Microsoft is Retiring Search-Mailbox Cmdlet and Legacy eDiscovery Tools

Microsoft is planning to deprecate *-MailboxSearch cmdlets and two legacy eDiscovery tools in the first half of 2020. After that, you can’t create new eDiscovery searches from the Exchange Admin Center (EAC) or by using the New-MailboxSearch cmdlet.

From Apr 1, 2020, you can’t use New-MailboxSearch cmdlet to create In-Place eDiscovery searches and In-Place Holds. Still, you can use *-MailboxSearch cmdlets (like Search-Mailbox, Start-MailboxSearch, Stop-MailboxSearch, Set-MailboxSearch) to run, edit and delete existing searching and holds at your own risk.

From July 1. 2020, you can’t use the Start-MailboxSearch,Stop–MailboxSearch,Set-MailboxSearch cmdlets. You will be able to use only Get-MailboxSearch and Remove-MailboxSearch cmdlets to list and remove existing mailbox searches and holds.

Alternative cmdlets for Search-Mailbox:

• • To create eDiscovery searches and eDiscovery case holds, you can use New-ComplianceSearch and New-CaseHoldPolicy.
  • You can use *-ComplianceSearch cmdlets to search the email messages.
    
    • *-ComplianceSearch cmdlets: New-ComplianceSearch, Get-ComplianceSearch, Start-ComplianceSearch
  • Once the search is complete, use *-ComplianceSearchAction cmdlets to preview, export, and delete the items found by the search.
    • *-ComplianceSearchAction cmdlets: New-ComplianceSearchAction, Get-ComplianceSearchAction, Search-ComplianceSearchAction, Remove-ComplianceSearchAction
  • You can export search results, using below cmdlet
    New-ComplianceSearchAction –Export
    However, you need to use the Core eDiscovery tool available in Microsoft 365 Compliance Center to download the search result.
  • After creating and searching, you can purge messages by executing following cmdlet.
    New-ComplianceSearchAction -Purge

Tips: Microsoft keeps updating its features and bidding farewell to existing ones. Stay informed on the Microsoft 365 features deprecation list to enhance the security of your organization.

The eDiscovery tools used to search, preview, and export email content from Exchange Online. However, legacy eDiscovery tools don’t work with non-Exchange Office 365 services like SharePoint Online and Office 365 Groups.

So, Microsoft is planning to retire following two eDiscovery tools in mid of 2020.

1. Advanced eDiscovery v1.0
2. In-Place eDiscovery and Hold

Office 365 Advanced eDiscovery V1 is the first version of Advanced eDiscovery. It can be accessed from Security & Compliance Center –> eDiscovery –>Advanced eDiscovery

Note: Microsoft retiring eDiscovery functionality only in cloud-based services such as Microsoft 365 and Office 365. This functionality will be supported in on-premises until further notice.

Alternative tool:

Since Microsoft retiring Version 1 of Advanced eDiscovery, you can use Advanced eDiscovery v2 (also called as Advanced eDiscovery solution in Microsoft 365). It can be accessed Microsoft 365 Compliance Center.

In-Place eDiscovery and Hold tool used for searching, holding, exporting mailbox content in Exchange Online and copying email search result to discovery mailbox for review.

Alternative tools:

You can use tools available in the Microsoft 365 Compliance Center for In-Place eDiscovery and holds.

• To search, export, and hold data for legal purposes, you can use Core eDiscovery cases. It will search content in Exchange Online, SharePoint Online, OneDrive for Business, Skype for Business, Microsoft Teams, Yammer groups, Office 365 Groups, and other Office 365 applications.
• To hold data for retention purposes, you can use Retention Policies in Microsoft 365 Compliance Center.
• You can use Review sets in Advanced eDiscovery v2.0 for copying email search results (for review) to a discovery mailbox.

Note: Advanced eDiscovery V2 requires Office 365 E5 licenses.

I hope this blog is useful to switch from legacy eDiscovery tools. If there is still something unclear to you, please leave a comment, and we will address your questions.