What is Office 365 eDiscovery?
Microsoft Office 365 e-discovery provides capabilities for the process of identifying, collecting, reviewing and exchanging electronic information for use as evidence in legal cases.
How does Microsoft 365 eDiscovery work?
e-Discovery tools in Office 365 enable users to search for content in Exchange Online mailboxes, Office 365 Groups, SharePoint Online, Microsoft Teams, and OneDrive for Business sites as well as Skype for Business conversations. There are three solutions in Office 365 e-discovery:
- Content search – Enables users to search for content across data sources in Microsoft 365 and export results locally.
- Core e-discovery – Allows users to create eDiscovery cases and assign managers to them. An expansion of eDiscovery’s basic search and export capabilities, Core lets users place an eDiscovery hold on content locations pertinent to the case.
- Advanced e-discovery – Enhances the existing case management, preservation, search, and export capabilities available in Core. Provides an end-to-end workflow to help facilitate critical aspects of the eDiscovery process. Advanced eDiscovery lets legal teams manage custodians, collect and copy data from live service into review sets, and filter, search, and tag content to help users identify and focus on only the most relevant content.
How to simplify Office 365 eDiscovery
For legal and IT teams who must manage multiple Office 365 legal hold and e-discovery requests, native Office 365 e-discovery tools for email may not provide sufficient flexibility, granularity or ease of management.
Email plays a critical evidentiary role in legal proceedings today. As the primary medium for business communication, email can be used to document an individual's knowledge and motivation as well as the timing and intent of actions and business transactions. Many regulatory frameworks have strict guidelines for email retention and e-discovery, and legal teams and IT administrators can easily be overwhelmed with Office 365 e-discovery requests and Office 365 legal hold requirements.
The right e-discovery tools can help to dramatically reduce the time and resources required to respond to legal and compliance requests. And while the Office 365 e-discovery tools included with the Microsoft platform may be adequate for some companies, many organizations are turning to Office 365 security compliance and archiving solutions from Mimecast to streamline and accelerate Office 365 e-discovery.
Office 365 eDiscovery with Mimecast
Mimecast offers an all-in-one solution for email archiving, continuity and security with tools that reduce the cost and complexity of Office 365 e-discovery. Mimecast Cloud Archive is an industry-leading, cloud-based email archive that lets organizations centrally manage litigation hold for Office 365 and accelerate Office 365 e-discovery with near real-time searches of live and archived email.
To protect email data from loss and corruption, Mimecast stores three tamper-proof and encrypted copies of every message in multiple data centers. In addition to capturing email content, Mimecast retains metadata that includes the proof of delivery and non-repudiation information that is often required in legal proceedings. Mimecast stores both the original message and any policy-mandated changes.
With rapid and granular search functionality and an archive that combines live and historic email, Mimecast helps to speed Office 365 e-discovery and simplify early case assessment tasks. Administrators can use a single, web-based console to manage multiple litigation holds as well as SEC 17a 4 compliance and compliance with other frameworks. And email retention policy can be easily enforced and automated throughout the organization to take email retention decisions out of the hands of end users.
Advantages of Office 365 eDiscovery with Mimecast
When you choose Mimecast to manage Office 365 e-discovery, you can:
- Reduce the cost and complexity of managing e-discovery and litigation holds.
- Implement a SaaS-based solution for Office 365 e-discovery quickly and easily.
- Ensure that e-discovery activity is fully auditable.
- Accelerate e-discovery with industry-leading search tools.
Learn more about Office 365 e-discovery and Mimecast, and about Mimecast healthcare compliance solutions.
Microsoft Office 365 eDiscovery FAQs
What is eDiscovery in Microsoft Teams?
eDiscovery, or electronic discovery, is the identification, preservation, collection, and presentation of electronically stored information (ESI) for litigation, regulatory compliance, or other types of investigations.
The purpose of eDiscovery in Microsoft Teams is to meet legal or regulatory compliance requirements by having the capability to search and store ESI from chat messages, file sharing, and meeting recordings from across Teams and associated apps like Exchange Online, SharePoint Online, and OneDrive for Business. This is usually accomplished through Microsoft Purview, Microsoft’s comprehensive eDiscovery solution.
Part of this process is placing legal holds on data sources from Teams to prevent deletion or modification throughout the eDiscovery process. Potentially relevant data is safeguarded by legal holds for review and presentation during legal proceedings.
Within Microsoft Purview, the Content Search and Core eDiscovery features make it possible to search and collect data from distinct Teams locations, including user mailboxes, group mailboxes, SharePoint sites, and OneDrive accounts.
Then, with features like conversation threading, deep indexing, and redaction capabilities, Advanced eDiscovery can take legal review even further. When necessary, Teams data can be exported into a reviewable format and analyzed for eDiscovery litigation or investigation.
Who can use eDiscovery?
Legal professionals, compliance officers, and IT administrators are all parties who may be interested in eDiscovery processes and require the ability to search and review ESI from Office 365. HR leaders may also need eDiscovery tools during legal or compliance investigations. Therefore, while eDiscovery may fall primarily under the purview of legal teams, other stakeholders can also benefit from eDiscovery capabilities.
How do I use Office 365 advanced E-Discovery?
There are several steps to take in order to use Advanced e-discovery. Select and assign the appropriate licensing - There are organization subscriptions and per-user licensing.
Assign permissions - To access Advanced eDiscovery or add a member:
- Go to Permissions and sign in using the admin credentials for your organization's Microsoft 365.
- Select the e-discovery Manager on the Permissions page.
- Click Add then and select the checkbox for all users you want to add to the role group.
- Click Add to add the selected users, and then click Done.
- Click Save to add the users to the role group.
- Click Close. Your changes may take a few hours to reflect.
What are the advantages of Office 365 eDiscovery?
Benefits of Office 365 e-discovery include:
- Automation. Enhanced remediation minimizes the need for users to manually remediate unsearchable content.
- Speed. Office 365 e-discovery enables users to place content on hold in Office 365 without moving it to another archive for preservation.
- Savings. Office 365 e-discovery can help search for and identify relevant content quickly and easily, with less need for manual review and less content that needs to be sent to third-party reviewers.
- Availability. Office 365 e-discovery is available globally to respond to legal and compliance needs or for internal investigations.
How does eDiscovery differ across private and shared channels?
eDiscovery is handled differently between private channels and shared channels in Microsoft Teams.
Within private channels, compliance copies of messages are sent to the mailboxes of all members. In shared and public channels, compliance copies of messages are sent to a system mailbox associated with the admins or parent team.
To perform eDiscovery on a private channel, the following locations should be included:
- SharePoint sites (for files, conversations about documents, list items, and pages)
- Exchange mailbox for each custodian
Legal holds can be placed on the SharePoint site, and on messages in user mailboxes to preserve content.To perform eDiscovery on a public channel, the following locations should be selected:
- SharePoint sites (for files, conversations about documents, lists, and pages)
- Exchange Group mailbox for the Teams mailbox (includes all shared channel conversations)
Legal holds can be placed on the Group mailbox and the Team’s SharePoint site to preserve content.
What are the limitations of Office 365 eDiscovery?
While Office 365 e-discovery offers a broad range of tools, there are a number of limitations that organizations migrating to Office 365 will need to address.
- The Office 365 Security and Compliance Center, which includes e-discovery and preservation policies, does not provide uniform tools across all subscriptions.
- Organizations that want to deploy enterprise-wide litigation holds may be frustrated by restrictions that Office 365 places on litigation hold features for end-user mailboxes.
- Performance can be limited in Office 365 e-discovery – some users have experienced slow results or variations in the accuracy of searches.
- In the basic subscription, Office 365 e-discovery performs searches without analysis capabilities, which can result in search results with duplicate files, unindexed items and potential false positives. This excess in data can add significant costs for third-party review services.
- Office 365 Advanced e-discovery can’t match the robust functionality of third-party review tools, particularly for processing and review.
- Leveraging advanced functionality can be complicated and may require companies to hire an in-house analyst or counsel.
How to address the gaps in Office 365 eDiscovery?
Most organizations will need to augment Office 365 with additional solutions for e-discovery that can manage outside data sources and provide additional functionality. To complement the abilities of Office 365 e-discovery, organizations should look for solutions that offer:
- A cloud SaaS solution that can scale easily as needed while reducing operational and capital costs.
- An archive that provides a single repository for archived and live email that enables comprehensive e-discovery across mobile and stationary devices.
- Litigation holds that can be deployed rapidly and managed centrally.
- Comprehensive data retention policies with in-depth control over data purge requests by clients to satisfy GDPR and other regulatory requirements.
- Easy-to-use tools and self-service options that simplify e-discovery, legal and compliance efforts.
What is the difference between content search and eDiscovery?
Microsoft Office 365 encompasses many data types, including calendars, documents, email, Microsoft Teams, OneDrive files, SharePoint sites, and more. The result is a complex web of ESI data points that, when eDiscovery is necessary, can be tricky to navigate.
There are several ways to find data source information and user-generated content within the Office 365 apps. The most basic is Content Search. This tool is available in Microsoft’s compliance center and can be used by accounts with E1 licenses or higher. Using Content Search, users can look for relevant content across their Office 365 workspace. It can rapidly search through Exchange mailboxes, SharePoint sites, and OneDrive locations and retrieve up to 1,000 results per search.
Identifying content for review is the first stage of an eDiscovery investigation. However, the eDiscovery process also encompasses data cataloging and governance tasks required for legal cases and regulatory compliance or investigations. Content Search is limited in its ability to support these broader eDiscovery processes.
What is the difference between standard and premium eDiscovery?
eDiscovery Standard provides core capabilities like creating cases, placing legal holds, and searching for relevant information across Microsoft 365 services. It's suited for basic legal and compliance needs.
eDiscovery Premium offers a more advanced workflow. It includes features like custodian management, collections, review sets, and analytics to streamline large or complex investigations.
While both help maintain data security, Premium is better for organizations handling high volumes of data or requiring deeper analysis during litigation or audits.
