By Chas Meier
Last week, John Patzakis explained why Microsoft Purview eDiscovery is getting worse and why the reasons are structural: a multi-tenant architecture that must throttle heavy workloads, a 2 GB per hour indexing ceiling that has not moved since 2024, no service level commitment for search times, and a finite pool of compute that Microsoft has told investors it allocates to its highest-value opportunities, with Copilot first in line.
That post was about the cause. This one is about the consequence, and it is a consequence that reaches well beyond legal operations. When the tool at the front of your eDiscovery workflow cannot filter reliably, the organization’s answer is almost always the same: collect everything and sort it out later. Every gigabyte that leaves your environment that way is a gigabyte you pay to process, host and review, and a gigabyte that now sits somewhere you do not control, at exactly the moment attackers are becoming faster and better equipped than they have ever been.
The argument below is simple. Purview’s limits drive over-collection. Over-collection drives cost. Cost and copies drive risk. And the risk curve is about to steepen.
When Filtering Fails, Over-Collection Becomes the Default
In principle, Purview lets you search before you collect. In practice, the service providers and enterprise teams we speak with tell us that targeted collection in Purview has become something they plan around rather than rely on.
- Searches stall or time out.
- Indexing runs at 2 GB per hour, so a 500 GB custodian set takes more than ten days to index before a search can be trusted.
- Partially indexed items that exceed parsing limits quietly fall outside keyword results.
- Exports are capped at 2 GB per hour per mailbox with daily tenant-level limits, and anything still running after seven days is cancelled.
Faced with a deadline and a toolset that cannot be trusted to narrow the data defensibly, legal teams do the rational thing: they widen the net. Rather than risk a motion over an under-inclusive search, they pull entire mailboxes, entire OneDrive accounts, entire Teams channels, and push the filtering downstream to a processing platform or a service provider where the tools actually work. One provider described it to us as “collect the custodian, not the matter.”
This is not a failure of judgment by the legal team. It is the predictable response to a collection tool that cannot do its job at enterprise scale. But it means that the single most effective cost and risk control in eDiscovery, culling data before it ever leaves the enterprise, is being abandoned at the very step where it matters most.
Not a Purview User? You Probably Are One Anyway
Many organizations read our Purview posts and conclude they do not apply because the legal team never logs into the Purview portal. They use a service provider, or a collection toolkit from their review platform vendor, or a connector that “just pulls from Microsoft 365.” That conclusion is usually wrong.
Look under the hood of most Microsoft 365 collection workflows and you find Purview. Many third-party connectors and service provider toolkits are built on Microsoft’s eDiscovery search and export APIs, which means they inherit the same index, the same 2 GB per hour ceilings, the same tenant-level export caps and the same throttling. Some tools run a Purview search and export in the background and present the result in their own interface. Others collect whole mailboxes through Graph or EWS precisely because the Purview search path is too slow and unreliable to filter with, which is over-collection by design. Either way, Purview’s limitations are shaping what gets collected from your tenant, even if nobody on your team has ever opened it.
If you are not sure which category your workflow falls into, that is worth finding out. Ask your provider or your platform vendor two questions:
- Does your Microsoft 365 collection depend on Purview’s index or Microsoft’s eDiscovery APIs?
- What percentage of the data you collect from our tenant is ultimately produced?
If the first answer is yes and the second answer is in the low single digits, you are an indirect Purview user, and you are paying for it.
The Volume Does Not Disappear. It Moves Downstream.
Data that is not filtered at collection does not go away; it flows into the next stage of the workflow. Whole-custodian collections land on a service provider’s processing infrastructure or in a hosted review platform, where the filtering that should have happened inside the enterprise is finally performed, at a per-gigabyte price. The industry has become very good at absorbing that volume, which is part of why the problem is so easy to ignore. Processing gets faster, hosting gets cheaper per unit, and analytics get better at culling. But none of that changes the fact that the data has already left.
The numbers compound quickly:
• A matter with 20 custodians and an average of 30 GB per custodian across email, OneDrive and Teams produces 600 GB of exfiltrated data before a single document has been reviewed.
• A targeted in-place search would have narrowed that to 5%; the other 570 GB is pure overhead: ingested, processed, deduplicated, and hosted for the life of the matter, and then for years afterward.
• Multiply that across every matter, investigation and regulatory request in a year and the over-collection tax on a mid-size enterprise runs into the hundreds of thousands of dollars, and for a large one, well into the millions.
Service providers see the other side of this. Their platforms are filling with data that nobody needed, and their clients are increasingly asking why the processing and hosting line items keep growing when case counts are flat. The honest answer: the collection tool upstream stopped doing its job.
Every Exfiltrated Gigabyte Is Both a Cost and a Risk
The cost side is visible on the invoice. Processing, hosting, review, productions and long-tail storage all scale with volume, and over-collection inflates every one of them. What is harder to see is that the same volume is also the organization’s single largest self-inflicted security exposure.
Consider what an eDiscovery collection actually is: a curated copy of your most sensitive communications, deliberately assembled, stripped of the access controls that protected it in the source system, and shipped to a third party. Executive email. Board materials. Privileged legal advice. Customer data, employee data, trade secrets, M&A deliberations. A whole-custodian collection does not just include the documents relevant to the matter; it includes everything that custodian ever touched. And it is now sitting on a service provider’s processing server, in a hosted review platform, in a law firm’s document management system, on an export drive, and in whatever backups each of those parties keeps.
Each copy is a new attack surface governed by someone else’s security program, someone else’s patch cycle and someone else’s employees. Law firms and eDiscovery vendors are high-value targets precisely because they aggregate the crown jewels of many clients in one place, and the breach record of the last several years bears that out. When one of those copies is compromised, the breach notification obligations, regulatory exposure and reputational damage belong to you, not to the vendor, and they attach to all of the data that was collected, not just the small fraction that was ever relevant.
Over-collection, in other words, turns a legal cost problem into an enterprise security problem. The 95% of the collection that was never responsive was never worth that risk.
The Next 12 to 24 Months: AI on the Other Side of the Wall
If the risk calculus above were static, over-collection might be a tolerable inefficiency. It is not static. The same generative AI wave that is consuming Microsoft’s compute capacity is also arming the people who want your data.
AI has collapsed the cost and skill required to run a sophisticated attack. Phishing campaigns are now fluent, personalized and generated at scale. Vulnerability discovery and exploit development that once took skilled teams weeks can be accelerated by models that reason over code. Reconnaissance against a target’s vendors, employees and infrastructure is automated. Agentic tooling allows a single operator to run many intrusion attempts in parallel and adapt to defenses in real time. Security researchers and government agencies have been warning for the past year that AI-enabled intrusion is moving from proof of concept to routine practice, and the trend lines for breach frequency, ransomware payouts and time-to-exploit all point the same way.
Over the next 12 to 24 months, we expect frequent, aggressive and automated attacks to become the baseline rather than the exception, and we expect the organizations that aggregate other companies’ sensitive data, including eDiscovery service providers, review platforms and law firms, to remain among the most attractive targets. Vendors will keep investing in defenses. But a defender has to be right every time, and AI has made the attacker’s job dramatically cheaper.
The only exposure you fully control is the amount of data you send out in the first place. Every copy you do not create is a copy that cannot be breached.
Now Is the Time to Be Proactive
The organizations that will be in the strongest position two years from now are the ones that treat eDiscovery collection as a data governance and security decision, not just a legal workflow step. That means three things.
- Limit exfiltration. Search, cull and validate inside your own environment, and collect only what is potentially responsive. The goal is to move the filtering step back to where it belongs, before the data leaves, so that what reaches a provider or a review platform is the matter, not the custodian.
- Limit unnecessary cost. Every gigabyte you keep inside the enterprise is a gigabyte you do not pay to process, host, review and store. Targeted in-place collection is the single largest lever available to reduce eDiscovery spend, and it is a lever that most Microsoft 365 organizations are not currently pulling because their tooling does not let them.
- Remain in control of your data. Run eDiscovery and governance on infrastructure you control, with search methodology you can test and document, indexes you own, and no dependence on a shared tenant’s throttling policies or a cloud provider’s capacity priorities. Control means being able to answer a court, a regulator or a board with confidence about what you searched, what you collected and where it went.
Waiting for Purview to improve is not a strategy. Last week’s post explained why its limitations are architectural and why Microsoft’s own capacity constraints make relief unlikely. Meanwhile the cost of over-collection accrues on every matter, and the risk of each unnecessary copy grows with every advance in offensive AI. The time to change the workflow is before the next large matter, not after the next breach.
How X1 Enterprise Is Different
X1 Enterprise was built for exactly this problem: search and collect in place, so that only what matters ever leaves. The differences from a Purview-dependent workflow are architectural, not cosmetic.
In-place indexing you own. X1’s patented distributed micro-indexing technology indexes Microsoft 365 data where it lives, across Exchange, OneDrive, SharePoint and Teams, alongside endpoints, file shares and other cloud sources. X1 does not use Purview’s index or Microsoft’s eDiscovery search APIs, so there is no 2 GB per hour ceiling, no tenant-level export cap, no seven-day cancellation and no throttling inherited from every other tenant on the platform.
Compute you control. X1 runs on infrastructure the customer controls, on premises or in the customer’s own cloud. Your eDiscovery and governance jobs are never queued behind Copilot or anyone else’s workload, and performance is predictable because it is yours.
Search that meets the courts’ standard. Full Boolean, proximity, wildcard and stemming queries execute consistently across email, files and Teams chat, with the ability to iteratively test, refine, validate and document search methodology before anything is collected. That is the “advanced and thoughtful” search the Kim v. Cushman & Wakefield court said Teams data requires, and the validation Special Master Favro found missing in native Microsoft 365 tools.
Targeted collection, not whole-custodian export. Because the search runs in place and can be trusted, only potentially responsive data is collected. Filtering moves back to the front of the workflow, where it cuts downstream volume, cost and exposure at the source. Collected data can be uploaded directly into Relativity for review.
Defensibility by design. Preservation, search and collection are logged and reportable, so you can show a court or a regulator exactly what was searched, when, with what criteria, and what was collected.
AI where the data lives. The same in-place architecture powers X1 AI In-Place, allowing organizations to apply AI classification directly to data in its source location for early case assessment, privilege and sensitivity identification, and information governance, again without exporting the data to do it.
Talk With X1
If your Microsoft 365 collections are coming back as whole custodians, if your processing and hosting invoices keep growing while your case count does not, or if you have never asked how much of the data you send out is actually responsive, we would like to talk.
Contact X1 to schedule a live demonstration of X1 Enterprise against a Microsoft 365 environment. Better still, bring us a recent matter. We will run a targeted in-place search on your own data and show you how much volume, cost and risk you could have kept inside the enterprise.
The next large matter is coming, and so is the next wave of attacks. Collect less, spend less and keep control of your data.
