eDiscovery Office 365: Tools, Benefits and Best Practices

eDiscovery, or electronic discovery, is the identification, preservation, collection, and presentation of electronically stored information (ESI) for litigation, regulatory compliance, or other types of investigations.

The purpose of eDiscovery in Microsoft Teams is to meet legal or regulatory compliance requirements by having the capability to search and store ESI from chat messages, file sharing, and meeting recordings from across Teams and associated apps like Exchange Online, SharePoint Online, and OneDrive for Business. This is usually accomplished through Microsoft Purview, Microsoft’s comprehensive eDiscovery solution.

Part of this process is placing legal holds on data sources from Teams to prevent deletion or modification throughout the eDiscovery process. Potentially relevant data is safeguarded by legal holds for review and presentation during legal proceedings.

Within Microsoft Purview, the Content Search and Core eDiscovery features make it possible to search and collect data from distinct Teams locations, including user mailboxes, group mailboxes, SharePoint sites, and OneDrive accounts.

Then, with features like conversation threading, deep indexing, and redaction capabilities, Advanced eDiscovery can take legal review even further. When necessary, Teams data can be exported into a reviewable format and analyzed for eDiscovery litigation or investigation.

Legal professionals, compliance officers, and IT administrators are all parties who may be interested in eDiscovery processes and require the ability to search and review ESI from Office 365. HR leaders may also need eDiscovery tools during legal or compliance investigations. Therefore, while eDiscovery may fall primarily under the purview of legal teams, other stakeholders can also benefit from eDiscovery capabilities.

There are several steps to take in order to use Advanced e-discovery. Select and assign the appropriate licensing - There are organization subscriptions and per-user licensing.

Assign permissions - To access Advanced eDiscovery or add a member:

• Go to Permissions and sign in using the admin credentials for your organization's Microsoft 365.
• Select the e-discovery Manager on the Permissions page.
• Click Add then and select the checkbox for all users you want to add to the role group.
• Click Add to add the selected users, and then click Done.
• Click Save to add the users to the role group.
• Click Close. Your changes may take a few hours to reflect.

Benefits of Office 365 e-discovery include:

• Automation. Enhanced remediation minimizes the need for users to manually remediate unsearchable content.
• Speed. Office 365 e-discovery enables users to place content on hold in Office 365 without moving it to another archive for preservation.
• Savings. Office 365 e-discovery can help search for and identify relevant content quickly and easily, with less need for manual review and less content that needs to be sent to third-party reviewers.
• Availability. Office 365 e-discovery is available globally to respond to legal and compliance needs or for internal investigations.

eDiscovery is handled differently between private channels and shared channels in Microsoft Teams.

Within private channels, compliance copies of messages are sent to the mailboxes of all members. In shared and public channels, compliance copies of messages are sent to a system mailbox associated with the admins or parent team.

To perform eDiscovery on a private channel, the following locations should be included:

• SharePoint sites (for files, conversations about documents, list items, and pages)
• Exchange mailbox for each custodian

Legal holds can be placed on the SharePoint site, and on messages in user mailboxes to preserve content.To perform eDiscovery on a public channel, the following locations should be selected:

• SharePoint sites (for files, conversations about documents, lists, and pages)
• Exchange Group mailbox for the Teams mailbox (includes all shared channel conversations)

Legal holds can be placed on the Group mailbox and the Team’s SharePoint site to preserve content.

While Office 365 e-discovery offers a broad range of tools, there are a number of limitations that organizations migrating to Office 365 will need to address.

• The Office 365 Security and Compliance Center, which includes e-discovery and preservation policies, does not provide uniform tools across all subscriptions.
• Organizations that want to deploy enterprise-wide litigation holds may be frustrated by restrictions that Office 365 places on litigation hold features for end-user mailboxes.
• Performance can be limited in Office 365 e-discovery – some users have experienced slow results or variations in the accuracy of searches.
• In the basic subscription, Office 365 e-discovery performs searches without analysis capabilities, which can result in search results with duplicate files, unindexed items and potential false positives. This excess in data can add significant costs for third-party review services.
• Office 365 Advanced e-discovery can’t match the robust functionality of third-party review tools, particularly for processing and review.
• Leveraging advanced functionality can be complicated and may require companies to hire an in-house analyst or counsel
• Microsoft eDiscovery requires teams to assemble data from Exchange mailboxes, SharePoint, and OneDrive, then copy relevant messages into review sets.
• New Microsoft Purview policies are processed in batches, which can delay email holds by up to 24 hours.
• Generic sentiment analysis is applied only after a case is created, which can increase irrelevant review material.
• Large review sets can become cumbersome when tools restrict how many messages can be processed or reviewed at once.

Most organizations will need to augment Office 365 with additional solutions for e-discovery that can manage outside data sources and provide additional functionality.

This is especially important when legal, compliance, HR, or security teams need to support investigations tied to litigation, regulatory requests, policy violations, or insider risk management.

• A cloud SaaS solution that can scale easily as needed while reducing operational and capital costs.
• An archive that provides a single repository for archived and live email that enables comprehensive e-discovery across mobile and stationary devices.
• Litigation holds that can be deployed rapidly and managed centrally.
• Comprehensive data retention policies with in-depth control over data purge requests by clients to satisfy GDPR and other regulatory requirements.
• Easy-to-use tools and self-service options that simplify e-discovery, legal and compliance efforts.

Microsoft Office 365 encompasses many data types, including calendars, documents, email, Microsoft Teams, OneDrive files, SharePoint sites, and more. The result is a complex web of ESI data points that, when eDiscovery is necessary, can be tricky to navigate.

There are several ways to find data source information and user-generated content within the Office 365 apps. The most basic is Content Search. This tool is available in Microsoft’s compliance center and can be used by accounts with E1 licenses or higher. Using Content Search, users can look for relevant content across their Office 365 workspace. It can rapidly search through Exchange mailboxes, SharePoint sites, and OneDrive locations and retrieve up to 1,000 results per search.

Identifying content for review is the first stage of an eDiscovery investigation. However, the eDiscovery process also encompasses data cataloging and governance tasks required for legal cases and regulatory compliance or investigations. Content Search is limited in its ability to support these broader eDiscovery processes.

eDiscovery Standard provides core capabilities like creating cases, placing legal holds, and searching for relevant information across Microsoft 365 services. It's suited for basic legal and compliance needs.

eDiscovery Premium offers a more advanced workflow. It includes features like custodian management, collections, review sets, and analytics to streamline large or complex investigations.

While both help maintain data security, Premium is better for organizations handling high volumes of data or requiring deeper analysis during litigation or audits.