eDiscovery review sets are where collected Microsoft 365 content goes to be read, analysed, tagged and exported inside a Microsoft Purview eDiscovery case, and they are a Premium feature. An earlier version of this page talked about custodian review sets as if they were one feature. They are two separate things, and confusing them is how a case ends up scoped to the wrong people with content nobody can remove. This page separates them, sets out what review sets do in the current Purview experience, and covers the decisions you cannot reverse. The licence side of Premium is covered in Microsoft Purview cost and licensing.
What eDiscovery review sets are
Microsoft defines a review set as a static set of documents where you can analyse, query, view, tag and export data in a case. It lives inside a case and appears on that case’s Review sets tab. Content gets there by adding search results to it, and Microsoft’s eDiscovery overview states that advanced indexing now runs automatically at that point, so there is no separate reindexing step to remember.
The word that matters is static. The same overview says searches are not immutable, even after their results have been added to a review set. The search can be edited afterwards. The review set does not follow it. A review set is therefore a snapshot of what a search returned at the moment it was loaded, and the query that produced it is only as reliable as whoever wrote it down.
Custodians, data sources and cases are not the same thing
In earlier versions of eDiscovery the custodian was the primary component. In the current experience Microsoft states that the case is the central organising unit. You still add people, groups and data sources to a case, but they hang off the case rather than defining it. Statistics in searches have replaced the old collections, and the background jobs that used to be called jobs are now called processes.
| Object | What it is | Standard or Premium |
|---|---|---|
| Case | The container for everything below it | Both |
| People, groups and data sources | The mailboxes, sites and accounts in scope | Both |
| Hold | Preserves content in place on the locations in the case | Both |
| Search with statistics | Finds and estimates content. Replaced collections | Both |
| Review set | A static copy of search results for review and export | Premium |
| Analytics, tagging, OCR, threading | Work on the items inside a review set | Premium |
A custodian, in plain terms, is a person whose content is in scope. A review set is where a copy of the content you found ends up. One decides what you look at. The other is where you look at it.
eDiscovery review sets need E5
Microsoft’s overview says that an Office 365 E5 or Microsoft 365 E5 subscription, or a related E5 add-on, unlocks the premium features. Review sets are on the premium list, along with advanced indexing, tagging, analytics, OCR, conversation threading, decryption and importing external data. The standard features are search, keyword queries and conditions, search statistics and samples, exporting search results, holds, case management and search and delete.
The Learn page never names E3. It defines standard by what is not marked premium. In practice that means a tenant without the E5 entitlement can find, hold and export content, but cannot load it into a review set to work on it inside Purview. Whether that gap is worth the uplift is a volume question, not a feature question, and it is the same arithmetic as the rest of Purview: the sensitivity labels you have already deployed are also why decryption sits on the premium side, because encrypted items are unreadable to a reviewer without it.
What review set analytics actually do
Analytics is run from inside a review set with Analytics, then Run document and email analytics. Progress shows in Process manager under the process type Run analytics. It does three things that matter for review effort.
- Email threading. An email marked inclusive contains all the unique content of its thread, including the previous replies. Only that most complete message needs reading, rather than every reply in the chain.
- Near duplicates. Documents are grouped around a pivot, with near duplicates and exact duplicates of it counted against that pivot.
- Themes. Groups documents by subject so a reviewer can work topic by topic.
Two built-in filters use those results. For Review, in preview, excludes items analytics judged immaterial, duplicate or non-inclusive. Potentially Immaterial Items targets compressed files such as .zip and image files smaller than 3 KB. The earlier version of this page said analytics tag and categorise data automatically. That overstated it. Analytics groups and flags. Tagging is a separate feature that reviewers apply.
The newsletter
Get the next Purview fix like this one by email
Subscribe and get the free 8-page Intune troubleshooting field guide (PDF), then new fixes about twice a month. From a Microsoft MVP.
The failure modes
A review set cannot be emptied or deleted. Microsoft states that you cannot delete items from a review set and cannot delete a review set from a case. The only way to remove one, and its data, is to delete the whole case. A trial load into a live matter is permanent for the life of that matter.
The search moved and the review set did not. Because searches stay editable, a search can be refined after loading and still carry the same name. Anyone reading the case later sees a query that does not describe the review set beside it. One search per load, named with the date it was loaded, avoids the problem entirely.
Items analytics never assessed. Microsoft notes that items with an empty MarkAsRepresentative value were not assessed by analytics and should be reviewed manually. Rely on the For Review filter alone and those items drop out of sight.
Limited-format cases behave differently. Review sets in limited-format cases use the legacy eDiscovery experience, and some features are not available in them. A case migrated from the old experience may not offer what this page describes.
Missing evidence of who did what. eDiscovery actions are audited, and a defensible process depends on that trail being complete. The ways it goes missing are covered in why Purview audit log events go missing.
What I would do differently
I have not run eDiscovery Premium on a live legal matter. My tenant is a lab, so this is judgement drawn from the documentation above.
Keep a scratch case for learning and testing loads, and never trial a query inside a real matter. The no-delete rule makes every experiment in a live case part of its record.
Freeze the search before loading it. Copy the query and the date into the review set name or the case notes at the moment you add results, because the search object itself will not hold that history for you.
Decide on Premium by how much you need to read, not by how much you need to find. Standard finds, holds and exports perfectly well. Review sets, threading and near duplicate detection earn their price when reviewer hours are the cost, and they are hard to justify for a tenant that exports a handful of mailboxes a year. The same discipline applies on the protection side, where a DLP policy that is not triggering is usually a scoping decision rather than a product fault.
Last verified: 29 October 2026 against Learn about eDiscovery (updated 29 June 2026), Manage review sets (updated 2 April 2026) and Analyse data in a review set (updated 29 June 2026).
