eDiscovery Basics

Lesson: eDiscovery Basics in Microsoft 365

Introduction: Why eDiscovery Matters in the Modern Workplace

In the digital era, organizations generate vast amounts of data daily across email, chat platforms, document libraries, and cloud storage. When legal disputes, internal investigations, or regulatory audits arise, the ability to find, preserve, and review this data is not just a technical necessity; it is a fundamental business requirement. Electronic Discovery, or eDiscovery, is the process of identifying, collecting, and producing electronically stored information (ESI) in response to a request for production in a lawsuit or investigation.

Without a structured approach to eDiscovery, organizations risk severe financial penalties, reputational damage, and the inability to defend themselves effectively in court. Microsoft 365 provides a built-in suite of tools designed to manage this lifecycle. By leveraging these native capabilities, administrators and legal teams can ensure that data remains intact, searchable, and compliant with legal requirements without having to move sensitive information to third-party platforms.

This lesson explores how Microsoft 365 handles the eDiscovery lifecycle, from the initial identification of data sources to the final export of findings. We will break down the core components, provide practical workflows, and discuss the best practices necessary to maintain defensibility throughout the process.

The eDiscovery Lifecycle in Microsoft 365

The eDiscovery process is generally divided into several distinct phases. Understanding these phases is crucial because each one requires specific tools and permissions within the Microsoft Purview compliance portal.

1. Identification: Determining which users, mailboxes, and sites contain information relevant to a specific case.
2. Preservation (Legal Hold): Ensuring that data is not deleted or altered, even if the user attempts to delete it or if automated retention policies would normally remove it.
3. Collection: Gathering the identified data into a central location for review.
4. Processing: Extracting metadata, indexing the content, and preparing it for search and analysis.
5. Review and Analysis: Examining the collected data to determine relevance, privilege, or sensitivity.
6. Production: Exporting the relevant documents in a format suitable for legal counsel or regulatory bodies.

In Microsoft 365, we manage these phases primarily through the Microsoft Purview eDiscovery (Standard) and Microsoft Purview eDiscovery (Premium) solutions.

Callout: Standard vs. Premium eDiscovery While both tools help you find and preserve data, the distinction lies in depth and complexity. eDiscovery (Standard) provides basic search, hold, and export capabilities. eDiscovery (Premium) introduces advanced features like machine learning-based document review, predictive coding, deep indexing, and the ability to manage the entire legal workflow including custodian notifications and legal holds in a more automated fashion. Most large-scale enterprise investigations rely on the Premium features to handle the sheer volume of modern data.

Setting Up eDiscovery Permissions

Before you can perform any eDiscovery tasks, you must ensure that the appropriate users have the necessary permissions. In Microsoft 365, access is governed by Role-Based Access Control (RBAC).

The eDiscovery Manager Role Group

To manage cases, you must be a member of the eDiscovery Manager role group. There are two levels within this group:

• eDiscovery Manager: Can create and manage cases, add members, and perform searches, but can only see the cases they have created or are explicitly added to.
• eDiscovery Administrator: Has full access to all cases created in the organization. They can see all content, manage all cases, and perform administrative functions.

Step-by-Step: Assigning eDiscovery Roles

1. Navigate to the Microsoft Purview compliance portal.
2. In the left navigation pane, select Permissions.
3. Under Microsoft Purview solutions, select Roles.
4. Search for and select the eDiscovery Manager role group.
5. Click Edit to modify the members.
6. Add the users or groups that require access and save your changes.

Warning: Be extremely cautious when assigning the eDiscovery Administrator role. Because this role allows a user to search and export any data in the organization, it carries significant privacy implications. Always adhere to the principle of least privilege.

Identification and Preservation: The Legal Hold

The legal hold is perhaps the most important part of the eDiscovery process. When a legal department notifies the IT department of a pending litigation, the organization is under a "duty to preserve." If data is deleted—even by accident or through standard automated lifecycle policies—the organization may face charges of "spoliation of evidence."

Creating a Case

A case acts as a container for all your investigative activities. It keeps your holds, searches, and exports organized.

1. Go to eDiscovery > Premium (or Standard) in the compliance portal.
2. Click Create a case.
3. Provide a meaningful name and description (e.g., "Project X Intellectual Property Dispute").
4. Once created, open the case to start adding sources and holds.

Applying a Hold

A hold ensures that the content remains in the system regardless of what the end-user does. When a hold is applied, the content is moved to a hidden area of the mailbox or site called the "Recoverable Items" folder if it is modified or deleted.

• Mailbox Hold: Preserves emails, calendar items, and tasks.
• Site Hold: Preserves documents in SharePoint and OneDrive for Business.
• Teams Hold: Preserves chat messages and channel posts (which are stored in the user's mailbox or a group mailbox).

Tip: You can apply holds to specific custodians (individuals) or to entire SharePoint sites. If you are unsure of the scope, it is often safer to place a hold on the entire mailbox or site, provided that it does not violate internal privacy policies or regulatory constraints.

Advanced Collection and Search Queries

Once a hold is in place, you need to find the relevant information. This is where Keyword Query Language (KQL) becomes essential. KQL allows you to construct precise searches to narrow down millions of items to the few that actually matter.

Understanding KQL Basics

KQL uses properties and operators to filter content. For example, if you want to find emails from a specific person regarding a specific project, you would use: From:jdoe@contoso.com AND Subject:"Project Alpha"

Common KQL Properties:

• From: The sender of the email.
• To: The recipient of the email.
• Subject: Keywords in the subject line.
• HasAttachment:true: Filters for items that contain files.
• Created:2023-01-01..2023-12-31: Searches for items created within a specific date range.

Practical Example: Searching Teams Chats

Teams chats are stored in the "Conversation History" folder of a user's mailbox. If you are searching for a specific conversation, you must target the correct location.

// Example: Searching for a specific keyword in Teams chats
ItemClass:IPM.Note.Microsoft.Teams.Chat AND Subject:"confidential"

Note: When using KQL, remember that searches are not case-sensitive, but the operators (AND, OR, NOT) must be capitalized. If you do not capitalize them, the system will treat them as regular words rather than logical operators.

Processing and Reviewing Data

After collecting the data, you need to make it readable and searchable for the legal team. In eDiscovery Premium, the system performs "deep indexing," which extracts text from files (like PDFs or Word documents) even if they are embedded in other files.

The Review Set

A Review Set is a static, isolated location where you can analyze data. You do not search the live environment here; you search the copy you have collected. This is critical for maintaining the integrity of the original data.

1. Add to Review Set: Once your search results are finalized, click "Add to Review Set."
2. Analytics: Use the built-in analytics tools to group similar documents, identify "near-duplicates," and detect "threading" (where the system identifies the full chain of an email conversation, including all replies and forwards).
3. Tagging: You can create custom tags like "Responsive," "Privileged," or "Non-Responsive" to organize documents during the review process.

Predictive Coding

In large cases with thousands of documents, manual review is impossible. Predictive coding allows you to "train" the system. You tag a small sample of documents, and the model learns what constitutes a "relevant" document based on your tags. The system then assigns a relevance score to the rest of the documents, helping you prioritize what to review first.

Best Practices for eDiscovery

Maintaining defensibility is the ultimate goal of any eDiscovery process. If your process is challenged in court, you must be able to prove that the data was not tampered with and that the search was thorough.

1. Document the Workflow

Keep a log of who created the case, what search queries were run, and who performed the exports. Microsoft 365 provides an "Audit Log" that tracks these actions automatically. Ensure that these logs are preserved and accessible.

2. Use Scoped Searches

Avoid running "search all" queries on the entire organization. This can lead to massive amounts of irrelevant data (noise), which increases the cost of review and the risk of accidentally exposing sensitive information that should not have been collected.

3. Regularly Test Your Holds

Do not assume a hold is working. Periodically verify that items deleted by users are actually moving to the Recoverable Items folder and remain available for discovery.

4. Manage Custodianships

Clearly define who the "custodians" are—the people who possess the relevant information. In eDiscovery Premium, use the "Custodian" management tool to track their devices and mailboxes centrally.

5. Be Mindful of Data Privacy

In some jurisdictions (like those governed by GDPR), you may be prohibited from collecting certain types of personal data. Always consult with your legal and privacy teams before initiating a broad collection exercise.

Common Pitfalls and How to Avoid Them

Even with the best tools, mistakes happen. Here are common pitfalls that administrators often encounter during eDiscovery exercises.

Pitfall 1: Failure to Index

The Issue: Sometimes, a search returns zero results, even when you know the data exists. This is often due to an indexing delay or a corrupted index. The Fix: Check the "Indexing" status in the compliance portal. If items are failing to index, you may need to trigger a re-indexing of the mailbox or site.

Pitfall 2: Over-reliance on Keywords

The Issue: Using too many keywords can lead to "over-inclusion," where you collect terabytes of irrelevant data. The Fix: Start with a broad search to understand the volume, then refine using date ranges, specific sender/recipient filters, and proximity operators (e.g., NEAR or W/n).

Pitfall 3: Not Handling Teams Data Correctly

The Issue: Users often think Teams messages are just emails. They are not. The Fix: Ensure your search scope includes the "Teams Chat" location and that you understand the difference between 1:1 chats and channel messages. Channel messages are stored in a group mailbox, while 1:1 chats are stored in the individual user mailboxes.

Pitfall 4: Ignoring Metadata

The Issue: Reviewing only the text of a document while ignoring its metadata (creation date, author, last modified date). The Fix: During the export process, ensure you include the metadata load file. This is often required by courts to prove the authenticity of the documents.

Comparison: eDiscovery Standard vs. Premium Features

Step-by-Step: Exporting Data for Production

Once the review is complete and you have identified the documents that need to be produced, you must export them from the Review Set.

1. Open the Review Set: Navigate to the specific case and open the Review Set containing your tagged documents.
2. Select Documents: Filter or select the documents you wish to export.
3. Click Export: Choose the export option.
4. Configure Export Settings:
   • Export reports: Choose whether to include load files (CSV/XML).
   • Structure: Choose whether to export as individual files or as a single PST/container.
   • Content: Select whether to include tags and metadata.
5. Download: Once the job finishes, use the eDiscovery Export Tool (a standalone application provided by Microsoft) to download the data to your local machine or a secure server.

Note: The export process can take a significant amount of time depending on the volume of data. Ensure you have adequate network bandwidth and storage space before initiating large-scale exports.

Frequently Asked Questions (FAQ)

Q: Does placing a hold on a user's mailbox affect their daily work? A: No. A legal hold is a background process. The user will not see any indication that their mailbox is on hold, and it does not limit their ability to send, receive, or delete items (though deleted items will be preserved in the background).

Q: Can I search for items in a user's archive mailbox? A: Yes. eDiscovery searches automatically include the user's primary mailbox and their archive mailbox.

Q: What happens if a user leaves the organization? A: If a user's account is deleted, their mailbox is also deleted. If that mailbox was on legal hold, the data is preserved for the duration of the hold. However, it is always best practice to convert the mailbox to an "Inactive Mailbox" before deleting the user account to ensure the data remains easily discoverable.

Q: How do I know if an item is a "near-duplicate"? A: In eDiscovery Premium, the Analytics tool identifies near-duplicates by comparing the text content of documents. If two documents have a high percentage of overlapping text (e.g., two versions of the same contract), the system groups them together.

Conclusion and Key Takeaways

The eDiscovery process in Microsoft 365 is a powerful, integrated solution that allows organizations to navigate the complexities of legal and regulatory compliance without the need for external data migration. By mastering the tools within the Microsoft Purview compliance portal, administrators can ensure that their organization is prepared for any eventuality.

Key Takeaways:

• Centralization: Microsoft 365 keeps data in place, reducing the risk of data loss or tampering that often occurs when moving files to third-party tools.
• The Power of Holds: Legal holds are your primary defense against spoliation. Always ensure holds are correctly applied to the relevant custodians and locations as soon as a duty to preserve arises.
• KQL Proficiency: Learning Keyword Query Language is essential for narrowing down massive data sets into actionable information.
• Use Premium for Scale: While Standard covers basic needs, eDiscovery Premium is necessary for large-scale investigations requiring AI, predictive coding, and advanced document analysis.
• Defensibility is Everything: Every step of the process—from the initial search to the final export—must be logged and documented. Always assume your process will be scrutinized in a court of law.
• Principle of Least Privilege: Only provide eDiscovery Manager roles to users who absolutely need them to perform their job functions to protect sensitive organizational data.
• Test and Verify: Never assume a hold is working; perform regular audits and tests to confirm that data is being preserved as expected.

By following these principles and utilizing the tools effectively, you can transform eDiscovery from a daunting, high-risk chore into a repeatable, defensible business process. As data volumes continue to grow, the ability to manage this lifecycle efficiently will become an even more critical asset for your organization.