In a post-COVID world, more data is being generated than ever before. Microsoft O365, and its Teams platform, has been a huge winner in the shift to working from home. In April 2020, Microsoft reported 258 million O365 users – a 21% jump from the 2019.

May 2021 update: Teams now reports over 145 million daily users. That number is astonishing considering its adoption as recently as March of 2020. Look at this growth over time:

This naturally increases the importance of the O365 platform for litigation and regulatory investigation discovery. This blog will cover Core vs. Advanced O365 capabilities, Accessing O365 Compliance, Data Storage, Legal Holds, Searching, and Collecting.

Core vs. Advanced eDiscovery Licenses 

Core eDisccovery provides capabilities for:

• legal holds
• searching for content
• exporting content

Advanced eDiscovery provides all of this, plus many tools like those found in Relativity, Everlaw, Disco, Logikcull, etc., including:

• Custodian/Data Source Management
• Legal Hold Notifications and Automation
• Near Dupe Deduplication and Threading
• Analyze and Review (Annotate/Redact)
• Export Data for External Review (Load File)

Mapping this on to the EDRM, O365 Core eDiscovery covers Identification, Preservation, and Collection, while the Advanced license also covers Processing, Review, and Analysis.

E3 vs. E5 eDiscovery Licenses

For Core eDiscovery, users will want the E3 license, which includes:

• Office Desktop apps: Word, Excel, Powerpoint, Outlook, OneNote, SP, OD, Teams
• Exchange (100GB)
• OneDrive (5TB)
• Basic Information Protection (message encryption and O365 Data Loss prevention)
• SharePoint online
• Azure Information Protection
• Basic Compliance Tools (Core eDiscovery)
• $20/user/month with an annual commitment

The E3 license is more appropriate for SMB contexts, and/or for when retaining an outside eDiscovery vendor is standard operating procedure. 

At the enterprise level, however, many companies have taken to insourcing more eDiscovery work, especially as cloud-based programs have made that more feasible. When millions of documents are potentially relevant, the Advanced eDiscovery requires E5 license which includes all of E3’s features plus:

• Phone system capabilities
• Advanced Threat Detection
• Advanced Compliance Tools (Advanced eDiscovery)
• $35/user/month with an annual commitment

Microsoft 365 was introduced in 2017, and includes Enterprise Mobility, Security, and a Windows 10 license: E3 plans are $32/user/month, and E5 is $57/user/month

May 2021 update: Microsoft seemingly indicated that it wasn't enforcing license limits, so depending on when you last accessed certain features you may encounter changes in your experience, specifically around content search previews, export limitations in the Core eDiscovery license for mailboxes, and Advanced eDiscovery treating SharePoint Online sites as individual locations, which is likely to slow down the collection process. 

Accessing O365's eDiscovery Tools

The O365 eDiscovery tools are located in the Security & Compliance Center accessible here. An organization’s O365 global admin or a member of the Organization Management role group in the Security & Compliance Center has the ability to grant permissions for specific users to access these tools.

Data Locations

The most complex piece of discovery in O365 may be the location of the stored data, laid out in this table:

And, of course, there is some data that is unsearchable. Though Microsoft is constantly adding features and search functionality, the following data types require a different method of collection utilizing third-party solutions:

Legal Holds

Traditional In-Place Legal Holds using the Exchange Admin Center (EAC) have been retired by Microsoft, but fear not: legal hold functionality is alive and well in O365. The new legal hold functionality in O365 improves your ability to specify what to hold and how long to hold.

Collecting

Once you have narrowed down your search results and are ready to export/collect the data you must specify the output options for the export. These settings allow you to exclude specific items such as encrypted or those with non-recognizable formats. If exporting Exchange content, you have the ability to specify .PST options, de-duplicate, etc. After you specify your export parameters you will export the results and download.

To download these items, you must use Microsoft Edge or Microsoft Internet Explorer 10 or newer and enable Click Once support for the eDiscovery Export Tool. The eDiscovery Export Tool automatically installs and will provide status information regarding the download.

Searching

The complexity of Search Operators is one of the reasons that outsourced eDiscovery is typically the safest play for high-stakes litigation. Simple Boolean search terms on small cases can be handled by associate attorneys with relative effectiveness, but appropriate identification and collection has massive downstream impacts on costs and timelines.

Conclusion

Many firms were using O365 before widespread work-from-home, but the shift accelerated adoption. For many firms, going back into the office may not be a reality for a long time – if they return to a physical office at all. And that means these collaboration tools will continue to generate more ESI moving forward.

If you have questions and O365 is a key source of data, let us know – we can help.