eDiscovery Playbook

Subject Rights Request

Streamlined playbook for fulfilling Subject Rights Requests (SRR) using Microsoft Purview eDiscovery. Covers access, export, and deletion workflows with an interactive KeyQL query builder.

KeyQL Query Builder

Fill in the data subject's details to generate the eDiscovery search query.

Generated KeyQL

Enter a name or email address above to generate the KeyQL query.

Access & Export Process

1

Create a Case

In the Microsoft Purview compliance portal go to eDiscovery → Standard (or Premium) → New case. Name it clearly — e.g., SRR-2025-JSmith.

Requires the eDiscovery Manager role. Cases isolate search scope and access permissions.

2

Create a Search & Add Data Sources

Inside the case, select New search. Give it a descriptive name, then designate your data sources — add the subject's mailbox and OneDrive as custodians, or choose a tenant-wide search for broader coverage. Tenant-wide is safer when you are unsure of every location but produces more review volume.

Custodian sources are preferred when you know exactly where the subject's data lives — they scope the search and reduce noise.

3

Add Query Conditions

In the search, open the Conditions tab and paste the KeyQL generated by the builder above into the Keywords field. Confirm the conditions match the subject's identifiers, then select Run search.

Review the statistics before moving on — check the item count and size across each workload. A large hit count is a signal to tighten the query before adding to a review set.

4

Add to Review Set

Once satisfied with the hit count and sample results, add the search to a review set. This creates a point-in-time snapshot of the content for review and export.

5

Tag & Redact

Create two tags in the review set: SRR-Export (items to include in the access/export package) and SRR-Delete (items the subject has requested be removed). Apply tags to each item, then use the annotation tool to redact third-party PII — other individuals’ data visible in the subject’s documents or email threads — before exporting.

Filter the review set by tag before acting: export only SRR-Export items; run deletion only against SRR-Delete items.

6

Export

Export from the review set with item-level reports enabled. Email exports as PST; SharePoint/OneDrive exports as ZIP; metadata exports as CSV for your audit trail.

Verify redaction settings are applied before initiating the export job.

7

Deliver & Document

Deliver the package to the requestor via a secure channel. Record the case ID, date of export, scope covered, and delivery method to satisfy audit requirements.

Deletion Operations

Deletion follows a separate path from access/export. Each workload uses a different mechanism — confirm no legal hold applies before purging.

Exchange Email

Locate items by internetMessageId in eDiscovery, then use the Microsoft Graph API purge endpoint. Set PurgeArea = mailboxes and PurgeType = permanentlyDelete.

KeyQL to locate items:

internetMessageId:"<message-id>"

Teams Messages

Same Graph API purge flow as Exchange. Use Teams-specific KeyQL to identify messages, then set PurgeArea = teamsMessage in the purge request.

KeyQL to locate items:

kind:microsoftteams

SharePoint / OneDrive

Export files from the review set, extract the metadata CSV from the reports package to identify item paths, then run the Microsoft-provided deletion script per its ReadMe.

Tips & Gotchas

  • •Always review statistics before adding to a review set — a broad query on a large tenant can return millions of items.
  • •Add known aliases and previous email addresses to the Aliases field. Former employees often have mail routed to their old address.
  • •Retention policies and legal holds block permanent deletion. Confirm holds are released before running any purge.
  • •The eDiscovery Manager role must be assigned explicitly in the compliance portal — Global Admin does not inherit it.
  • •If you need to recover a query from the Priva portal: open DevTools → Network, find the privacy cases API response, and extract the filterQuery field. Remove escape characters before pasting into eDiscovery.
  • •Export filenames map to workloads: PSTs for email, ZIPs for files. Organize by workload in your delivery package.