.svg){kind=small}
by Aware
Electronic discovery is the process of identifying, collecting, and presenting electronically stored information (ESI) for litigation, regulatory compliance, or other investigations. In this post, we’ll explore the tools available for legal teams to perform eDiscovery in Microsoft Office 365, the challenges they may face, and how to overcome them quickly and effectively.
Contents
- What is the difference between Content Search and eDiscovery?
- Who can use eDiscovery?
- How do I do an advanced eDiscovery search in Office 365?
- How to use eDiscovery in Microsoft Purview
- What are the different eDiscovery plans that Microsoft Purview offers?
- What are some limitations of using Microsoft Purview for eDiscovery?
- Integrate Aware with Office 365 for more powerful eDiscovery
What is the difference between Content Search and eDiscovery?
Microsoft Office 365 encompasses many data types, including calendars, documents, email, Microsoft Teams, OneDrive files, SharePoint sites, and more. The result is a complex web of ESI data points that, when eDiscovery is necessary, can be tricky to navigate.
There are several ways to find data source information and user-generated content within the Office 365 apps. The most basic is Content Search. This tool is available in Microsoft’s compliance center and can be used by accounts with E1 licenses or higher. Using Content Search, users can look for relevant content across their Office 365 workspace. It can rapidly search through Exchange mailboxes, SharePoint sites, and OneDrive locations and retrieve up to 1,000 results per search.
Identifying content for review is the first stage of an eDiscovery investigation. However, the eDiscovery process also encompasses data cataloging and governance tasks required for legal cases and regulatory compliance or investigations. Content Search is limited in its ability to support these broader eDiscovery processes.
Read more: Top eDiscovery challenges and how to overcome them
Who can use eDiscovery?
Legal professionals, compliance officers, and IT administrators are all parties who may be interested in eDiscovery processes and require the ability to search and review ESI from Office 365. HR leaders may also need eDiscovery tools during legal or compliance investigations. Therefore, while eDiscovery may fall primarily under the purview of legal teams, other stakeholders can also benefit from eDiscovery capabilities.
Read the case study: How a major restaurant chain resolved a lawsuit using Aware
How do I do an advanced eDiscovery search in Office 365?
Microsoft Office 365’s eDiscovery solution is called Purview. Purview gathers data from the entire O365 ecosystem into one core source, providing a starting point for legal officers to analyze their data.
With Purview, companies can identify custodians’ communications data across all of Office 365’s programs, preserve relevant ESI, and conduct more efficient collection and review.
Related: How to do eDiscovery in Google Drive
How to use eDiscovery in Microsoft Purview?
Access to the eDiscovery features in Purview typically requires E3 or E5 licenses to get started. Additional subscriptions then determine the depth of ESI investigators can obtain through Purview. Companies may need to acquire a premium subscription service to fully unlock all of Purview’s eDiscovery capabilities.
After configuring licenses and subscriptions to ensure all Microsoft Purview users have the necessary access, the next step is to manage permissions to the data itself. This involves determining the categories of ESI for the intended search and identifying who will be responsible for parsing the data when the search is completed. Those parties will need permissions to view the datasets. For eDiscovery administrators not privy to the entire dataset, restrictions should be in place before the search query results are returned.
Microsoft Purview allows users to configure advanced settings before running the search to index the data. Users can then create legal holds to preserve the results in an immutable archive, ensuring its integrity for a court of law. Finally, Purview provides review sets, which are documents that can be tagged, analyzed, queried, viewed, and exported during early case analysis.
Webinar: Your legal ops checklist for collaboration tools
What are the different eDiscovery plans that Microsoft Purview offers?
Microsoft Purview offers 3 tiers of eDiscovery solutions: Content Search, eDiscovery (Standard), and eDiscovery (Premium).
Content Search
- Enables searching across the Microsoft Office 365 suite, including Teams, Exchange, OneDrive, SharePoint, and more
- Provides keyword queries and search parameters to narrow search functions
- Displays search statistics like quantity and size of files found
- Allows exporting of search results
- Requires a Microsoft 365 or Office 365 license
eDiscovery (Standard)
Includes everything in Content search, plus:
- Enables creation of eDiscovery cases and assignment to specific case managers
- Allows placing legal holds on content locations to preserve data integrity
- Facilitates the linking of searches and exports to specific cases
- Requires an Office 365 or Microsoft 365 E5 license or related E5 add-on subscription
eDiscovery (Premium)
Includes everything in eDiscovery (Standard) plus:
- End-to-end eDiscovery workflow for identifying, preserving, collecting, reviewing, analyzing, and exporting content
- Allows managing custodians and the legal hold notification process
- Includes advanced analytics and machine learning-based predictive coding models
- Supports features like review set filtering, tagging, and error remediation
- Requires an Office 365 or Microsoft 365 E5 license or related E5 add-on subscription
What are some limitations of using Microsoft Purview for eDiscovery?
Purview gives stakeholders the power to perform eDiscovery queries and gather necessary ESI for legal and compliance investigations. However, Purview’s complexity and lack of transparency may cause frustration for some users.
For a comprehensive investigation, not only is an eDiscovery Premium subscription required, but each custodian involved must have an E5 license. Additionally, Microsoft charges processing fees to run the search and a storage fee for the data when the search returns results. Depending on the number of custodians and length of investigation, plus the number of touch points for each custodian, it could be terabytes of relevant information to store.
Download the checklist to secure your collaboration tools now
Although Purview is capable of running large-scale searches, it only collects data for an index when the search is initiated. It doesn’t ingest data in real-time. As a result, Purview may require days to complete an eDiscovery query, especially if the request is particularly large or complex.
Purview is also limited to searching only across the Microsoft 365 suite of programs. For a company that may also use popular productivity and collaboration tools like Zoom, Google Drive, and Slack, Purview’s eDiscovery solution cannot comprehensively search all their ESI.
Searches within Purview are also limited by the number of custodians, topics, and size they can process, requiring multiple runs and queries to build the necessary eDiscovery data sets. Search parameters have to be queried one at a time and then blended together. This lack of granular customization for complex eDiscovery workflows limits analytics capability as well.
Case study: This nonprofit used Aware's eDiscovery tools to avoid fines and penalties
Once the search is complete, Purview converts all data types into MS Outlook file formats for storage, which may complicate the search and management of the data set. It also limits export content capabilities, since exports can’t be made directly from the search.
Perhaps one of the biggest limitations is that Purview does not allow for role-based access controls and data visibility, reducing who can manage the data sets and work with the results. During indexing, when large amounts of metadata are collected and visible within the ESI, this problem is magnified.
Whitepaper: Aligning Legal & IT on collaboration tool data
Integrate Aware with Office 365 for more powerful eDiscovery
Purview is a powerful eDiscovery tool for Microsoft Office 365, but there are gaps in its capabilities that make it harder to quickly get to data and export it into existing workflows. The Aware platform complements Purview by filling those gaps to strengthen your risk posture within Microsoft collaboration tools.
Aware connects to Microsoft via native APIs and continuously ingests data in real time, creating a search-ready archive that saves legal teams time otherwise lost in indexing data prior to search, and delivers results in user-friendly formats protected by robust, enterprise-grade security.
- Get the results you need in minutes, not days.
- Easily create an immutable archive of all data with one-click legal holds.
- Use Aware’s proprietary NLP and AI-ML models to surface more results with fewer false positives than the leading competitors.
- Secure your data with RBAC and comprehensive audit logs.
- Return a user-friendly format that’s easily exported to third-party tools like Relativity.
With Aware, legal teams have the ability to perform full forensic searches and surface results—including deletions and edits—in their complete context, simplifying and accelerating eDiscovery in complex data sets. Contact us today to learn how Aware supports your eDiscovery needs across all your collaboration tools.
