Said It Here

What Microsoft Purview licenses do I need for eDiscovery searches?

Advanced eDiscovery features like message ID searches in Microsoft Purview are locked behind premium subscriptions, leaving administrators guessing whether they need separate licenses for investigators and victim mailboxes. This ambiguity makes it difficult to purchase the right software without running afoul of complex rules, especially when managing a mix of nonprofit grant seats and commercial licenses.

What people tried

Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.

  1. 1
    Constructing custom PowerShell scripts for running forensics on compromised accounts
  2. 2
    Looking for other ways to locate the emails manually
  3. 3
    Comparing pricing across multiple CSPs and current resellers
  4. 4
    Consulting board members about tech stack vendors

In their words

Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.

r/nonprofit1 person · September 2026

“Our nonprofit gets discounted M365 grant seats for most of the org but our fundraising team sits outside that program and pays full commercial rate every year.”source ↗

“Our finance committee meets in three weeks and wants real numbers. Has any other nonprofit split grant and commercial licensing across two vendors and kept it simple?”source ↗

Jealous_Theme929 · r/nonprofit · 2 upvotes
r/sysadmin1 person · September 2026

“Any attempts to use Microsoft Purview and eDiscovery to search for the e-mails when using the message ID's is not allowed as its locked behind a premium feature subscription.”source ↗

“I don't want to run afoul of licensing and want to ensure i purchase the appropriate licenses to make this easier”source ↗

“I'm looking at purchasing the Purview Suite for Microsoft Business Premium License (Most of our Licenses are Business Premium or Business Standard) and its my assumption that I will need 2 licenses (1 for the investigator and 1 for the victim mailbox) can anyone verify this?”source ↗

Krazie8s · r/sysadmin · 1 upvotes

Where this came up

People with this problem also raised