 365 and Microsoft 365 Government organizations; this includes GCC, GCC High, and DoD
- Office 365 and Microsoft 365 operated by 21Vianet (China)
- Office 365 and Microsoft 365 Germany
Timeline for retirement
- July 1, 2020: You won't be able to create new searches and holds, but you can still run, edit, and delete existing searches at your own risk. Microsoft Support will no longer In-Place eDiscovery & Holds in the EAC.
- October 1, 2020: The In-Place eDiscovery & Holds functionality in the EAC was placed in a read-only mode. This means you'll only be able to remove existing searches and holds.
Alternative tools
The following table describes other tools that you can use to replace the existing functionality that's being retired.
| Functionality | Alternative tool | Comments |
|---|---|---|
| Search, export, and hold for legal purposes | eDiscovery (Standard) cases in the compliance portal | Using the capabilities of eDiscovery (Standard) cases provide the functional parity to In-Place eDiscovery and In-Place Holds. This includes the following:
|
| Hold for retention purposes | Retention policies in the compliance portal | You can use Retention policies to retain content and, if desired, delete it after the retention period expires. Other capabilities include:
For more information, see Learn about retention policies and retention labels. |
| Copy email search results to a discovery mailbox for review | Review sets in eDiscovery (Premium) v2.0 | Reviewing content in Microsoft 365 has never been easier. Review sets have many great capabilities to help reduce the amount of time and data needed to review, including:
For more information, see Overview of the eDiscovery (Premium) solution in Microsoft 365.
Alternatively, you can export search results to PST files and then use Microsoft 365 Import service to import the PSTs to a discovery mailbox. For step-by-step instruction, see Use network upload to import PST files to Office 365. |
| Copy messages from one mailbox to a different mailbox | Assign permissions to a mailbox | To give a person access to another user's email (such as when an employee leaves your organization and you need to give another person access to the former employee's email), we recommended that you assign that person permissions to access the former employee's mailbox. So instead of copying mailbox items to another user mailbox or a shared mailbox, just assign a user the permissions necessary to access the source mailbox. |
| Restore items from the Recoverable Items folder | Restore-RecoverableItems | You can restore permanently deleted items (also known as soft-deleted items) in mailboxes, as long as the deleted item retention period for an item hasn't expired. For more information, see Recoverable Items folder in Exchange Online. |
FAQs about In-Place eDiscovery and In-Place Holds
I use the copy search results functionality of In-Place eDiscovery & Holds in the EAC to copy search results to a discovery mailbox for review by attorneys. What options do I have now?
There are two ways to replicate this functionality today. The first is to use review sets in eDiscovery (Premium) v2.0. Review sets have many of the same capabilities you see in a traditional review tool like fast search of documents, tagging, email threading, near duplicate grouping, themes analysis, and predictive coding. If you still want to use discovery mailboxes for review, the second option is to export search results to PST files and then import the PST files to a discovery mailbox by using the PST import feature in the Microsoft compliance center.
How do I control which content locations (such as mailboxes or sites) that can an eDiscovery manager can search using the new tools?
The compliance portal also uses compliance boundaries to control which content locations an eDiscovery Manager can search. Compliance boundaries are useful in government entities that need to stay within agency boundaries or multi-national corporations required to respect geographical boarders.
*-MailboxSearch cmdlets
As per the original notice announced on July 1, 2017 in the Exchange admin center, the In-Place eDiscovery & Hold functionality and the corresponding *-MailboxSearch cmdlets are being retired. These cmdlets provide users the ability to search, hold, and export mailbox content for legal, regulatory, and public requests.
Because these capabilities are now available in the compliance portal and Office 365 Security & Compliance PowerShell with improved performance and scalability, you should using these improved cmdlets. These cmdlets include *-ComplianceCase, *-ComplianceSearch, *-CaseHoldPolicy, *-CaseHoldRule, and *-ComplianceSearchAction.
Scope of affected organizations
- Office 365 and Microsoft 365 Enterprise organizations
- Office 365 and Microsoft 365 Education organizations
- Office 365 and Microsoft 365 Government organizations; this includes GCC, GCC High, and DoD
- Office 365 and Microsoft 365 operated by 21Vianet (China)
- Office 365 Germany
Timeline
- July 1, 2020: You won't be able to use New-MailboxSearch to create new In-Place eDiscovery searches and In-Place Holds, but you can still use cmdlets to run, edit, and delete existing searches and holds at your own risk. Microsoft Support will no longer provide assistance for these types of searches and holds.
- October 1, 2020: The In-Place eDiscovery & Holds functionality in the EAC was placed in a read-only mode. You won't be able to use the New-MailboxSearch, Start-MailboxSearch, or Set-MailboxSearch cmdlets. You'll only be able to get and remove existing searches and holds.
Alternative tools
The following table describes other tools that you can use to replace the existing functionality that's being retired.
| Functionality | Alternative tools | Comments |
|---|---|---|
| Search and export |
|
The ComplianceSearch and ComplianceSearchAction cmdlets work together to help you search and export content. You can create a new search and view the search estimate by using the New-, Get-, and Start-ComplianceSearch cmdlets. Then you can use the New-ComplianceSearchAction cmdlet to export the search results. You'll still have to use the eDiscovery (Standard) tool in the compliance portal to download those search results to your local computer.
Note: If you use these cmdlets to create searches that aren't associated with a eDiscovery (Standard) case, these searches will be located on the Content search page in the compliance portal. |
| Hold content in a mailbox |
|
Holds in the compliance portal must be associated with a ComplianceCase. First, create the compliance case, and then create a CaseHoldPolicy and a CaseHoldRule. Note: Creating a CaseHoldPolicy without a creating CaseHoldRule will render the hold inoperable until the CaseHoldRule is created and associated to the CaseHoldPolicy. See the cmdlet documentation for more information. |
| Copy search results to a discovery mailbox | None | There's no direct replacement for this functionality because it does not provide access to all Microsoft 365 services. See the following FAQ below for alternative solutions. |
| Copy messages from one mailbox to a different mailbox | Assign permissions to a mailbox | To give a person access to another user's email (such as when an employee leaves your organization and you need to give another person access to the former employee's email), we recommended that you assign that person permissions to access the former employee's mailbox. So instead of copying mailbox items to another user mailbox or a shared mailbox, just assign a user permissions to access the source mailbox. |
FAQs about *-MailboxSearch cmdlets
We use Copy Search to export email messages or instant Messages for purposes other eDiscovery and legal investigations. What other options do we have after these cmdlets are retired?
The Microsoft Graph APIs provide a number of methods for extracting data for analysis and other purposes that are far more resilient and scalable than the using the *-MailboxSearch cmdlets.
After the cmdlets are retired, will I still be able to remove or retrieve searches?
Yes, although we're removing the ability to create and modify searches, you'll still be able to use the Remove-MailboxSearch until further notice. However, the use of this cmdlet will be at your own risk after the retirement dates and Microsoft Support will no longer be able to provide assistance.
Search-Mailbox cmdlet
The Search-Mailbox cmdlet in Exchange Online PowerShell has been retired as originally announced in a warning in the cmdlet output starting back in 2018. The Search-Mailbox cmdlet was originally used to search a user's mailbox and purge malicious content. We recommend that you start using the New-ComplianceSearch and New-ComplianceSearchAction cmdlets in Office 365 Security & Compliance PowerShell to search for and purge content. For a built-in security experience, the <Microsoft 365 security features provide robust threat protection for email and many other Microsoft services.
Scope of affected organizations
- Office 365 and Microsoft 365 Enterprise organizations
- Office 365 and Microsoft 365 Education organizations
- Office 365 and Microsoft 365 Government organizations; this includes GCC, GCC High, and DoD
- Office 365 and Microsoft 365 operated by 21Vianet (China)
- Office 365 Germany
Timeline
April, 2024: The Search-Mailbox cmdlet is no longer be available and Microsoft Support will no longer provide assistance.
Alternative tools
The following table describes other tools that you can use to replace the existing functionality that's being retired.
| Functionality | Alternative tools | Comments |
|---|---|---|
| Search a mailbox | The ComplianceSearch and ComplianceSearchAction cmdlets work together to help you search and export content. You can create a new search and view the search estimate by using the New-, Get-, and Start-ComplianceSearch cmdlets. Then you can use the New-ComplianceSearchAction -Export command to export the search results. You'll still have to use the eDiscovery (Standard) tool in the compliance portal to download those search results to your local computer. |
|
| Delete bulk email from a mailbox | Admins can create an archiving and deletion policy that automatically moves items to a user's archive mailbox and automatically deletes items from the mailbox. |
|
| Copy search results to a discovery mailbox | There's no direct replacement for this functionality because it does not provide access to all Microsoft 365 services. See the FAQs in the *-MailboxSearch cmdlets section for alternative solutions. | |
| Copy messages from one mailbox to a different mailbox | Assign permissions to a mailbox | To give a person access to another user's email (such as when an employee leaves your organization and you need to give another person access to the former employee's email), we recommended that you assign that person permissions to access the former employee's mailbox. So instead of copying mailbox items to another user mailbox or a shared mailbox, just assign a user permission to access the source mailbox. |
| Purge messages from a mailbox | The ComplianceSearch and ComplianceSearchAction cmdlets work together to help you search and purge content. You can create and run a search with New-ComplianceSearch and New-ComplianceSearch cmdlets, and then you can purge the content by using New-ComplianceSearchAction -Purge -PurgeType command. For more information, see Search for and delete messages. |
|
| Purge messages from a mailbox | Assign permissions to a mailbox | To purge messages from a mailbox, assign an administrator permissions to access the employee's mailbox. Messages can be deleted and recycled as needed taking advantage of the built-in search and viewing capabilities in Outlook. |
Exchange Web Services API operations
These operations in the Exchange Web Services API are used by the In-Place eDiscovery & Holds feature in the Exchange admin center and the corresponding *-MailboxSearch cmdlets in Exchange Online PowerShell. They will also be retired as part of retiring the other legacy eDiscovery tools.
Scope of affected organizations
- Office 365 and Microsoft 365 Enterprise organizations
- Office 365 and Microsoft 365 Education organizations
- Office 365 and Microsoft 365 Government organizations; this includes GCC, GCC High, and DoD
- Office 365 Germany
Timeline
July 1, 2020: The GetSearchableMailboxes, SearchMailboxes, SetHoldOnMailboxes, and GetHoldOnMailboxes operations will no longer be available, and Microsoft Support will no longer provide assistance.
eDiscovery (Premium) v1.0
eDiscovery (Premium) v1.0, which is the version of eDiscovery (Premium) available in a eDiscovery (Standard) case by selecting Switch to eDiscovery (Premium), is being retired. Its functionality has been replaced by the new eDiscovery (Premium) solution in the compliance portal.
To determine if your organization is using eDiscovery (Premium) v1.0:
Note
For a limited time, this classic eDiscovery experience is also available in the new Microsoft Purview portal. Enable Compliance portal classic eDiscovery experience in eDiscovery (preview) experience settings to display the classic experience in the new Microsoft Purview portal.
Go to the compliance portal, select eDiscovery (Standard), and open a eDiscovery (Standard) case.
If you see Switch to eDiscovery (Premium), selecting it takes you to the 1.0 version of eDiscovery (Premium), which is being retired. The ability to create and manage cases in eDiscovery (Standard) won't be affected. Only the ability to add and analyze case data in eDiscovery (Premium) v1.0 (by selecting Switch to eDiscovery (Premium)) is being retired.
The new eDiscovery (Premium) solution in Microsoft 365 (also known as eDiscovery (Premium) v2.0) provides all of the capabilities of the original solution, but now includes a custodian-based approach of identifying content in other Microsoft 365 services, collecting that content, and then adding it to a review set where reviewers can take advantage of fast search queries, tagging, and analytics features to help cull relevant documents. eDiscovery (Premium) now includes improved processing and native viewers for both Microsoft and non-Microsoft file types, a full list of file types is here and supported metadata fields are here. Also, the new eDiscovery (Premium) solution provides a powerful custodian holds management feature that lets you apply holds to content in different services, notify users of the holds, and track custodian responses, all within an eDiscovery (Premium) case.
To access eDiscovery (Premium) v2.0:
Go to the compliance portal, select eDiscovery > Advanced, and open a eDiscovery (Standard) case.
At this time, we recommend that you begin to transition your eDiscovery workflow to the new eDiscovery (Premium) functionality. If necessary, you can archive your eDiscovery (Premium) 1.0 cases by exporting the content and storing it offline. Although you'll still be able to access eDiscovery (Premium) v1.0 in existing cases until December 31, 2020, Microsoft Support won't provide support after October 1, 2020. See the following timeline for more details.
Scope of affected organizations
- Office 365 and Microsoft 365 Enterprise organizations
- Office 365 and Microsoft 365 Education organizations
- Office 365 and Microsoft 365 Government organizations; this includes GCC, GCC High, and DoD
- Office 365 Germany
Timeline
- July 1, 2020: You won't be able to create new eDiscovery (Premium) v1.0 cases.
- October 1, 2020: You won't be able to add new data (Prepare search results for eDiscovery (Premium)) to any cases. You'll be able to continue working with data in existing cases at your own risk. Microsoft Support will no longer provide assistance.
- December 31, 2020: You won't be able to access eDiscovery (Premium) v1.0 cases.
Alternative tools
The eDiscovery (Premium) solution in the compliance portal.