M365

The Microsoft 365 Substrate is a core component of the Microsoft 365 platform, providing a unified data layer that enables compliance features across various services. It is important to understand the overall relationship between Entities, Apps, Services, Containers and the Objects that eDiscovery holds and requests target. Diagram by Tony Snover and good description of Substrate by Tony Redmond. Entities - Custodians in [...]

Overview The Microsoft 365 mailbox is the primary storage container for communication content generated in Outlook, Teams, Viva Engage (Yammer), Planner, Streams and other partner applications. It is the central repository where original or compliance copy emails, chat, calendar entries, tasks, and other communication related data are retained and managed. Microsoft consolidated all the visible and hidden communication information into a mailbox database [...]

SharePoint/Teams Components and Locations (Common eDiscovery targets - default content types) Documents/Files – multiple item types - Stand alone files are stored in the Document Libraries. Can get size/count for individual document libraries with this PowerBI method. Hidden/Alternative locations – Versions, Recoverable Items, held items Lists – Multiple Item types - Event, Link, Contact, Task, Announcement Pages - filetype:aspx Forms – Actual form [...]

This rough checklist is just a starting point and intended to support documentation, coordination and considerations relevant to Purview eDiscovery actions. Such a checklist can be created in your eDiscovery platform, a secured SharePoint site or any other appropriate platform. Every export should have a fully documented Chain-of-Custody form that ties to the decision history. Request Goal and matter factors Investigation – informal [...]

A Teams site and the underlying channels are owned by a M365 Group. Teams sites and channels are essentially an application layer on top of a SharePoint container and Exchange mailbox. The UI is focused on collaboration with much simpler security and the primary eDiscovery content is usually focused on chat messaging, meetings and integrated internal/external applications. The primary data sources (SharePoint and [...]

Many IT and legal executives ask their discovery teams, “Why not just use Microsoft?” After all, Microsoft 365 contains the vast majority of enterprise content and communications for large enterprise litigants. The acquisition-integration of Equivio gave Purview eDiscovery checked most of the functionality boxes, even if it was not designed for large scale, complex review. While many eDiscovery peers may disagree, I feel [...]

Purview eDiscovery partner enabled functionality: eDiscovery professionals who need to access, process and export ESI from Microsoft 365 from their favorite eDiscovery platform should understand the capabilities and limitations of the Graph eDiscovery API used by authorized third-party applications to connect to Microsoft Purview eDiscovery (Premium). This API integration or custom internal PowerShell driven applications can perform tasks such as creating cases, custodians, [...]

Introduction Copilot has roots in various Microsoft productivity applications that promised to keep workers on track with tasks, requests and events. Copilot is an AI assistant that uses public and private Large Language Models (LLMs) for generative search, predictive text, images and more. Users can draft/create documents and images within Word, PowerPoint, Loop and other M365 applications via prompts. M365 now logs these Copilot [...]

The table below is a cursory list of formal Microsoft Partners and products that have public M365 eDiscovery integrations based on quick searches. This list has NOT been vetted by the providers and is obviously incomplete. Close the left side navigation bar for readability and click the plus (+) sign to see the public source link and comments.  Please use the feedback form [...]

In-place legal holds can be placed in Purview eDiscovery (Standard E3 licence or Premium E5 license) using the normal Purview search scope criteria. These holds are actually preservation retention policies that control how targeted items act when changed or deleted. If effect, they save preservation copies in a hidden Recoverable Items folder within the mailbox or SharePoint/OneDrive container. These folders are indexed for [...]