An Evolving Outlook: Discovery from Microsoft (Office) 365

Office 365 – now known as Microsoft 365 – has become a dominant cloud service and a common source for discovery, but its complexity and constant evolution make it a challenging one

In June 2011, Microsoft launched a new, cloud-based software-as-a-service option called Office 365.  This subscription service allowed organizations (or individuals) to utilize online, up-to-date versions of the applications in the Microsoft Office software suite, such as Word, Excel, PowerPoint, and Outlook.  Adoption was rapid for this subscription alternative to traditional software license purchases and on-premises installations.  By October 2019, Microsoft reported that it had surpassed 200 million commercial monthly active users of Office 365.

Along the way, the range of applications, features, and services available as part of Office 365 has continually expanded and evolved.  For example, in 2017, Microsoft rolled out a new Office 365 chat and collaboration application called Teams (a direct competitor to Slack), and by November 2019, Teams had already surpassed 20 million daily active users.  Most recently, Microsoft has changed the name of the service offerings from Office 365 to Microsoft 365, in part to reflect how the range of available services has evolved beyond the basic Office software suite with which they began.

With such widespread usage, Microsoft 365 has become a common source for the discovery of relevant materials.  So, just what sorts of materials might be in Microsoft 365?  What eDiscovery features are available?  What limitations of those features do practitioners need to know?

Materials in Microsoft 365

As a discovery source, Microsoft 365 can contain as diverse an array of file types as any personal computer or modern smartphone.  Depending on an organization’s subscription level, their Microsoft 365 might include any or all of the following:

  • Microsoft 365 Apps: PowerPoint, Word, Excel, OneNote, and Access
  • Email and calendar: Outlook, Exchange, and Bookings
  • Meetings and voice: Teams
  • Social and intranet: SharePoint and Yammer
  • Files and content: OneDrive, Stream, and Sway
  • Task management: Power Apps, Power Automate, Planner, and To Do
  • Advanced analytics: MyAnalytics and Power BI Pro
  • Additional features and tools designed to facilitate: device and app management, identity and access management, threat protection, information protection, security management, and advanced compliance

Beyond these official offerings from Microsoft, numerous third-party add-ons, integrations, and customizations can also be incorporated.  For example, the widely-used collaboration and work management platform SmartSheet has been integrated with Microsoft 365 in several ways.  All such components, integrations, and customizations can generate or affect ESI, ranging from traditional Office documents, to communication and chat records, to application- or environment-specific metadata, to ESI storage, to audit logs, and beyond.

Most eDiscovery practitioners are familiar already with the traditional Office document file types, and the various administrative functions and tools are not often sources of relevant ESI.  There are some increasingly-common sources within Microsoft 365, however, that present specific discovery complications related to collection, review, and more.  For example:

  • SharePoint may be extensively customized through the incorporation of widgets or the creation of custom extensions or graphical user interfaces, and it can also retain multiple successive versions of documents collaborated upon within it showing the history of their revisions.
  • Teams may contain relevant materials in standard channels or private channels or team chat, which may be stored in different places, and those materials might include audio, reactions, parent/child relationships, embedded and linked content, and other wrinkles.
  • OneNote, too, can contain a variety of multimedia and embedded content types, and in addition, OneNote features nearly unbounded canvasses on which to arrange content, which do not readily translate to standard, letter-size pages. 

eDiscovery Features in Microsoft 365 

In 2015, Microsoft began to focus on the integration of eDiscovery features into its Office 365 platform.  To help it meet those needs, Microsoft acquired Equivio, then a major developer of eDiscovery software and document analytic tools, and began to integrate its document review and analysis products into Office 365.

In the five years since, the range of eDiscovery features available in Office 365 – and now available in Microsoft 365 – has evolved several times.  In its current incarnation, these features are grouped into three tiers:

  1. Content Search” is a tool that allows you to “search mailboxes, public folders, Microsoft 365 Groups, Microsoft Teams, SharePoint Online sites, One Drive for Business locations, and Skype for Business conversations . . . in a single search.” You can use complex queries, report on search statistics, and export search results.
  1. Core eDiscovery” is a suite of features that allows you to create and manage cases, create and manage legal holds, and to utilize Content Search within a case management structure.
  1. Advanced eDiscovery” is a larger suite of features that adds custodian management, more robust legal hold management, data collection and processing, document analysis and review, and more. Full details are available here.  Advanced eDiscovery was recently updated from version 1.0 to version 2.0, and Microsoft is in the process of phasing out version 1.0.

Which of these tiers is available to you depends on your organization’s specific Microsoft subscription plan:

Limitations and Complications in Microsoft 365 

Although the integrated discovery features have grown quite robust over the past few years, there are still some important limitations and complications of which practitioners should be aware: 

    • For search, this includes limitations on how many searches can be run at once, on the number of results that can be previewed, on search length, on wildcard results, and more.
    • For indexing, this includes limitations on file types, size and number of attachments, depth of nested content, time required to parse, body length, and more. Materials that cannot be fully indexed are designated “partially indexed.”
  • Running a full project in Advanced eDiscovery: With its expanded feature set, Microsoft’s Advanced eDiscovery offering is theoretically capable of running a full eDiscovery project within Microsoft 365, from preservation through to production, but there are limitations to that approach that make it most suitable for small, simple matters that only involve sources within Microsoft 365. For example:
    • If the project involves particularly large or complex document review, you may find that Advanced eDiscovery’s built-in review tools and review management tools are not sufficient to meet your needs. They are not as robust or customizable as those you may be familiar with from dedicated review platforms like Relativity.  For example, there is no integrated privilege log creation solution.
    • If the project involves any data sources outside of Microsoft 365 – as most matters do – you are limited in your ability to import and process that outside data for integration into your Microsoft 365-based document review. Advanced eDiscovery can process some outside data, but with fewer supported file types and with fewer options for control and customization than are available when working with a full-featured eDiscovery processing tool.
  • Hybrid environments: It is very common for organizations to utilize a combination of cloud-based and on-premises Microsoft products requiring identification and collection activities to cover both environments. Such hybrid environments may not be integrated, with discrete (and potentially duplicative) on-premises and cloud-based activities taking place.  Even when they are integrated – with synchronized Active Directory functions, Exchange server hybrid deployments, and more, there are issues that must be considered regarding what has or hasn’t been synced to the cloud and what can or can’t be found using Content Search (e.g., Teams chat data).

For Assistance or More Information

Xact Data Discovery (XDD) is a leading international provider of eDiscovery, data management and managed review services for law firms and corporations.  XDD helps clients optimize their eDiscovery matters by orchestrating precision communication between people, processes, technology and data.  XDD services include forensicseDiscovery processingRelativity hosting and managed review.

XDD offers exceptional customer service with a commitment to responsive, transparent and timely communication to ensure clients remain informed throughout the entire discovery life cycle.  At XDD, communication is everything – because you need to know.  Engage with XDD, we’re ready to listen.

About the Author

Matthew Verga

Director of Education

Matthew Verga is an electronic discovery expert proficient at leveraging his legal experience as an attorney, his technical knowledge as a practitioner, and his skills as a communicator to make complex eDiscovery topics accessible to diverse audiences. A fourteen-year industry veteran, Matthew has worked across every phase of the EDRM and at every level from the project trenches to enterprise program design. He leverages this background to produce engaging educational content to empower practitioners at all levels with knowledge they can use to improve their projects, their careers, and their organizations.

Whether you prefer email, text or carrier pigeons, we’re always available.

Discovery starts with listening.

(877) 545-XACT / or / Email Us