O, O, It's Magic (What You Can Do In O365)

Aug 12, 2020 3:09:57 PM / by Anthony Cozzi

In a post-COVID world, more data is being generated than ever before. Microsoft O365, and its Teams platform, has been a huge winner in the shift to working from home. In April 2020, Microsoft reported 258 million O365 users – a 21% jump from the 2019.

This naturally increases the importance of the O365 platform for litigation and regulatory investigation discovery. This blog will cover Core vs. Advanced O365 capabilities, Accessing O365 Compliance, Data Storage, Legal Holds, Searching, and Collecting.


Core vs. Advanced eDiscovery Capabilities

Core eDisccovery provides capabilities for:

  • legal holds
  • searching for content
  • exporting content

Advanced eDiscovery provides all of this, plus many tools like those found in Relativity, DiscoveryMaster, Everlaw, Disco, Logikcull, etc., including:

  • Custodian/Data Source Management
  • Legal Hold Notifications and Automation
  • Near Dupe Deduplication and Threading
  • Analyze and Review (Annotate/Redact)
  • Export Data for External Review (Load File)

Mapping this on to the EDRM, O365 Core eDiscovery covers Identification, Preservation, and Collection, while the Advanced license also covers Processing, Review, and Analysis.


Microsoft O365 eDiscovery Capabilities


O365 License Options

For Core eDiscovery, users will want the E3 license, which includes:

  • Office Desktop apps: Word, Excel, Powerpoint, Outlook, OneNote, SP, OD, Teams
  • Exchange (100GB)
  • OneDrive (5TB)
  • Basic Information Protection (message encryption and O365 Data Loss prevention)
  • SharePoint online
  • Azure Information Protection
  • Basic Compliance Tools (Core eDiscovery)
  • $20/user/month with an annual commitment

For the Advanced eDiscovery, users will want the E5 license, which includes all of E3’s features, plus:

  • Phone system capabilities
  • Advanced Threat Detection
  • Advanced Compliance Tools (Advanced eDiscovery)
  • $35/user/month with an annual commitment

Finally, Microsoft 365 was introduced in 2017, and includes Enterprise Mobility, Security, and a Windows 10 license: E3 plans are $32/user/month, and E5 is $57/user/month


Accessing O365's eDiscovery Tools

The O365 eDiscovery tools are located in the Security & Compliance Center accessible here. An organization’s O365 global admin or a member of the Organization Management role group in the Security & Compliance Center has the ability to grant permissions for specific users to access these tools.


Data Locations

The most complex piece of discovery in O365 may be the location of the stored data, laid out in this table.

O365 structured data

And, of course, there is some data that is unsearchable. Though Microsoft is constantly adding features and search functionality, the following data types require a different method of collection utilizing third-party solutions.

unstructured data O365


Legal Holds

Traditional In-Place Legal Holds using the Exchange Admin Center (EAC) have been retired by Microsoft, but fear not, legal hold functionality is alive and well in O365. The new legal hold functionality in O365 improves your ability to specify what to hold and how long to hold.



Once you have narrowed down your search results and are ready to export/collect the data you must specify the output options for the export. These settings allow you to exclude specific items such as encrypted or those with non-recognizable formats. If exporting Exchange content, you have the ability to specify .PST options, de-duplicate, etc. After you specify your export parameters you will export the results and download.

To download these items, you must use Microsoft Edge or Microsoft Internet Explorer 10 or newer and enable Click Once support for the eDiscovery Export Tool. The eDiscovery Export Tool automatically installs and will provide status information regarding the download.



The complexity of Search Operators is one of the reasons that outsourced eDiscovery is typically the safest play for high-stakes litigation. Simple Boolean search terms on small cases can be handled by associate attorneys with relative effectiveness, but appropriate identification and collection has massive downstream impacts on costs and timelines.

O365 ediscovery search terms



Many firms were using O365 before widespread work-from-home, but the shift accelerated adoption. For many firms, going back into the office may not be a reality for a long time – if they return to a physical office at all. And that means these collaboration tools will continue to generate more ESI moving forward.

If you have questions and O365 is a key source of data, let us know – we can help.

ediscovery blog

Tags: Legal Hold, Data Collection, ediscovery, ediscovery companies, top ediscovery vendors, ediscovery detroit, ediscovery providers, ESI, ESI management

Anthony Cozzi

Written by Anthony Cozzi

Anthony joined Proteus in 2019. Law is Anthony's second act, as he previously spent a decade as an IT consultant. He holds the CEDS, Brainspace, and multiple Relativity certifications, and considers himself the funniest member of the team. He can be reached at anthony.cozzi@proteusdiscovery.com