We need to search mail or files for a legal request, how do we do that cleanly?

Compliance Search and eDiscovery let you search across mailboxes, SharePoint sites and Teams chats without bothering each user. For SMB context eDiscovery (Standard) is usually enough, eDiscovery Premium is overkill until you're in actual legal proceedings.

Try this first

1. 1Open Purview admin > eDiscovery > Standard. Create a Case with a clear name and description (for example 'Audit_2026-Q1' or 'Request_Person_X'). Whoever has case access is who can open it, so keep it tight.
2. 2Add locations (which mailboxes, sites, Teams). Usually you mean a specific user plus the team sites they're in. For broad requests you can pick 'all locations', but it takes longer.
3. 3Build a query. KQL syntax: from:name@company.com AND received>=2025-01-01 AND received<=2025-12-31 AND ('search term' OR 'other term'). Test broadly first, narrow once you see noise.
4. 4Run the search and review the preview. For SMB cases usually sufficient. Formal legal proceedings need eDiscovery Premium with holds, custodians and chain-of-custody reporting, but that's a different license.
5. 5Export as PST or reviewable format. Store on a secure location and delete after completion. An eDiscovery export is sensitive data.
6. 6Document: who requested, on what basis, who ran the search, when export was made and deleted. That audit trail protects you if anyone questions the process later.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.