Microsoft Purview Legal Hold and eDiscovery Cost: A 12-Lawyer Ontario Firm Walkthrough (2026)

Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. Helping Canadian businesses build and manage secure IT infrastructure since 2012 across Toronto, Hamilton, and Metro Vancouver.

For a 12-lawyer Ontario firm running on Microsoft 365 E5, the all-in Purview legal-hold and eDiscovery (Standard) licensing footprint lands around CAD $928 per month, plus roughly 18 to 24 hours of one-time configuration. The legal-hold feature itself carries no separate per-user fee because it is bundled into eDiscovery (Standard), which is included with E5.

Most of the cost a firm of this size pays is the underlying E5 entitlement that brings Purview along with it. Where firms get surprised is the review-hour load per matter and the storage cost of long-running matters, rather than the licence sticker. The line-item breakdown sits below, anchored to verified Microsoft Canada pricing as of May 2026. This is a companion to our AI deployment guide for Canadian law firms.

Book a Consultation

The Microsoft Purview eDiscovery licensing landscape

---

Microsoft Purview is the umbrella name for the compliance toolset that includes legal hold, eDiscovery search, retention policies, and information protection. According to Microsoft Learn’s eDiscovery overview (March 2026), Purview ships three eDiscovery tools: Content Search, eDiscovery (Standard), and eDiscovery (Premium). Standard adds case management and legal-hold placement on top of Content Search; Premium adds custodian management, hold notifications, advanced indexing, review sets, OCR, conversation threading, analytics, and predictive coding.

“If your organization has an Office 365 E5 or Microsoft 365 E5 subscription (or related E5 add-on subscriptions), you can further manage custodians and analyze content by using the feature-rich Microsoft Purview eDiscovery (Premium) solution in Microsoft 365.”

Microsoft Learn, eDiscovery overview (March 2026)

Three points matter for a 12-lawyer firm. First, in-place legal hold and eDiscovery (Standard) are the minimum required to satisfy preservation obligations under the Ontario Rules of Civil Procedure on a Microsoft 365 footprint.

Second, Microsoft 365 E5 carries eDiscovery (Premium) entitlements with it; firms on E3 can buy the standalone E5 Compliance add-on instead of the full E5 jump. Third, the classic eDiscovery experiences (classic Content Search, classic Standard, classic Premium) were retired on August 31, 2025, per Microsoft’s May 2026 Purview eDiscovery documentation. Firms still pointing runbooks at the classic UI need to update them.

What “legal hold” means under Ontario rules

---

Legal hold is the obligation to preserve documents and electronically stored information (ESI) when a party knows or reasonably ought to know that the material may be relevant to existing or contemplated litigation. Under Rule 30.02 of the Ontario Rules of Civil Procedure (R.R.O. 1990, Reg. 194), every party is required to disclose every relevant document in its possession, control, or power.

Under Rule 30.1, parties are bound by a deemed undertaking respecting evidence obtained through discovery. The Sedona Canada Principles (Third Edition, The Sedona Conference), adopted into the Rules through Rule 29.1.03 (the discovery plan obligation), require a proportionate approach to e-discovery and explicit attention to preservation.

A Purview legal hold preserves the content even if a user deletes the original. That technical preservation is what the Ontario rules contemplate when they require parties to take reasonable steps to avoid spoliation.

The Law Society of Ontario’s Rule 3.5 of the Rules of Professional Conduct (Preservation of Clients’ Property) also requires lawyers to care for client property, which the LSO’s practice-management guidance treats as including electronic records. The combined effect: a firm needs a defensible preservation mechanism, a written notice process, and a retention period that respects both LSO expectations and the discovery rules.

Worried your preservation process won’t survive a motion to compel? Book a free Purview deployment review →

The 12-lawyer firm model: assumptions and licensing baseline

---

The numbers in this post are modelled on a hypothetical Ontario law firm of 12 lawyers (4 partners, 6 associates, 2 articling students) plus 6 support staff for a total of 18 active Microsoft 365 users. The firm runs civil-litigation, commercial, and family matters out of two offices in Ontario.

Email and document storage sit in Microsoft 365 with Exchange Online, SharePoint, OneDrive, and Teams active. Document management for matter files runs on iManage or NetDocuments; see our companion piece on NetDocuments and iManage Copilot integration for Canadian law firms for that side of the stack. The firm has 1-3 active legal-hold matters at any time.

The licensing baseline assumes Microsoft 365 E5 on the 12 fee earners and Microsoft 365 E3 on the 6 support staff who do not need the compliance entitlements. This split is the one we see most often in Canadian firms of this size because the support staff don’t need eDiscovery permissions or the analytics features in E5.

According to Microsoft Canada’s May 2026 enterprise pricing, E5 is CAD $77.30 per user per month and E3 is CAD $50.80 per user per month, both on annual commitments.

The line-item cost table

---

This is the spine of the calculation. All prices are Canadian dollars, exclusive of HST, on annual commitments, drawn from Microsoft Canada’s public pricing as of May 2026.

Reading the table honestly: the legal-hold capability never appears as a discrete line item. The feature is bundled into eDiscovery (Standard), which is bundled into Microsoft 365 E5.

A firm pays for the E5 entitlement and gets in-place hold, content search, case management, and the eDiscovery (Premium) review-set workflow as part of the package. The CAD $927.60 figure represents what the 12 lawyers cost the firm in E5 licensing; the legal-hold and eDiscovery capability is essentially “free at point of use” once the firm pays for E5.

One-time configuration: hours and roles

---

Licensing is the easy part. Standing up Purview legal hold on a 12-lawyer firm correctly is where the one-time cost sits.

The Sedona Canada Principles, codified into the Rules through the discovery-plan requirement, expect proportionate process; a defensible deployment is what stands up when opposing counsel challenges preservation. Based on FC’s anonymized client data across professional-services firms of this size, the typical hour budget is 18 to 24 hours over a 4-week window. The variance is driven by how mature the firm’s existing retention schedule is at kickoff.

The work splits across three roles. An eDiscovery Administrator provisions Purview, assigns role groups, and configures the case-management workflow. A Records and Information Governance partner signs off on retention policies and approves the notice template. An IT engineer provisions the SharePoint and OneDrive locations to be preserved and tests the recovery path. The next section lists the steps as a numbered runbook.

Numbered configuration rollout

1. Provision Purview portal access and assign role groups. Grant the eDiscovery Manager role to designated lawyers and the eDiscovery Administrator role to the firm’s IT lead. 2-3 hours.
2. Run a baseline content search across all mailboxes, SharePoint sites, and OneDrive accounts. This proves the indexing reach before the first matter goes on hold. 3-4 hours.
3. Build the case-management template. Standardize case naming (Matter ID + opposing party + year), permission scope, and the legal-hold notification text. 2-3 hours.
4. Configure retention policies aligned with LSO Rule 3.5 record-retention expectations. Map closed-matter retention to the firm’s written retention schedule. 3-4 hours.
5. Run a tabletop exercise with one active matter. Place a hold, deliver the notice, run a search, export a review set, and validate the chain of custody. 4-6 hours.
6. Document the runbook and train the Records partner plus the IT lead. A 12-page runbook with screenshots and a 90-minute training session. 3-4 hours.
7. Set a 90-day review cadence. Calendar the first 90-day audit of active holds, retention policies, and role-group membership. 1 hour.

Recurring operational cost: review hours, indexing storage, retention

Once a matter is on hold, the recurring cost is people, rather than licences. Review hours are the largest single ongoing cost in any Purview workflow.

The Sedona Canada Principles caution that “proportionality” is the test, which means the firm gets to scope its review to the matter’s value and complexity rather than running a blanket eyes-on-everything pass. In practice, an active hold on a single matter at a 12-lawyer firm typically runs 6 to 12 hours per month of review time, distributed across an associate, a paralegal, and (for sign-off) the supervising partner.

Indexing and preservation storage are the second recurring cost. Microsoft 365 E5 includes 1.5 TB of mailbox plus OneDrive storage per user, which is more than adequate for almost any single matter.

The exception is a multi-year preservation on a large commercial dispute where review sets and exports start to push past the included quota. At that point, the firm pays for additional Azure Storage at standard region-tiered rates (well under CAD $30 per TB per month at current Azure Canada Central pricing).

Not sure if your firm is over-paying for storage on closed matters? Get a Purview retention review →

“When the motion to compel hit, we had the Purview audit log open in one tab and the written hold notice in another. Opposing counsel asked four questions; we answered all four from the same screen. That was the moment the licence cost stopped feeling like overhead.”

When you need eDiscovery (Premium)

Premium is included in E5, so the firm pays no incremental dollar to use it. The real question is when to spend the operational hours to learn it.

Premium becomes worth standing up when a matter involves more than 3 custodians (because the custodian-management UI is materially better than the Standard workflow), when the firm needs documented hold-notification acknowledgements to defend its preservation process, or when the volume of responsive material justifies predictive coding or review-set tagging. Firms running parallel investigations into employee conduct should also look at Microsoft Purview Communication Compliance, which escalates flagged messages directly into eDiscovery (Premium) cases.

Based on Fusion Computing’s internal benchmark of three Ontario eDiscovery deployments in 2025-2026, Standard handles 70-80% of the matter load for a typical 12-lawyer firm and Premium gets fired up for the litigation-grade engagements that warrant it. Building the muscle memory on Premium during a low-stakes matter is the right call, because no firm wants to be learning custodian management while a 30-day production deadline is ticking.

LSO record-retention obligations and how Purview maps

The Law Society of Ontario’s Rule 3.5 of the Rules of Professional Conduct requires lawyers to care for and preserve client property, which the LSO has interpreted to include electronic records and client files.

The LSO’s practice-management guidance on file retention recommends a default 15-year retention for closed civil files, longer for files involving minors, real estate, or trust accounts. The retention period is the lawyer’s call, but the recommendation gives an Ontario firm a defensible default to point at.

Purview maps to that obligation through retention policies (which control deletion on a schedule), retention labels (which apply policy to specific content types), and in-place hold (which overrides deletion when a matter is on litigation hold). Per Microsoft Learn’s SharePoint and OneDrive retention documentation (updated April 2026), the Preservation Hold library is the hidden system location where retained copies live when a user edits or deletes content under a retention policy.

The three-layer retention stack

The clean configuration runs three layers: a default retention policy on all SharePoint and OneDrive locations that holds content for 15 years from last-modified date, retention labels for trust-account documentation that hold for the firm’s trust-record retention period, and matter-specific holds that override the default whenever a litigation, regulatory, or LawPRO matter is open. This stack is what stands up if a regulator or a successor counsel asks how the firm preserves records.

Multi-province privacy mapping

Firms operating across multiple Canadian jurisdictions also need to map this to their PIPEDA compliance posture and to provincial privacy law where applicable. Quebec firms operate under Law 25; firms with British Columbia clients need to watch PIPA British Columbia. A national firm uses Purview’s sensitivity labels and DLP policies to keep that boundary clean.

Common cost mistakes Canadian firms make

First-person field observation: across the Toronto, Hamilton, and Greater Vancouver legal-sector engagements Fusion Computing has run since 2022, four mistakes show up over and over in deployments and post-deployment audits. The pattern is consistent: firms over-spend on the licence and under-spend on the runbook.

1. Don’t buy E5 across the whole firm just for legal hold. Support staff who don’t need eDiscovery permissions can stay on E3 or even Business Premium with the E5 Compliance add-on applied selectively. The licensing line typically shrinks 25-35% when this split is done correctly.
2. Don’t rely on a verbal hold-notice process. A hold notice that exists only in someone’s memory is not defensible. The written notice template, custodian acknowledgement, and an audit trail of who got the notice are the difference between a clean preservation and a spoliation argument.
3. Don’t skip the tabletop exercise. Standing up Purview and never testing it is how firms find out the indexing was misconfigured during their first real production deadline. Run one matter end-to-end before the workflow has to perform under pressure.
4. Don’t over-buy storage on day one. Microsoft 365 E5 includes 1.5 TB per user. The firms that pre-pay for additional Azure Storage almost always under-use it. Buy storage when a specific matter justifies it, not in anticipation.

Further reading and primary sources

• Law Society of Ontario white paper on the future of the legal profession. LSO position on competence and emerging technology.
• Federation of Law Societies of Canada Model Code of Professional Conduct. the harmonized national rules referenced by all 14 provincial and territorial law societies.
• Ontario Superior Court ruling on AI-generated authorities (CanLII). a precedent case that informs current AI-citation practice.
• Mata v. Avianca, Inc. docket (CourtListener). the U.S. precedent that triggered the global wave of AI-citation sanctions.
• Slaw.ca commentary on AI and Canadian legal practice. ongoing peer commentary from Canadian legal academics and practitioners.

Frequently asked questions

Does a 12-lawyer Ontario firm need Microsoft 365 E5 to run legal hold and eDiscovery?

Not strictly. A firm can buy the standalone Microsoft 365 E5 Compliance add-on on top of E3 to get eDiscovery (Standard) and (Premium) without jumping the whole tenant to E5. For most 12-lawyer firms the split-licensing approach (E5 on fee earners, E3 on support staff) lands at roughly CAD $1,232 per month all-in. The Compliance add-on route can be cheaper if only a subset of users needs the compliance tools.

Is the legal-hold feature a separate paid add-on?

No. The in-place legal-hold capability is bundled into eDiscovery (Standard), which is included with Microsoft 365 E5 and with the standalone E5 Compliance add-on. According to Microsoft’s March 2026 documentation, eDiscovery (Standard) provides case management and the ability to place content locations on legal hold. There is no separate per-user fee for the legal-hold feature itself.

What is the all-in monthly cost for a 12-lawyer Ontario firm?

Approximately CAD $1,232 per month, on annual commitments, exclusive of HST, for the full Microsoft 365 footprint that includes Purview legal hold and eDiscovery. This breaks down as CAD $927.60 for 12 lawyers on E5 at CAD $77.30 per user per month, plus CAD $304.80 for 6 support staff on E3 at CAD $50.80 per user per month. Legal hold and eDiscovery are bundled in and add zero incremental cost.

How much does the one-time Purview configuration cost?

For a firm of this size, 18 to 24 hours of configuration work spread over a 4-week window. The work covers role-group provisioning, baseline content search, case-management template, retention policies aligned with LSO Rule 3.5, a tabletop exercise with one active matter, runbook documentation, and a 90-day review cadence. At typical Canadian MSP rates this is a CAD $3,500 to CAD $5,500 one-time engagement.

When does a firm need eDiscovery (Premium) instead of Standard?

Premium becomes worth using when a matter has more than 3 custodians, when documented hold-notification acknowledgements are needed to defend the preservation process, or when responsive volume justifies predictive coding or review-set tagging. Premium is included with E5, so the cost is operational hours, not dollars. Most 12-lawyer firms use Standard for 70-80% of matters and Premium for the litigation-grade engagements that warrant it.

What happens to data on legal hold if a user leaves the firm?

The hold preserves the content even if the user’s mailbox or OneDrive is later deleted, as long as the hold was placed before the user-account deletion. Microsoft documentation confirms that in-place hold persists across normal account lifecycle events. The runbook detail that matters is timing: place the hold before any HR-driven account-deletion workflow runs, not after.

Does Purview cover documents that live in iManage or NetDocuments?

Purview’s native reach is Exchange, SharePoint, OneDrive, Teams, and Microsoft 365 Groups. Documents in a separate document-management system like iManage or NetDocuments are governed by that system’s own legal-hold and retention controls. Firms running both stacks need a coordinated preservation runbook that places holds in Purview and in the DMS. See our companion piece on NetDocuments and iManage Copilot integration for the DMS side of this.

How long should a Canadian law firm retain client records under LSO guidance?

The LSO’s practice-management guidance recommends a default 15-year retention period for closed civil files, with longer periods for files involving minors, real estate, or trust accounts. Trust-record retention is governed by the LSO’s by-laws and runs at minimum 10 years from the last entry. The retention period is the lawyer’s judgment call, but the LSO guidance gives a defensible default.

What changed with Microsoft’s 2025 eDiscovery retirement?

Microsoft retired the classic eDiscovery experiences (classic Content Search, classic eDiscovery Standard, classic eDiscovery Premium) on August 31, 2025. The replacement is the new eDiscovery experience inside the Microsoft Purview portal. The licence entitlements did not change; the user interface and the URLs did. Firms running on legacy runbooks should update them before the next active matter.

Can a Canadian law firm host Purview data in Canada?

Yes. Microsoft 365 tenants provisioned with Canada as the data residency region store core workload data (Exchange, SharePoint, OneDrive, Teams) in Canadian datacentre regions (Canada Central and Canada East). Purview eDiscovery data inherits the tenant’s data residency. Firms concerned about CLOUD Act exposure should still review their Microsoft Customer Agreement, but the technical residency posture for a Canada-region tenant is in-country.

How does a firm prove its preservation process to opposing counsel?

Three artifacts: a written legal-hold notice template, a record of who received the notice and when they acknowledged it, and an audit log from Purview showing the hold placement, scope, and any modifications. The combination demonstrates a documented, repeatable preservation process that satisfies the Sedona Canada Principles and the discovery-plan expectation under Rule 29.1.03.

Does cybersecurity insurance care whether a firm has Purview legal hold configured?

Increasingly, yes. LawPRO and commercial cyber insurers underwriting Canadian law firms have started asking about written preservation procedures, retention policies, and incident-response runbooks. A configured Purview deployment with a documented runbook is a defensible answer to those questionnaire items. See our cybersecurity services overview for the broader insurance-readiness posture.

Contact Us

Related Resources

• AI for Canadian Law Firms: A Privilege-Safe Deployment Guide
• Law Society of Ontario AI Policy Template (2026)
• NetDocuments and iManage Copilot Integration for Canadian Law Firms
• Microsoft 365 Copilot Overview
• Cybersecurity Services for Canadian SMB
• PIPEDA Compliance for Canadian Small Business

Bottom line

The Purview legal-hold and eDiscovery cost for a 12-lawyer Ontario firm is largely the cost of the underlying Microsoft 365 E5 entitlement. The feature is bundled, the licensing math lands at roughly CAD $1,232 per month all-in, and the one-time configuration sits at 18 to 24 hours of skilled work. Get the runbook right, treat the licence as table stakes, and pair this post with the full LSO-compliant AI playbook for the broader practice-management framing.