Cannot Find a User by Last Name in Microsoft Purview eDiscovery: Data Source Search Guide

Why a Last-Name Search Can Return Nothing

The new eDiscovery source picker is not a general employee directory. It resolves supported Microsoft 365 identities and data locations for a case, search, or hold. A last name by itself is both ambiguous and absent from Microsoft’s documented list of supported person-search values.

The picker supports a person’s full display name, first name, SMTP address, alias, Exchange GUID, or OneDrive URL. Use the exact primary SMTP address whenever it is available. It remains clear when several people share a surname, display names contain accents, a user has changed their name, or the directory contains guests and duplicate objects.

Do not confuse this step with searching the person’s content. First resolve and add the data source. Then build the eDiscovery content query against that mailbox, site, or other selected location.

The Purview Audit and eDiscovery investigation workflow provides the surrounding case model so source selection remains tied to an authorized scope rather than becoming an open-ended directory search.

Use the Strongest Identifier Available

Work down this table until the user resolves. Keep the value in the case notes so another reviewer can reproduce the source selection.

If several inputs must be tested, separate SMTP addresses with semicolons. The semicolon multi-search does not support site URLs, so add those as site locations.

Verify the Investigator Can See and Add the Source

A correct SMTP address still returns an unusable experience when the investigator lacks the required eDiscovery role or case access. Confirm the account can open the case and manage its data sources. Non-administrators see only cases where they are members, and the Custodian role provides access to the Data Sources tab for case-related source management.

Run Microsoft’s eDiscovery RBAC diagnostic from the Purview help control when Search, Preview, Export, or source-management behavior differs between investigators. Record the role group, case membership, diagnostic result, and time of the most recent permission change.

Permissions and source existence are separate questions. If another authorized investigator can resolve the same SMTP address, correct RBAC. If nobody can resolve it, move to account and workload state.

When the source picker itself is slow or repeatedly redirects, preserve the case and user identifiers and follow the Purview portal troubleshooting workflow before rebuilding the case.

Resolve Deleted, Unlicensed, Converted, and Unavailable Users

Open Manage sources and inspect the location status instead of assuming a selected person’s mailbox and OneDrive are both available.

For duplicate objects, Microsoft recommends checking Exchange recipients with Get-Recipient -Filter "EmailAddresses -eq '[email protected]'". Resolve duplicate identity data before placing a consequential hold.

Rebuild Legacy Case Sources in the New eDiscovery Experience

Microsoft states that data sources from the legacy eDiscovery experience do not synchronize into the same case in the new experience. Add the users, groups, mailboxes, and sites again at the case level or directly to the search or hold.

After selecting a user, open Manage and choose whether the investigation needs mailboxes and sites, mailboxes only, or sites only. The default includes both the mailbox and site. Review supported application containers and remove irrelevant locations only when the investigation scope authorizes that choice.

For multiple exact sources, use bulk import with SMTP addresses and full URLs separated by semicolons. Microsoft supports up to 500 sources per import but recommends splitting large imports to reduce processing time. Export the verification list and correct duplicates or unverified inputs before relying on the scope.

Prove the Source Is in the Search or Hold

A person appearing in the picker is not proof that all expected locations were added. Open the search or hold, inspect Manage sources, and verify the mailbox, OneDrive, SharePoint, and relevant application containers individually. Save the scope, run the operation, and review the location CSV in the process report.

If the user resolves by SMTP but OneDrive is missing, add the known OneDrive URL directly and document why. If a departed user’s mailbox should be inactive, verify it with the inactive-mailbox inventory rather than selecting a similarly named active account. If the source remains Unverified, allow the operation to retry verification and inspect the final process report before drawing a coverage conclusion.

Keep source selection separate from query design. Once the locations are correct, use the eDiscovery query condition building guide for keywords and Boolean logic, and the eDiscovery hold verification guide for hold status and statistics.

Close the issue with the exact identity used, resolved source type, included locations, verification status, RBAC evidence, process report, and any direct URLs added. That record protects the investigation from the much larger risk: believing a person’s data was searched when only part of their Microsoft 365 footprint was in scope.