Microsoft 365 eDiscovery Updates: Legal and Technical Developments

Jan 23 2023

eMerge attorneys and technologists recently presented a two-part webinar series on the legal and technical considerations for corporations using Microsoft 365 to satisfy their eDiscovery obligations.

• Click here to view the first session.
• Click here to view the second session.

Below are 10 key takeaways that will help your company effectively use Microsoft 365 for your eDiscovery needs.

1. Understand basic licensing options, including features and limitations.
   • Content Search – Search your organization for content in emails, documents, Teams conversations, and more. You can then preview and export the search results. Requires E1/G1/A1, Standard/Basic/Business Premium Subscription.
   • Standard – After creating an eDiscovery case and choosing who can access it, use the case to search for email, documents, Teams conversations, OneDrive and SharePoint data, and other content in your organization. You can then preserve the content and export the search results for further analysis. Requires E3/G3/A3, F5 Security/Compliance Add-on, or Exchange/SharePoint Online Plan 2 Subscription.
   • Premium – Includes all of the features in Standard with additional functionality, such as custodian management, legal hold notifications, advanced indexing, review set filtering, tagging, and analytics. An end-to-end workflow to preserve, collect, review, analyze, and export content responsive to your organization’s internal and external investigations. Requires E5/G5/A5, F5 Security/Compliance Add-on, or E3 + E5 Compliance/eDiscovery and Audit/Security Add-on Subscription.
   • User Data Search – Manage GDPR/CCPA data subject requests (DSR) with the UDS case tool in the Microsoft Purview compliance portal. eMerge would not ordinarily use the UDS tool to collect data, but it is a method for identifying and exporting user specific data. Runs within eDiscovery and has the same minimum subscription requirements as eDiscovery Standard.
2. Knowing where your data resides is essential when preserving or collecting data stored in multiple locations to ensure inclusion of relevant data in the process. If you are unsure where your data resides, you may preserve or collect irrelevant data, which can be costly in terms of storage and processing. It could also lead to a longer, more complicated review process. Moreover, if you fail to preserve or collect relevant data, you may be at risk of sanctions or penalties for spoliation of evidence and violating laws, regulations, or compliance requirements.
3. Migrate file server data to SharePoint carefully and check legal hold requirements. The migration of content from on-premises file servers to SharePoint can implicate ongoing legal hold requirements, particularly with respect to system metadata and folder organization, so IT should consult with the legal department on the disposition of legacy file servers post-migration and the scope of file transfers. Also, selective transfers and re-organization of materials can complicate collections of supplemental documents for existing matters.
4. Prevent burdensome “linked” document requirements from sneaking into your ESI protocol. Pay careful attention to any language in an ESI protocol that introduces potentially unduly burdensome requirements to locate, produce, and connect “linked” documents with an email, communication, or other document to which it is not physically embedded. Any requirements that remain should be circumscribed, as modern discovery collection and processing tools do not yet fully support these document links.
5. Refresh policies. The technologies used to create documents change constantly, as do the discovery tools that need to adapt with those changes. Key policies governing your organization, such as those concerning eDiscovery, document retention, data security, privacy, and template ESI protocols should periodically be revisited to ensure they reflect current usage patterns and the latest legal requirements.
6. Even with Purview eDiscovery Premium, Relativity and other eDiscovery review platforms are generally best equipped to perform the majority of any keyword filtering to ensure maximum effectiveness, reporting capability, and accuracy. Date and targeted folder filtering is the recommended extent of Microsoft 365-based filtering.
7. The estimated volumes reported by Purview eDiscovery Premium are consistently incorrect. For accurate estimates, it is best to rely on the actual exported volume.
8. RMS-protected documents will be automatically decrypted on export from Purview eDiscovery Premium. If you export as PST (instead of “individual messages), protected messages will automatically export as individual messages.
9. Utilize PowerShell cmdlets to perform various tasks and operations in Microsoft 365. Almost all functions controlled by the web interface can also be controlled by PowerShell cmdlets. PowerShell also offers unique functionality not possible in the web interface. For most work, using the web interface is preferred, but some scenarios demand a more flexible and robust scripting method, including:
   • Cross-Matter Hold Reports (and Matters without Holds) – It is possible to generate cross-matter reports (Standard and Premium) that outline ALL custodian holds across the tenant. Then, a simple sort in Excel will show all matters where a custodian is subject to a hold.
   • Custodian Hold Reports – create a report of all matters where a custodian is subject to a hold.
   • Mass/Bulk Litigation Holds – the web interface provides some limited functionality for applying holds to large numbers of custodians or sources, but PowerShell provides more advanced and complete options.
   • Revealing Folder Identifiers (names) for targeted collections – finding the names of user-created folders within Exchange, OneDrive, and SharePoint sites.
10. Please reach out to us for the latest guidance. eMerge’s attorneys and technologists are constantly monitoring Microsoft’s eDiscovery roadmap and documentation to ensure that our procedures and recommendations remain best in class. We work together to deliver strategic end-to-end eDiscovery and data management solutions for litigation, investigations, due diligence, and compliance matters. We help clients discover the information necessary to resolve disputes, respond to investigations, conduct due diligence, and comply with legal requirements.

To learn more about eMerge and how we can help your company, please click here. To be the first to know about eMerge’s upcoming webinars, please connect with us on LinkedIn and sign up for our latest insights.