Microsoft 365 Advanced eDiscovery Licensing: What It Costs and When You Actually Need It

Advanced eDiscovery — now officially branded as Microsoft Purview eDiscovery (Premium) — is the enterprise-grade legal hold and content collection platform built into Microsoft 365. For organizations with meaningful litigation risk, regulatory examination exposure, or government information requests, it provides significant value. For organizations without those specific drivers, it represents one of the most commonly over-sold components of the E5 Compliance bundle.

The licensing question for Advanced eDiscovery is more nuanced than most M365 compliance features: it's not just about which license tier includes it, but about the distinction between Standard and Premium capabilities, the custodian-based licensing model, and whether third-party eDiscovery platforms (Relativity, Nuix, ZL Technologies) offer a more economical solution for your litigation profile. This guide addresses all three dimensions.

Standard vs. Premium: The Capability Gap That Drives Licensing Decisions

Understanding which eDiscovery tier you actually need requires understanding what each tier delivers. Most organizations assume they need Premium because their legal team says so — but legal teams are rarely exposed to the actual capability differences that justify the licensing cost.

The capability gap is significant for organizations with complex litigation. The custodian management workflow, conversation threading (critical for Teams-heavy organizations), and predictive coding capabilities in Premium are genuinely valuable for legal teams managing large matters. For organizations with simple, infrequent eDiscovery needs — occasional HR investigations, simple regulatory requests — Standard may be entirely sufficient.

Who Needs to Be Licensed for Premium eDiscovery

This is the critical licensing question, and Microsoft's guidance is consistent but often misapplied in practice.

Custodians: The Primary Licensing Subject

A "custodian" in eDiscovery terminology is a user whose mailbox, OneDrive, or Teams data is placed on legal hold or collected into a review set. Each custodian must hold E5 or E5 Compliance licensing at the time their data is collected or placed on hold. The licensing obligation is not prospective — it applies at the point of data action, not when the case is opened.

Case Managers and Legal Reviewers

Users who manage eDiscovery cases in the Purview portal (creating cases, running searches, managing holds, reviewing content) must also hold E5 Compliance. These users are typically a small population: in-house legal counsel, compliance officers, and IT administrators supporting the legal function — typically 10–50 users in most organizations.

What About On-Hold But Unlicensed Users?

A common compliance gap: organizations place users on In-Place Hold (which works at E3 tier) but then need to run Premium-level eDiscovery searches against that preserved data. If the custodian's data needs to be collected into a Premium review set, the custodian needs E5 Compliance licensing at the time of collection — not just at the time of the original hold. Organizations that hold data at E3 and then attempt Premium collection will need to either temporarily upgrade custodian licenses or manage a complex mixed-tier approach.

Modeling Your Actual Litigation Risk to Size the Licensing Need

The right framework for eDiscovery licensing is not "do we need Premium?" but "what is our litigation profile, how many custodians are typically in scope for our matters, and what capabilities does our legal team actually use?" This requires input from General Counsel and litigation support, not just IT.

Key questions for the litigation risk analysis:

• Average active litigation matters per year: An organization with 2 matters per year, each involving 10–20 custodians, has very different licensing needs than one with 50 matters involving 500+ custodians.
• Nature of matters: Employment litigation (email-heavy, simpler threading) vs. commercial litigation (complex multi-party, Teams-heavy) has different Premium feature requirements.
• Regulatory examination frequency: Organizations subject to frequent SEC, CFTC, or FCA examinations need robust eDiscovery capability year-round, not on-demand.
• Current eDiscovery tool stack: If you're running Relativity or Nuix for litigation review, the Premium features (predictive coding, near-duplicate detection) may be redundant — those platforms provide comparable or superior functionality. In that case, Standard eDiscovery for collection and export, combined with third-party review tools, may be the optimal model.

Advanced eDiscovery vs. Third-Party Platforms: The Hybrid Model

For many enterprises, the optimal eDiscovery architecture is hybrid: Microsoft 365 Advanced eDiscovery for collection, hold management, and initial processing (leveraging native M365 integration and the Premium features included in E5 Compliance) plus a third-party review platform (Relativity, DISCO, Everlaw, Nuix) for attorney review and production.

The rationale: Advanced eDiscovery is excellent at the collection and early-case-assessment phase within the Microsoft ecosystem. Teams conversation threading, custodian hold notifications, and the review set workflow are genuinely better in the native Microsoft tool than in third-party platforms with M365 connectors. But for large-scale attorney review, production, and case management, Relativity and its alternatives remain dominant — and legal teams that know Relativity are not going to switch to Purview for the review phase.

The licensing implication of the hybrid model: you need Advanced eDiscovery (E5 Compliance) for collection and hold management, and you pay separately for the third-party review platform. The cost savings from replacing Relativity with Purview Premium for review are typically insufficient to justify the workflow disruption — unless you're a smaller organization where Relativity's per-matter costs are prohibitive.

Teams eDiscovery: The Premium-Critical Use Case

If your organization has significant Teams usage — which in 2026 means virtually every enterprise — Advanced eDiscovery Premium's conversation threading capability is the most compelling licensing argument.

Microsoft Teams stores chat messages in a complex structure: individual messages are stored as individual items in the underlying Exchange Online infrastructure. When exported at the Standard tier, Teams chats export as individual message records — completely unusable for legal review without extensive reconstruction. Advanced eDiscovery Premium reconstructs Teams conversations into threaded, contextually readable format, with proper time ordering, and can include meeting chat and channel conversations in the same logical view.

For any organization where Teams is the primary internal communication platform — and where legal matters routinely involve Teams communications — the conversation threading capability alone can justify E5 Compliance licensing. The alternative (third-party Teams archiving and threading tools) typically costs $10–20 per user per year for the monitored population, which is comparable to E5 Compliance add-on pricing when amortized across other compliance features the add-on provides.

In-Place Hold vs. Retention Policies: The Compliance Architecture Decision

Organizations frequently confuse legal hold (eDiscovery-driven preservation of specific user data in response to a legal matter) with retention policies (systematic application of retention schedules across all data). These are different capabilities with different licensing implications.

Retention policies — applying 7-year retention to all Exchange Online email, for example — are available at the E3 tier via Microsoft Purview retention. Legal hold — placing a specific employee's mailbox on hold in response to litigation — requires eDiscovery. Both Standard and Premium eDiscovery support legal hold, but the management workflow for custodian holds, hold notifications, and release of holds is significantly better in Premium.

Organizations that use retention policies as a substitute for legal hold (relying on the fact that all data is retained by policy rather than managing per-custodian holds) may not need Advanced eDiscovery Premium — but this strategy has legal defensibility risks that counsel must evaluate. Blanket retention without custodian-level hold management is not adequate in jurisdictions that require demonstrated custodian-level preservation steps.

Negotiating Advanced eDiscovery Licensing in Your EA

Advanced eDiscovery is almost always purchased as part of the E5 Compliance add-on. The negotiation levers specific to eDiscovery-driven E5 Compliance purchases:

Custodian Count as a Negotiation Anchor

If your legal team can document that your typical litigation involves 25–75 custodians, this count becomes the licensing anchor for E5 Compliance purchases driven by eDiscovery requirements. This is typically a small fraction of total tenant users — and significantly smaller than the "all users" proposals that Microsoft account teams generate by default.

Third-Party Platform Cost as Competitive Leverage

Present your current eDiscovery platform spend (per-matter Relativity fees, third-party archiving costs, etc.) as the baseline Microsoft must beat or match to win consolidation. Microsoft wants to own the eDiscovery workflow natively — use that ambition as discount pressure on E5 Compliance pricing.

Align with Other E5 Compliance Purchases

The most efficient path for organizations that need eDiscovery Premium, Communication Compliance, Information Barriers, and Insider Risk is to negotiate one E5 Compliance bundle for the population that needs all four features — and price it as a consolidated negotiation, not four separate add-on conversations. The bundle discount on E5 Compliance is substantially larger than the sum of individual feature add-on discounts.

For the full EA negotiation framework, see our EA Negotiation Complete Guide, the Compliance Add-Ons guide, and our EA Negotiation service.

eDiscovery in the Broader Compliance Architecture

Advanced eDiscovery sits at the intersection of legal, compliance, and IT — and integrates with the other E5 Compliance features that organizations in regulated industries typically also need:

• Information Barriers — IB-managed segments may require eDiscovery to cross segment boundaries during investigations (requires careful configuration). See our Information Barriers guide.
• Communication Compliance — flagged communications in Communication Compliance can be escalated to eDiscovery for legal investigation. See our Communication Compliance guide.
• Insider Risk Management — IRM cases with evidence of data exfiltration can be escalated to eDiscovery for forensic preservation. See our Insider Risk guide.
• Microsoft Purview Audit (Premium) — 180-day audit log retention (vs. 90-day standard) is critical for forensic investigations — included in E5 Compliance.

Conclusion: eDiscovery Licensing Should Follow Litigation Risk, Not Sales Pressure

Advanced eDiscovery Premium is the right choice for organizations with meaningful, recurring litigation risk, Teams-heavy communication environments, and internal legal teams that can leverage the custodian management and predictive coding capabilities. It is the wrong choice for organizations that license E5 Compliance primarily because their Microsoft account team recommended it without a rigorous litigation risk analysis.

The framework: define your typical custodian count, assess whether Teams conversation threading is essential (it usually is), compare the E5 Compliance add-on cost for that population against current third-party eDiscovery tool spend, and make the decision based on that analysis — not on a Microsoft-provided ROI calculator.