eDiscovery in Microsoft Teams: Everything You Need to Know

Microsoft Teams is a collaboration platform trusted by companies across the globe, providing business solutions and communications capabilities to 270 million active users every day. The ability to perform eDiscovery tasks in Teams is essential for responding to legal discovery requests and internal investigations. This article explains everything you need to know about eDiscovery for Microsoft Teams.

Contents

• Understanding Microsoft Teams
• What is eDiscovery in Microsoft Teams?
• How does Microsoft store Teams data?
• How is data retained in Microsoft Teams?
• Can you search for Teams data with Microsoft’s eDiscovery tools?
• What eDiscovery features are available for Microsoft Teams?
  • Content Search
  • Core eDiscovery
  • Advanced eDiscovery
• How does eDiscovery differ across private and shared channels?
• How do you collect and export Teams data?
• What are the limitations of Microsoft Teams eDiscovery?
• Aware—a modern eDiscovery solution for Microsoft Teams

Understanding Microsoft Teams

Microsoft Teams is a centralized cloud-based collaboration program built for communication, collaboration, and file sharing that integrates well with other Microsoft productivity tools. It’s one of the strongest business tools on the market, used worldwide to keep companies moving.

Teams brings employees together in the following ways:

• Communications and collaboration—Group messages filter chats topic, project, or team, and Teams users can share files from other Office 365 apps like Word, Excel, PowerPoint, and SharePoint.
• Meetings and calling—Video conferencing connects up to 1000 participants in a single meeting, depending on business account. Teams meetings connect through a channel’s calendar, and Teams supports audio and video, so calls can be made directly from the app.
• Security and governance—With enterprise-grade security features like two-factor authentication, encryption at rest and in transit, and standards compliance, plus guest access controls and data storage in the Microsoft 365 cloud, Teams is secure and searchable for eDiscovery investigations and regulatory compliance requirements.
• Integrations and customization—Teams integrates with a range of third-party apps and services for custom app development. Users can access familiar Microsoft apps like Outlook, Word, Excel, and PowerPoint through Teams, or customize with other integrations to streamline workflows and automate tasks.

Information governance checklist for collaboration

Download Now

What is eDiscovery in Microsoft Teams?

eDiscovery, or electronic discovery, is the identification, preservation, collection, and presentation of electronically stored information (ESI) for litigation, regulatory compliance, or other types of investigations.

The purpose of eDiscovery in Microsoft Teams is to meet legal or regulatory compliance requirements by having the capability to search and store ESI from chat messages, file sharing, and meeting recordings from across Teams and associated apps like Exchange Online, SharePoint Online, and OneDrive for Business. This is usually accomplished through Microsoft Purview, Microsoft’s comprehensive eDiscovery solution.

Part of this process is placing legal holds on data sources from Teams to prevent deletion or modification throughout the eDiscovery process. Potentially relevant data is safeguarded by legal holds for review and presentation during legal proceedings.

Within Microsoft Purview, the Content Search and Core eDiscovery features make it possible to search and collect data from distinct Teams locations, including user mailboxes, group mailboxes, SharePoint sites, and OneDrive accounts.

Then, with features like conversation threading, deep indexing, and redaction capabilities, Advanced eDiscovery can take legal review even further. When necessary, Teams data can be exported into a reviewable format and analyzed for eDiscovery litigation or investigation.

See how Aware integrates with Microsoft Teams for more complete eDiscovery.

How does Microsoft store Teams data?

Teams uses Azure Storage services like Exchange Online, SharePoint Online, OneDrive for Business, and Azure Blob Storage to store different types of data generated by the Teams platform.

Teams adopts Azure’s scalability, security, and compliance features to its greatest advantage. The following table demonstrates the data types in Teams and their corresponding storage locations:

Azure’s robust storage capabilities ensure data is stored efficiently and securely with built-in compliance, eDiscovery, and information governance capabilities.

Align Legal and IT on information governance

Learn More

How is data retained in Microsoft Teams?

There are three distinct retention policy settings for private chats, group chats, one-on-one chats, and channel messages in Teams.

Retain Only allows organizations to keep chat and channel messages indefinitely. The messages are available for eDiscovery searches and legal holds. Users can still edit or delete their messages, but copies of the originals are retained for compliance and eDiscovery purposes.

Retain and Delete allows companies to retain chat and channel messages for a specified period of time to comply with compliance requirements or internal need. As with Retain Only, the data is available for eDiscovery searches and legal holds, and while users can still edit or delete their own messages, copies are preserved for compliance.

Delete Only allows the earmarking of chat and channel records for deletion. No retention period is required to be set, and messages are not preserved for legal holds or eDiscovery searches. Once the deletion period specified is reached, messages are removed from the custodians’ view in the Teams app.

These retention settings can be customized to target specific users or teams within the Teams app, or throughout the whole organization. If one team requires different retention periods than others for compliance reasons, the longer retention period is set first. Then the wider organization retention parameter is set.

The retention period starts from the time a message is created, and subsequent replies do not reset the timer. By configuring the appropriate retention policy setting, organizations can balance compliance, data governance, and storage resources for chat and channel data with enabling legal teams to perform necessary eDiscovery investigations.

Expand your records retention capabilities in Microsoft Teams with Aware.

Can you search for Teams data with Microsoft’s eDiscovery tools?

While some Teams data is searchable with Microsoft’s eDiscovery tools, there are gaps in what is discoverable.

What is easily discoverable includes:

• 1:1 or group chat messages (from custodians’ mailboxes)
• Standard channel messages (stored in group mailboxes representing the team)
• Files shared in Teams channels (stored in SharePoint Online and OneDrive for Business)
• Meeting recordings (likely stored in Azure Blob Storage)
• Meeting transcripts (stored in Exchange Online mailboxes)
• Meeting whiteboards (stored in SharePoint Online)

What is not easily discoverable includes:

• Real-time audio/video streams during meetings
• Screen sharing activities
• Whiteboard annotations made during meetings
• Public Teams when attempting to join them through eDiscovery

Most core Teams data is discoverable through Microsoft Purview eDiscovery tools, but organizations should be aware of the gaps in data.

Learn more about Aware’s eDiscovery capabilities for collaboration tools.

What eDiscovery features are available for Microsoft Teams?

Office 365 has different eDiscovery workflow capabilities depending on the subscription and licensing plan organizations choose. Here are the key features available for eDiscovery with Microsoft Teams.

Content Search

• Available in Microsoft 365 with Enterprise 3 licensing and higher
• Search Teams data across Exchange Online, SharePoint Online, and OneDrive for Business, including messages, files, and recordings
• Supports basic keyword searches and filters like data range and file type
• Previews and exports search results to PST files and other formats

Core eDiscovery

• Available in Microsoft 365 with E3 licensing and higher
• Provides case management framework for eDiscovery
• Create cases, place legal holds, and search Teams data
• Supports more advanced search queries and conditions compared to Content Search
• Export search results for review and analysis

Advanced eDiscovery

• Available with Microsoft 365 E5 or as an add-on to E3
• Advanced eDiscovery capabilities for Teams data
• Conversation threading for Teams chat data
• Deep indexing of Teams files and attachments
• Automated redaction and annotation tools
• Advanced analytics and machine learning for data culling
• Custodian communication tracking and visualization

Webinar: Legal ops checklist for collaboration security

Watch Now

How does eDiscovery differ across private and shared channels?

eDiscovery is handled differently between private channels and shared channels in Microsoft Teams.

Within private channels, compliance copies of messages are sent to the mailboxes of all members. In shared and public channels, compliance copies of messages are sent to a system mailbox associated with the admins or parent team.

To perform eDiscovery on a private channel, the following locations should be included:

• SharePoint sites (for files, conversations about documents, list items, and pages)
• Exchange mailbox for each custodian

Legal holds can be placed on the SharePoint site, and on messages in user mailboxes to preserve content.

To perform eDiscovery on a public channel, the following locations should be selected:

• SharePoint sites (for files, conversations about documents, lists, and pages)
• Exchange Group mailbox for the Teams mailbox (includes all shared channel conversations)

Legal holds can be placed on the Group mailbox and the Team’s SharePoint site to preserve content.

How do you collect and export Teams data?

Microsoft Purview is Microsoft’s native tool for collecting and exporting data from Microsoft Teams. There are a few ways in which data from chats and channels can be searched.

Create an eDiscovery Case

In the Purview compliance portal, navigate to eDiscovery and click “Create a case.” Then create a case name according to your company’s naming conventions, add a description, and choose your custodians.

Place a legal hold

In the Purview compliance portal, navigate to eDiscovery and find the applicable case for the legal hold.

Within the case, select “Create hold.” Choose the hold type (e.g. litigation, eDiscovery, etc.), and then select Teams for the data location. Next, specify the date range and, if applicable, the duration of the hold. Leave the duration blank to create indefinite holds.

Configure the hold settings by choosing whether to include Teams chat data. You may also include other Office 365 applications in the hold, such as SharePoint sites, Exchange mailboxes, and OneDrive accounts, but for Teams-specific holds, limit it to chat and channel data. You may also exclude specific data here.

Review and create the hold.

Preview and export the data

It’s advisable to preview the search results to verify they’re relevant to your eDiscovery investigation before exporting for legal review and presentation. The Purview interface offers preview, filtering, and sorting options that can be performed before exporting takes place.

Once the search results are refined, choose your preferred format (PST, ZIP, etc.) and click “Export.” The data will be exported for download.

Searching Teams data

There are two ways to search Teams data for review before exporting the final results of an eDiscovery investigation.

1. By custodian or location
2. Using queries and conditions

To search by custodian or location within Teams, select specific custodians or content locations, including mailboxes, SharePoint sites, and OneDrive accounts.

For queries and conditions, search using keywords for specific terms or phrases. You’ll need to apply parameters around the search, like date ranges, file types, or message types (e.g. kind:im for chat messages). For Teams chat data, use kind:im AND kind:microsoftteams.

Improve your eDiscovery capabilities in Microsoft Teams with Aware.

What are the limitations of Microsoft Teams eDiscovery?

While Microsoft Teams eDiscovery has many features companies need to conduct investigations, some functionality gaps cause its users frustration and leave holes in the eDiscovery datasets.

These limitations may include:

• Lack of discoverability among Teams content types, (audio recordings, code snippets).
• Reduced search capabilities that return only partial data, since Office 365 stores Teams data in different locations according to data type.
• Microsoft’s eDiscovery tools do not work with data stored in third-party applications. For example, external meeting content cannot be archived.
• Some eDiscovery features require Microsoft PowerShell, a cross-platform task automation and management tool, which can be difficult to use. In some cases, additional expertise is required for a more comprehensive collection.
• Exported data is unstructured, which may frustrate users who require the datasets to be exported into Relativity for litigation proceedings.
• eDiscovery searches in Microsoft Teams with Purview can only be performed on a single attribute at a time, so datasets that require multiple parameters must be built search by search.
• Teams eDiscovery does not capture emoji reactions in chat conversations and channels, which can scrub context from the conversations in the datasets.
• Once a search is complete, Purview exports datasets into a MS Outlook format, which can complicate management and review of the dataset in its final presentation.
• Purview does not allow for role-based access controls (RBAC), which limits the users allowed to review the datasets in an eDiscovery investigation to those with the greatest information clearance.

Aware—a modern eDiscovery solution for Microsoft Teams

The Aware platform gives legal teams the flexibility to perform full federated searches and surface results complete with context in Teams chats and channels. Organizations use Aware to strengthen their risk position and solidify their information governance and compliance posture in Microsoft Teams.

With Aware, companies using Microsoft Teams can:

• Place one-click legal holds
• Conduct investigations that are supported by contextual results, including emojis, with all the information in one place
• Reduce search time with real-time data ingestion—searches take minutes rather than hours or days
• Reduce false positives with Aware’s industry-leading natural language processing (NLP) and machine learning AI-powered search filters
• Export to user-friendly formats compatible with existing workflows and third-party eDiscovery solutions such as Relativity
• Set up role-based access controls (RBAC) and manage visibility so users with the right permissions can review datasets.

With customizable searches by custodian, keyword, data channel, file type, and more, legal teams can surface more contextualized and fully discoverable datasets from Microsoft Teams conversations with Aware. Contact us today to learn how Aware can fulfill your organization’s eDiscovery needs across Teams and other collaboration tools.

Learn more about Aware for Teams