eDiscovery Search Misses SharePoint Files: User-Safe Fix
🔍 WiseChecker

eDiscovery Search Misses SharePoint Files: User-Safe Fix

When you run an eDiscovery search in the Microsoft Purview compliance portal, SharePoint files that should appear in the results are missing. This problem usually happens because the content search query does not include all site locations or because the files are stored in a location that eDiscovery cannot index by default, such as a library with special permissions or a site that is not fully crawled. This article explains why eDiscovery misses SharePoint files and provides a step-by-step fix that a compliance administrator can apply without affecting end users.

Key Takeaways: Fixing Missing SharePoint Files in eDiscovery

  • eDiscovery search query syntax: Adding the site path with the correct syntax ensures all SharePoint libraries are searched.
  • Content search location selection: Selecting “All sites” instead of individual URLs prevents missing newly created sites.
  • Permissions and indexing: Files in libraries with unique permissions or excluded from search indexing are not returned in results.

ADVERTISEMENT

Why eDiscovery Search Misses SharePoint Files

Microsoft Purview eDiscovery searches rely on the SharePoint search index. When a file is not indexed, eDiscovery cannot find it. Several conditions cause indexing failures or incomplete search results.

Incomplete Content Search Location Selection

When creating a content search, you must specify which SharePoint sites to search. If you select individual site URLs and leave out a site that contains relevant files, those files will not appear in the results. This is the most common cause of missing files.

Files in Libraries with Unique Permissions

SharePoint libraries that use unique permissions (permissions that break inheritance from the parent site) are not automatically crawled by the SharePoint search index. eDiscovery cannot search unindexed content. You must explicitly include these libraries in the search query.

Unindexed File Types

SharePoint search indexes common file types like .docx, .pdf, and .xlsx. Some file types are not indexed by default, including .zip, .exe, and certain image formats. eDiscovery only searches indexed content, so files with unindexed extensions are missed.

Retention Policy Conflicts

A retention policy applied to a SharePoint site can prevent eDiscovery from accessing files that are under legal hold or retention. If a file is marked as a record or is in a preservation hold library, eDiscovery might not return it in search results unless the search is configured to include preserved locations.

Steps to Fix eDiscovery Search Missing SharePoint Files

Apply these fixes in the Microsoft Purview compliance portal. Each fix is safe for end users and does not change site permissions or file access.

  1. Open the Content Search and Verify Location Selection
    Go to Microsoft Purview compliance portal > eDiscovery > Content search. Select the search that is missing files. Click “Locations” and check the SharePoint sites section. If you selected individual site URLs, click “Choose sites” and verify every site that should be searched is listed. To include all SharePoint sites, select “All sites” instead. This prevents missing files from newly created sites.
  2. Add the Site Path to the Search Query
    If the file is in a specific library or folder, add the site path to the search query. Use the syntax: path:"https://yourtenant.sharepoint.com/sites/sitename/libraryname". This forces the search to include that exact location. For example, to search the “Documents” library on the “Sales” site, use path:"https://contoso.sharepoint.com/sites/Sales/Documents". Combine this with keywords using AND or OR operators.
  3. Include Libraries with Unique Permissions
    Identify libraries that have unique permissions. Open the SharePoint site, go to Site contents, select the library, click the gear icon, then Library settings > Permissions for this document library. If the ribbon shows “Manage Permissions” instead of “Inherited”, the library uses unique permissions. For each such library, add its path to the eDiscovery query as described in step 2. Without the explicit path, eDiscovery will not search that library.
  4. Check File Type Indexing Status
    Determine if the missing file has an unindexed extension. In the SharePoint admin center, go to Search > Manage Search Schema > File Types. Review the list of indexed file types. If the file extension is not listed, you cannot search it with eDiscovery. Convert the file to a supported type, for example, save a .zip as a .pdf after extraction, or upload the file in a supported format.
  5. Remove Retention Policy Conflicts
    If the file is under a retention policy, check the policy settings. In the compliance portal, go to Information governance > Retention policies. Select the policy applied to the SharePoint site. Under “Locations”, ensure the policy is not set to “Preservation in place” without also enabling eDiscovery access. Edit the policy and under “Choose what happens after the retention period”, select “Delete items automatically” or “Do nothing” to avoid blocking eDiscovery. For records, use the eDiscovery search option that includes preserved locations: in the content search query, add isrecord:true if you need to find records.
  6. Run the Search Again and Export Results
    After making changes, click “Search” at the bottom of the content search page to rerun the query. Wait for the search to complete. Review the results. If files still missing, repeat steps 2 and 3 for additional libraries. When satisfied, export the results using the “Export results” option and select a report format that includes the file paths for verification.

ADVERTISEMENT

If eDiscovery Still Has Issues After the Main Fix

eDiscovery Search Returns Zero Results for SharePoint

If the search returns zero results even after adding site paths, the search query syntax might be incorrect. Remove all keywords and run a search with only the location set to “All sites”. If results appear, the keyword filter is too restrictive. Simplify the query by removing date ranges or complex operators. Test with a single keyword like “confidential” to confirm indexing works.

Files in a Modern Team Site Are Missing

Modern team sites connected to Microsoft 365 Groups use a default document library called “Documents”. eDiscovery searches this library automatically when the site is included. If files are missing, check if the files are in a different library, such as “Site Assets” or a custom library. Add the path for each library explicitly.

External Sharing Prevents eDiscovery Access

If a file was shared externally, eDiscovery can still find it as long as the file is indexed. External sharing does not block eDiscovery. However, if the file is in a site that has been deleted and is in the first-stage recycle bin, eDiscovery cannot search it. Restore the site from the SharePoint admin center before running the search.

Item Content Search with Individual URLs Content Search with All Sites
Scope Only the sites you manually select All SharePoint sites in the tenant
New sites added after search creation Not included automatically Included automatically
Search performance Faster for targeted searches Slower for large tenants
Best use case Known set of sites for a specific case Compliance sweeps or broad investigations

You can now fix eDiscovery searches that miss SharePoint files by verifying location selection, adding site paths, and including libraries with unique permissions. Next, run a test search with a single keyword to confirm the index is working. For advanced scenarios, use the PowerShell cmdlet New-ComplianceSearch with the -SharePointLocation parameter set to All to automate site inclusion across multiple searches.

ADVERTISEMENT