New eDiscovery UI - Building a Query

Most things are there, if you click in the right place

Photo by Markus Winkler on Unsplash

This week, I am continuing my deep dive into the new M365 Purview discovery user interface by building a query. The process may seem familiar if you’re familiar with starting a new collection in Purview eDiscovery Premium. The goal, after all, is to identify the locations to run the query against and build a query that locates relevant information.

Everything else, however, is different.

I’m going to walk you through this step by step. First, I'll explain how it’s done in eDiscovery Premium, and then I'll explain how you would accomplish the same thing in the new eDiscovery.

Hang on. Things might get bumpy.

Before we get into it, though, a caveat. Everything I’m about to show you is what I see in a Dev tenant as of March 31, 2025. Some of what you will see might be a bug that will be fixed when you read this and look for it yourself. All of it is subject to change. It is also possible that I’m missing something. (My inability to delete a query, for example, might result from not finding the proper sub-menu. I’m not perfect.)

Overall, the interface is cleaner, but I’m afraid the cleaner interface was a result of hiding things in various menus and making it a little trickier to work with. I got used to it once I could locate what I wanted.

As I always tell people working in OneDrive and SharePoint, click the three dots and see the options listed. That’s usually where the good stuff lives. The same is true in the query builder; click the extra buttons, and the good stuff lives there.