Microsoft Purview eDiscovery

Microsoft Purview eDiscovery (opens in a new tab) discovers a data subject's footprint across Microsoft 365 — Exchange, SharePoint, OneDrive, and Teams — and surfaces it for review. Access requests are fully automated. Erasure requests are routed to a manual task, since Purview eDiscovery does not support programmatic deletion across Microsoft 365 workloads.

This is a separate integration from the Microsoft Purview data catalog integration, which discovers and classifies data assets in Purview's Data Map rather than executing data subject requests.

Prerequisites

In order to integrate with Microsoft Purview eDiscovery, you'll need to complete setup in Microsoft Entra ID and Purview, then collect the required credentials. This must be performed by a Microsoft 365 Global Administrator — the Purview role grant below has no portal or API equivalent and cannot be delegated to a non-admin.

1. Confirm your tenant has eDiscovery Premium. Astralis collects the subject's items into a Purview review set, which Microsoft gates behind eDiscovery Premium (delivered through Office 365 E5, Microsoft 365 E5, or an E5 Compliance add-on on E3). The fastest check is to sign in to the Purview portal (opens in a new tab) and try creating a review set. Docs (opens in a new tab)

2. Register an application in Microsoft Entra ID — record the Application (client) ID and Directory (tenant) ID, create a client secret, and add Application permissions (not Delegated) for eDiscovery.Read.All and eDiscovery.ReadWrite.All, then grant admin consent. Record the Enterprise application's Object ID from Enterprise applications — you'll need it for the next step. Docs (opens in a new tab)

3. Grant Purview eDiscovery roles in PowerShell, using the Object ID from step 2. Graph-level permissions alone are not enough; the service principal also needs Purview-level case and role permissions, which are only grantable through Security & Compliance PowerShell:

   Install-Module ExchangeOnlineManagement
   Import-Module ExchangeOnlineManagement
   Connect-IPPSSession
    
   New-ServicePrincipal -AppId "<clientId>" -ObjectId "<enterpriseAppObjectId>" -DisplayName "Fides eDiscovery"
   Add-RoleGroupMember -Identity "eDiscoveryManager" -Member "<enterpriseAppObjectId>"
   Add-eDiscoveryCaseAdmin -User "<enterpriseAppObjectId>"

   This grants tenant-wide search across all mailboxes and sites, so most organizations will want it reviewed by their security team; Purview supports search permission filtering (opens in a new tab) to narrow the scope. Docs (opens in a new tab)

Once setup is complete, you'll need to collect the following information:

Integrating with Microsoft Purview eDiscovery

To integrate an existing system with Microsoft Purview eDiscovery:

1. Navigate to Data map → View Systems and choose the system that you want to connect.
2. Click on the Integrations tab.
3. Pick the vendor or system type that you want to integrate with from the Connection type drop-down menu.
4. Complete the required fields for the integration and click Save.
5. On the Manual tasks tab, assign at least one reviewer. This integration ships with a locked erasure review task — it can't be edited, but it does need an assignee, and setup isn't complete until one is chosen. Without a reviewer, erasure requests have nobody to complete them.

You may confirm your connection is working using the Test connection button, if desired.

To learn more, please see our guides for Managing Integrations and Manual privacy request tasks.

Technical detail

Astralis utilizes API endpoints to access the API service for a SaaS application. An API service is the programmatic interface through which Astralis can query and update data within an application to access, rectify, or delete personal information. Each SaaS tool will have a unique set of endpoints to enable privacy functions.

Microsoft Purview eDiscovery authenticates using the OAuth 2.0 client-credentials grant against Microsoft Entra ID, requesting the https://graph.microsoft.com/.default scope, then calls the Microsoft Graph eDiscovery API (opens in a new tab).

Access behavior

Access requests are fully automated. Astralis gets or creates an eDiscovery case for the privacy request, then a content search scoped to the subject (matching participant, author, and free-text fields across all tenant mailboxes and sites), then estimates the matching item count, then gets or creates a review set and adds the search results to it, then pages through the review set's file listing. Long-running operations (estimate, add-to-review-set) are polled asynchronously. The file listing is capped at 5,000 items, with a truncation notice appended if the cap is hit.

Every step is get-or-create, keyed on the privacy request, so a retried request reuses the case, search, and review set it already made rather than duplicating them. In the Purview portal these appear as a case named Fides DSR <request id>, a search named Fides search <email>, and a review set named Fides review <id>. If the estimate returns no items, the review set step is skipped and the reviewer simply sees a count of zero.

Returned rows expose item metadata only — name, source type, date, size, and location — not raw content. The Participants field is filtered down to entries containing the subject's own email, so no unrelated third-party data is returned. Items Purview couldn't index are called out separately as a completeness caveat.

Erasure behavior

Purview eDiscovery has no API for deleting content across Exchange, SharePoint, OneDrive, and Teams, so erasure requests are routed to a manual task rather than an automated API call. The assigned reviewer sees the item counts and location summary surfaced from the access step, describes the actions they took, and confirms they have reviewed all identified locations. That confirmation is required before the request can complete.

Microsoft Purview eDiscovery endpoints

In the table below, you can find which endpoints are used for each type of privacy function. Clicking on the endpoint will take you to the documentation for that endpoint.