.png)
Last updated on November 5, 2026
Microsoft Purview eDiscovery boundaries are the licensing, configuration, location-scope, retention, content, indexing, and service conditions that determine which information and functions are available to a matter. Purview provides important native preservation, search, audit, collection, processing, review, and export capabilities across Microsoft 365, while counsel and eDiscovery leaders remain responsible for deciding which people, sources, periods, communications, files, and document states the matter requires.
Cloudficient approaches this planning through Context-Aware eDiscovery™: using identity, activity, repository, and document context to help legal teams make better decisions from identification through review. CaseFusion® complements Microsoft 365 in-place preservation by connecting that context to matter-driven identification, orchestration, legal hold and preservation, and targeted collection workflows.
Key takeaways
-
Purview's available functions and information vary with licensing, configuration, retained data, source selection, and the supported workflow.
-
A hold on personal locations may not include shared repositories, group-connected sources, channel sites, or files owned by another user.
-
Content preservation and audit retention follow different paths, so a preserved message or file may outlast related activity records.
-
Cloud attachments connect a communication to a separately stored file whose location and version history require their own matter decisions.
-
Documented limits affect how searches, holds, processing jobs, review-set loads, and exports are divided and reconciled.
-
CaseFusion helps connect identity, activity, repositories, content, and matter decisions across the discovery lifecycle.
Table of contents
What makes a Purview boundary relevant to a matter?
A Purview boundary becomes relevant when a licensing, configuration, source, retention, content, or service condition affects the information or workflow the matter requires. The interface can bring eDiscovery operations together, but it does not make the underlying Microsoft 365 information environment uniform.
One business exchange may involve a message in Exchange, a file in OneDrive or SharePoint, a Teams compliance record in a supported mailbox location, a version history governed by separate settings, and activity records retained on another schedule. The matter depends on the availability of those sources and the relationships among them.
Cloudficient calls the information that cloud collaboration creates around ESI and that does not travel with the content into discovery the context gap. Context-Aware eDiscovery addresses that gap by bringing identity, activity, repository, and document context into the decisions that shape scope.
Native access gives legal teams the mechanism to act on supported Microsoft 365 sources. Matter-level context determines which sources and document states require attention.
Why can custodian-based scope miss collaborative ESI?
Custodian-based scope can miss collaborative ESI because a person's mailbox and OneDrive account represent personal locations, while work may also occur in group mailboxes, SharePoint sites, Teams-connected sites, private and shared channel locations, project repositories, and files owned by other users.
A hold applied to personal locations may therefore leave related shared sources outside its scope. Permissions describe potential access, while matter scope depends on the facts, the person's role, the business process, and the ESI connected to the events at issue.
Time changes the analysis. The directory available when a matter arises reflects current roles, accounts, reporting relationships, and memberships. The relevant period may involve a different role, manager, team, alias, or repository relationship. Identity information for the relevant period helps connect people to the locations that require investigation without treating a current organizational profile as a historical source map.
Cloudficient's CaseFusion can combine available historical HR and identity information with organizational relationships, custodian interviews, and system activity to help legal teams identify additional custodians and data sources. Human knowledge remains essential for confirming relevance, understanding business processes, and applying legal judgment.
A custodian list identifies people. A matter-level source map connects those people to the locations and ESI the matter may require.
Why are audit history and preserved content separate?
Audit history and preserved content are separate because a content hold and an audit-retention policy serve different functions in Microsoft 365. A hold may preserve a supported message or file in a selected location, while activity records describing supported access, sharing, modification, movement, or deletion events follow separate licensing, workload, policy, and retention conditions.
That difference matters when activity could inform identification or collection. A permissions list may show that a person could reach a SharePoint site. Available audit activity may record an event associated with that person and a file. Neither source determines relevance by itself, and an activity record does not establish what a person read, understood, or relied upon. Together with matter facts and organizational information, retained activity can help identify repositories or document states that deserve attention.
CaseFusion can preserve and index available audit activity so it can inform matter-driven data mapping. Where supported activity is available, it may show which repositories people used, accessed, or shared from, helping legal teams evaluate observed activity alongside theoretical access.
The timing question extends beyond whether content remains available. It includes whether activity was recorded for the relevant workload, retained under the policies then in place, and preserved before its retention period ended.
What happens when a message contains a cloud attachment?
A cloud attachment is a cloud-hosted file referenced through a link in an email, chat, or collaboration message rather than embedded as a conventional attachment. The message and file are separate objects and may reside in different Microsoft 365 locations.
The file may continue to change after the link is sent. The current version, the version associated with sharing, and a version associated with a recorded recipient interaction can represent different document states. Which state bears on the matter depends on the issues, available version history, retained activity, and the preservation and collection steps already in place.
Microsoft provides cloud-attachment and version options in supported Purview workflows. Availability and results depend on configuration, licensing, retention settings, source data, and the workflow used. Counsel still determines which linked files and available versions require investigation and how the relationship among the message, link, file, repository, and version should continue into processing and review.
CaseFusion supports collect-to-preserve workflows that can capture messages, identify cloud attachments, resolve linked files, and preserve relevant versions before they change or disappear. Where indexed activity is available, the workflow can also identify additional versions associated with recorded recipient access or other relevant interactions. The activity informs the decision; it does not establish what a person read, understood, or relied upon.
Preserving the message location does not establish that the linked file and the document states the matter calls for were preserved with it.
How do indexing and service limits affect execution?
Indexing and service limits affect execution when one logical scope must be divided across several holds, searches, processing jobs, review-set loads, downloads, or exports. Each division creates another point where populations, settings, exceptions, and results have to be tracked and reconciled.
Indexing illustrates the issue. A parent message or file may appear in results even when attached, embedded, encrypted, oversized, nested, or otherwise unsupported content was not fully available to keyword search. Search results are bounded by the configured process and the content available to the index.
High-volume work creates a related coordination problem. Separate jobs may use different source lists, date conditions, time zones, processing settings, or successor queries. A technically successful job confirms that the operation ran under its configured conditions. Matter-level validation connects the operation to the intended scope and explains how errors, exclusions, retries, overlaps, and replacement jobs were handled.
Cloudficient's decision-driven approach begins with the scope counsel has approved and connects that scope to preservation and collection activity. Better identification does not always produce a smaller scope. It produces a scope supported by better information.
When can native Purview workflows meet the matter's needs?
Native Purview workflows may meet the matter's needs when the relevant people and locations are known, the required content and activity remain available, the necessary functions are licensed and configured, and the expected scope fits within the documented operating conditions.
Additional controls become more important when the relevant period predates current organizational information, shared repositories are central to the events, linked files sit outside personal locations, document versions require closer treatment, audit history informs source identification, or one population must move through several policies and jobs. Their significance should be assessed for the matter at hand.
The useful question is specific: do the tenant conditions, available information, identified locations, and selected workflow support what counsel has decided this matter requires? Cloudficient uses that question to keep technology tied to the legal decision rather than treating data volume as the starting point.
How can Cloudficient help with Purview eDiscovery planning?
Cloudficient helps legal and eDiscovery teams add matter context to Microsoft 365 discovery workflows. Microsoft provides important native preservation, search, audit, and collection capabilities. CaseFusion connects identity, activity, repositories, content, and matter decisions across the discovery lifecycle.
CaseFusion supports four connected areas of the workflow:
-
Identify: Bring together available identity, organizational, interview, and activity information to help identify custodians and data sources.
-
Legal Hold and Preservation: Coordinate notices, preservation actions, status, exceptions, changes, and releases through a documented workflow, including collect-to-preserve strategies where appropriate.
-
Targeted Collection: Apply matter-selected collection and version policies using available repository, content, version-history, and activity information.
-
Analyze: Carry context forward so legal teams can investigate the collected population and return findings to scope.
The value of context continues downstream. Information about why ESI was preserved, how it relates to the matter, and which decisions shaped its collection can travel with it into processing, analysis, review, and export.
Plan around Microsoft Purview's eDiscovery boundaries
Planning Around Microsoft Purview’s eDiscovery Boundaries explains the operational factors that shape identification, preservation, search, collection, and export. It covers licensing and configuration, location-based holds, audit retention, cloud attachments, document versions, indexing, and the demands of high-volume execution.
Frequently asked questions about Microsoft Purview eDiscovery boundaries
Does a Purview hold on a custodian preserve files in shared repositories?
Not necessarily. A hold on a person's mailbox and OneDrive account applies to those selected locations. Related ESI may reside in group mailboxes, SharePoint sites, Teams-connected sites, channel locations, project repositories, or files owned by another user. The source set should reflect the matter's facts and the locations selected for preservation.
Does preserving content in Purview preserve related audit history?
Content preservation and audit retention follow separate paths. A supported message or file may remain preserved while related activity records are subject to different licensing, workload, policy, and retention conditions.
Can Microsoft Purview collect cloud attachments and file versions?
Microsoft provides cloud-attachment and version options in supported Purview workflows. Availability and results depend on licensing, configuration, retention settings, source data, and the workflow used. Counsel determines which linked files and available versions bear on the matter.
Why does identity information for the relevant period matter?
Current directories describe current roles, accounts, managers, and memberships. Earlier events may involve different responsibilities, aliases, teams, or repositories. Identity information for the relevant period can help identify custodians and sources that a current organizational profile may not reveal.
How do partially indexed items affect search results?
A parent item may be returned even when attached, embedded, encrypted, oversized, nested, or unsupported content was not fully available to keyword search. The workflow should identify how partially indexed and exception populations will be treated before downstream decisions rely on the results.
How does CaseFusion work with Microsoft Purview?
Microsoft provides important native preservation, search, audit, and collection capabilities. CaseFusion complements those capabilities by connecting identity, activity, repositories, content, and matter decisions across the discovery lifecycle.
Other posts you may like
