As we explored in Part 1 of our series on hyperlinked files, managing and exporting hyperlinked content is a constantly shifting challenge. Not only is preserving and exporting this type of content inherently difficult, but collaboration app providers like Microsoft are continually enhancing their capabilities and data storage environments, introducing more complex features centered around shareable, linked content. Simultaneously, the compliance application teams at these providers are struggling to keep up with developing the necessary governance tools and workflows to help corporations adequately preserve and manage hyperlinked files.    

A prime example: on May 26, Microsoft quietly retired one of its two existing Purview eDiscovery workflow modules, eDiscovery Standard. Along with eDiscovery Premium, eDiscovery Standard provided compliance administrators and outside service providers with the ability to identify, preserve, search, and export user content from Microsoft 365 data sources. eDiscovery Standard was designed to support basic “hold, search, and export” eDiscovery workflows for clients with an E3 license level user base.

While Standard did have some capability to export bulk hyperlinked data from targeted cloud storage locations, its support for defining any relationship linking between cloud attachments and parent emails/Teams chats was non-existent. Purview previously offered this feature exclusively through its eDiscovery Premium module. Microsoft plans to retire that module in early August of this year.

What is replacing these two critical eDiscovery workflow modules in Purview? and how is Microsoft responding to demands for a more robust eDiscovery workflow? The answer is a “unified” workflow called Cases, which Microsoft has assured will make the process of managing compliance preservation, search, filter, and export a much simpler and more cohesive experience. Is it working? So far, yes and no.  

CDS’ Digital Forensics and Advisory teams have been working extensively in the new unified workflow for several months. Our user experiences have been mixed, with improvements and new challenges. Provided here is a short summary of our experience with managing eDiscovery response workflows in Purview, with added emphasis on the management of hyperlinked files.

Summary of eDiscovery Response Workflows in Purview

• Cases is designed to allow for a single workflow experience in Purview eDiscovery, attempting to simplify the search, filter, and export of multiple data sources for a single custodian, or groups of custodians, regardless of M365 license level. 

• Advanced features like enhanced indexing, OCR, the Review workflow, and cloud attachment export are available, but still depend on user license level, with some “premium” features unavailable in Cases when targeting data sources from E3 or lower licensed custodians.   

• For custodians with the required licensing level, specific hyperlinked file support has been provided for the export of cloud attachments, with advanced features designed to target and export the latest document version, or a specified quantity of versions, or all versions. Exports also include detailed metadata, with fields designed to provide attachment linking references. 

• Content Search, a legacy investigative tool, is still available and designed primarily for one-off search and export needs that do not require the case management workflows available in Cases.   

• Microsoft retired the legacy PowerShell features within Purview, removing several manual tools that compliance admins had relied on in Purview and its predecessor, the Security and Compliance Center.

The Good

• Overall, having a single eDiscovery experience is beneficial, as the separated Standard and Premium workflows led to confusion for compliance teams on when and how to use which solution, on what types of cases, and for what types of custodians. From the user side, streamlining eDiscovery into a consolidated workflow is a good thing. 

•  When using key terms to try and isolate data, Microsoft has improved search term hit reporting, which was previously a significant drawback in legacy and recent iterations of both eDiscovery Standard and Premium. Any improvement here is a good thing, though caution should still be taken when considering deploying search criteria in Purview. Many of the same concerns around file type support, full indexing and support for advanced search term functionality still exist in the new unified workflow. 

• Export reporting has also improved, particularly when compared to eDiscovery Standard, with more robust summary and detailed reporting now available for exported data sets. Detailed reports include more available metadata field delivery as well. 

The Bad

• General Performance and Export performance: along with retiring PowerShell capabilities, on May 26, 2025, Microsoft fully retired its embedded “eDiscovery Export Tool”, a plug in application which managed and streamlined the transfer download of exports from M365 to local storage. Microsoft cited “privacy and security concerns” as a factor in retiring this tool. Since then, however, the speed and efficiency of downloading data exports has dramatically decreased. Many have reported this issue beyond our own experience at CDS, but Microsoft has not formally acknowledged it. 

• Hyperlinked files summary reporting: when searching or filtering content for export, statistics reporting does not include the volume and proportional impact of selecting cloud attachments for export. There is no way to determine in advance what adding cloud attachments will do to the GB size or file count of an export. This would be extremely helpful to compliance administrators and services providers. 

Direct Effect on Hyperlinked Files Management

• Cloud attachment handling has improved. The interface provides more explicit and streamlined cloud attachment handling details in the unified workflow experience, with the promise of better management in identifying and exporting hyperlinked content. 

• To be clear, while hyperlinked file management is improving, exported cloud attachments still don’t just show up ready for review as intact families. If your eDiscovery workflow includes exporting custodian data from M365 for processing and hosting in Relativity or another eDiscovery platform, there is still plenty of work to be done after you export from Purview. For example, making sure your eDiscovery provider can use Purview’s associated export files during ESI processing to “re-link” those cloud attachments back to their email or chat parent messages.    

• There is still general frustration from the M365 user population surrounding how hyperlinked content is identified and managed. One area of improvement would be to include some form of pre-export reporting: a feature that would help compliance admins identify and report on the scope and breadth of cloud attachment populations, prior to just waiting for those results to appear after running a custodian export. In other words, initial reporting that answers “if I choose to include cloud attachments and versions, what proportional impact will that have on my total volume of exported data?” 

Alternatives and Third-Party Solutions

• There are various third-party forensic application providers, information governance application developers, and other compliance app providers that are investing heavily in developing and promoting toolkits specific to the defensible collection of M365 data. 

• Vendors design many of these solutions for enterprise information governance. While deploying them requires significant implementation costs and cloud infrastructure, they can also deliver more efficient, streamlined management of M365 data sources, including hyperlinked data.

• Organizations evaluating a third-party solution—whether for temporary use or long-term management—must carefully consider M365 data security. They need to understand how the tool accesses and reads data within their M365 tenant. Most outside solutions developed to manage M365 data sources require at least some back-end access to an organization’s tenant, likely delivered by adding application access permissions to the tenant in Azure e.g. Microsoft Graph API, a web API solution designed to allow gateway access to M365 data sources. This can be a significant information security consideration for any organization. 

Where We Land with Hyperlinked Data in M365

The full retirement of Microsoft Purview eDiscovery Standard and Premium will mark the end of a short era for diversified eDiscovery management in Microsoft 365. While we are optimistic about utilizing a simpler, more consolidated experience with unified case management, Microsoft has some ground to cover before Purview can fulfill that promise, particularly with respect to overall performance and hyperlinked file compliance management.        

Corporates, law firms, and service providers should closely monitor how these application changes impact their eDiscovery processes and proactively adjust tools and workflows to manage the growing pains that come with new technologies. Key Executive, IT, InfoSec, and Legal stakeholders must also thoroughly assess any third-party enterprise governance solutions they consider as alternatives.

For more information on how best to handle hyperlinked files in Microsoft 365, contact CDS Advisory Services and CDS Digital Forensics at .