By John Patzakis
For organizations that rely on Microsoft Purview for eDiscovery, compliance and investigations, the gap between what the tool delivers and what the job demands is widening. Stalled searches, timed-out exports and a 2 GB per hour indexing cap slow investigations, drive up costs and leave legal teams with results they can’t fully defend.
Over the past several months, we have been speaking with a number of eDiscovery service providers, channel partners, and enterprise customers about their experiences with Microsoft Purview eDiscovery. The feedback has been remarkably consistent. The same challenges we began writing about several years ago are still there, and by most accounts they have gotten worse. One service provider that handles a high volume of Microsoft 365 matters told us that Purview performance has deteriorated noticeably in recent months, describing searches and exports that stall or time out and processing delays that have put counsel in a difficult position with opposing parties and the court.
When X1 first raised these issues, the common reaction in the market was that Purview was a maturing product that Microsoft would eventually fix. With Microsoft’s engineering resources, many assumed that eDiscovery inside Microsoft 365 would steadily improve. That was a reasonable expectation at the time. It has not happened. In our view, the reason is that Purview’s limitations stem from the architecture of Microsoft 365 itself, which makes it very difficult to engineer away. And there is now an additional factor worth considering: the intense competition for computing resources driven by Microsoft’s AI strategy.
The Architecture Has Not Changed
As we explained in our post on Microsoft 365 eDiscovery throttling, Microsoft 365 is a massive multi-tenant SaaS environment. Every customer shares pooled infrastructure, and eDiscovery is exactly the kind of heavy, bursty workload that a multi-tenant system must restrain to protect everyone else on the platform. Throttling, timeouts, and hard caps are how Microsoft manages that “noisy neighbor” problem, and they are built into the design of the system. We made the same point more broadly last December in our analysis of why most SaaS architectures fall short for enterprise-grade AI: shared capacity introduces contention and performance variability that no configuration setting can resolve.
Microsoft’s own documentation bears this out. The current Microsoft Learn page on eDiscovery limits, last updated in June 2026, shows:
- 2 GB per hour for advanced indexing in Purview eDiscovery Premium. That is the same cap we cited in 2024. At that rate, indexing a single terabyte requires roughly three weeks of continuous processing.
- 2 GB per hour per mailbox limit for exports, with daily exports capped at the tenant level.
- Automatic cancellation of any process or export still running after seven days.
- No service level agreement for search terms. Microsoft also states plainly that it “doesn’t provide a service level agreement for search times.”
Microsoft even maintains a service advisory to notify administrators when their tenant has been “throttled due to number of Search and Export jobs exceeding the limit set by Microsoft.”
For organizations with significant information governance requirements, these constraints are even more limiting. As we discussed in our post on information governance challenges in Microsoft 365, a defensible governance program depends on automated enforcement across the full data estate, and a 2 GB per hour ceiling makes that impractical at enterprise scale.
Special Master Favro’s Findings Still Hold
In July 2023, Special Master Philip Favro issued a report in Deal Genius, LLC v. O2COOL, LLC, No. 21 C 2046 (N.D. Ill.), raising serious concerns about whether reliance on Microsoft 365’s native search tools satisfies the reasonable inquiry requirement of Federal Rule of Civil Procedure 26(g). As we reported at the time, the Special Master found that M365 has “technological limitations that may not allow a responding party to generate reliable search results,” that it “generally does not fully index the data” in an organization’s environment, and that it does not allow users to validate their search and production results.
More than three years later, nothing in Microsoft’s documentation indicates those problems have been resolved. The indexing ceiling is unchanged, items that exceed parsing limits are still marked as partially indexed, and there is still no service level commitment. Meanwhile, the courts have raised the bar. In Kim v. Cushman & Wakefield U.S., Inc., 2026 WL 1353455 (C.D. Cal. Apr. 24, 2026), the court held that “[k]eyword searches alone, without more advanced and thoughtful search techniques, will be inadequate for Teams data.” That is a difficult standard to meet with a native toolset built around basic keyword and condition searching.
Recent Developments Reinforce the Concerns
Several developments over the past year add to the picture.
A systemic Purview hold failure. In Oakley v. MSG Networks, Inc., 792 F. Supp. 3d 394 (S.D.N.Y. 2025), Madison Square Garden placed a legal hold through Purview that was intended to ensure emails were “retained no matter what the user does.” Emails from eleven custodians were lost anyway. MSG’s forensic expert concluded that a technical glitch in its Microsoft environment had occurred “beyond a shadow of a doubt,” and the court noted that “the software malfunction affected seventy-nine matters other than the Oakley case.” MSG avoided sanctions because the court found its use of Purview to be a reasonable preservation step. But the emails were gone, and MSG had to fund a forensic investigation and litigate the issue to establish it was not at fault. Reasonableness under Rule 37(e) turns on what a party knew or should have known, and as the record of Purview failures grows, I would not count on that defense being available indefinitely.
Sanctions for delay even when reliance was reasonable. In FTC v. Match Group, Inc., 2025 WL 46024 (N.D. Tex. Jan. 7, 2025), an archiving system used with Office 365 failed to capture certain custodians and time periods. Match produced nearly 500 additional documents after the discovery deadline, most of them after the FTC had moved for summary judgment. The court found Match’s reliance on the archive reasonable, yet still imposed sanctions under Rule 16(f) for the late production, allowing the FTC additional depositions at Match’s expense. The lesson for Purview users is clear: courts can and will sanction delays caused by collection tools, regardless of how reasonable the choice of tool may have been.
Reduced functionality. In 2025 Microsoft moved all customers to its new Purview eDiscovery experience, retiring classic Content Search and eDiscovery (Standard) in May and classic eDiscovery (Premium) in August. In the process, Microsoft retired its legacy legal hold communications tools for custodian notices and acknowledgments. And as Casepoint has noted, the new interface no longer shows that a custodian was ever on hold once that custodian is released, making it harder to document a preservation timeline. The visibility problem is significant enough that a new third-party reporting product launched this spring because, as LawNext reported, legal teams have “no direct visibility into what is happening inside Microsoft Purview eDiscovery.”
More data, more complexity, new fees. Copilot is generating entirely new categories of data that Purview must preserve, search, and produce. Microsoft recently had to add an option to convert Loop and Copilot Pages files to HTML because those formats cannot be opened by standard review tools. Microsoft now also bills pay-as-you-go storage for certain AI interaction data in eDiscovery cases and requires E3 customers to activate pay-as-you-go billing to use its eDiscovery export APIs.
Service disruptions. On January 22, 2026, an infrastructure failure in North America blocked administrator access to the Purview portal, along with Exchange, Teams, and SharePoint search, for several hours.
The AI Factor
This brings us to a question several of our partners have raised with us. Microsoft has been unusually candid with investors that it does not have enough computing capacity to meet demand, and that it is making deliberate choices about where that capacity goes.
On Microsoft’s January 28, 2026 earnings call, CFO Amy Hood described the order of priority directly: “the first thing we’re doing is solving for the increased usage in sales and the accelerating pace of M365 Copilot. Then we make sure we’re investing in the long-term nature of R&D and product innovation,” with “the remainder going towards serving the Azure capacity that continues to grow in terms of demand.” She added that if the GPUs that came online in the prior two quarters had been allocated entirely to Azure, Azure’s growth metric “would have been over 40” percent.
On the October 28, 2026 call, Ms. Hood reported that “[c]ustomer demand continues to exceed available supply.” CEO Satya Nadella said Microsoft will “dynamically allocate capacity to the highest-value opportunities across compute, data, Foundry, and Copilot,” explaining that “we have one pool, and we want to get the pool to be as efficient and fungible” as possible. Microsoft is now projecting capital spending on the order of $170 billion to try to catch up.
Microsoft has not said where Purview eDiscovery falls in that order of priority, and we have no inside view into how Microsoft allocates resources within its data centers. But consider what Microsoft has told us. It operates “one pool” of capacity. That pool is constrained. Capacity is allocated to the “highest-value opportunities,” and Copilot is first in line. eDiscovery is a compliance function that generates little incremental revenue, carries no service level commitment for search times, and has seen its documented throughput limits stay frozen while its feature set has been trimmed. At the same time, Copilot is adding new volumes and types of data that Purview is expected to handle.
When capacity is scarce and allocated by value, it is fair to ask how high a priority eDiscovery search and export jobs receive. The service providers and customers telling us that Purview has gotten worse may be seeing the practical result of that ordering. Organizations planning their discovery and governance obligations around Purview should at least account for that possibility.
A Different Architecture
X1 takes a fundamentally different approach. The X1 Enterprise Platform uses our patented distributed micro-indexing technology to index Microsoft 365 data in place, across Exchange, OneDrive, SharePoint, and Teams, along with endpoints, file shares, and other cloud sources.
For legal and compliance teams, that means:
- Predictable timelines. X1 does not depend on Purview’s search index or Microsoft’s eDiscovery search APIs, so it is not subject to Purview’s indexing ceiling, export caps or the throttling that comes with sharing those resources with every other Microsoft tenant.
- No competing with Copilot for capacity. The compute runs on infrastructure our customers control, which means eDiscovery and governance jobs are not competing with Copilot for priority.
- The search methodology courts now expect. Full Boolean, proximity, wildcard, and stemming queries that execute consistently across email and Teams chat, with the ability to iteratively test, validate and document search methodology before anything is collected.
- Lower cost and less risk. Only potentially responsive data is collected, and it can be uploaded directly into Relativity for review.
- AI where your data lives. The same in-place architecture powers X1 AI In-Place, allowing organizations to apply AI classification directly where their data lives without the cost, delay, and exposure of moving it.
X1 works alongside your Microsoft 365 investment. Your data stays in M365, and X1 gives you the defensible, scalable discovery layer Purview wasn’t built to provide.
If your organization or your clients are running into these issues with Purview, we would like to hear from you. Contact X1 to schedule a live demonstration of X1 Enterprise in a Microsoft 365 environment, or to discuss a proof of concept on your own data.
