Migrated from eDJGroupInc.com. Author: Greg Buckles. Published: 2012-10-16 08:55:11 Can you really place legal holds on email hosted in Microsoft’s Office 365 cloud offering? A recent request from a long time client made me think long and hard about this question. I will leave the many other questions to consider before migrating your data to the cloud for future articles so that we can laser focus on just email. Maybe your own company has retired your Exchange servers, you have clients on Office 365 or the other side uses the cloud service. The odds are good that some party within your dysfunctional eDiscovery family has entrusted their email to Microsoft’s cloud service. What’s that? You are not sure that you understand what Office 365 is? Okay, here’s the fast version. Traditional corporate email was managed from dedicated, single tenant servers located in-house or with a hosted facility. Small and mid-sized businesses began to use premium versions of Gmail, Yahoo! and other web-based email systems which pushed Microsoft to offer BPOS, Business Productivity Online Standard Suite, in 2008. This hosted offering was based on Exchange/SharePoint 2007 and was really designed to compete with in the SMB market, though I worked on several Fortune 100 companies who migrated to BPOS early on. Office 365 is based on the MS Office 2010 suite, which was specifically designed to support cloud delivery. This adds Lync messaging, Office Professional Plus applications and more to create a true cloud collaboration platform. Now that we have defined Office 365, let’s look at how it supports discovery and preservation in the cloud.The first thing to make clear is that Office 365 does not offer any new or expanded eDiscovery features over in-house Exchange 2010 servers. Last year we conducted a discovery functionality assessment of Exchange 2010 and detailed the testing process and results in a research paper. Despite concerns with relying on Exchange’s FAST search for eDiscovery, Exchange 2010 did introduce a powerful new set of administration features to preserve the content of user mailboxes without affecting the user experience. Essentially, an administrator can enable the ‘legal hold’ feature over an entire user’s mailbox from the Outlook Web Access interface while ‘Managing My Organization’. This changes how the Exchange ‘dumpster’ functions and essentially saves versions of deleted or altered email into a Recoverable Items folder that the user cannot access. A copy of the original message and all its MAPI properties are saved to the Versions subfolder in the Recoverable Items folder in a user’s mailbox. This happens when one of these properties is changed:
- Subject field
- Message body
- Attachments
- Senders and recipients
- Sent and received dates
If you are paying attention, that means that read/unread status, tags, flags and even folder location changes may not trigger a preservation copy. The legal hold function is only available on the Office 365 E2 or higher plan. This starts at $14/month, a 175% increase over the more typical E1 plan at $8/month. The good news about this feature is that it is relatively easy to apply through the web interface or the command line driven power shell interface. The power shell option should make it relatively easy for eDiscovery technologies to integrate functionality to place, remove or report on legal holds. Email saved in the Versions subfolder can be found and retrieved from Office 365’s Multi-Mailbox Search screen, but you can only specify user mailboxes as targets rather than more granular search on specific folders. If you want to retrieve all email from a specific folder, you are pretty much stuck with running a search without criteria on the entire mailbox and archive mailbox. The results are copied to a ‘Discovery Mailbox’ and the folder structure will be reconstructed as long as you did not try to deduplicate the email results.While the legal hold feature in Exchange 2010 and Office 365 may suffice for a large number of civil litigation preservation scenarios, it may not suffice for some regulated corporations or for any who have concerns about potential criminal investigations such as the Foreign Corrupt Practices Act (FCPA). The early materials on Exchange 2013 indicate that they have been working hard to address many of these issues. They will now support ‘In-place holds’ and item preview on search results without having to make full copies in a system that broke single instance storage. Will Office 365 customers automatically upgrade to this new functionality? Microsoft’s track record here is mixed. There is a migration path from BPOS (Exchange 2007) to Office 365 (Exchange 2010), but not an upgrade path. Will Microsoft have an in-place upgrade option for Office 365? These are questions that a large enterprise or global corporation should ask before launching their vital communications into the Cloud. The discovery features and legal hold in Office 365 is an immature solution that may meet the needs of SMB customers or the rare company that has a very limited litigation profile. It would be very labor intensive and challenging to manage multiple or selective holds within a typical corporation. I hope that this has given you some insight into how holds can be applied within Office 365 today. I am eager to try out the new features in Exchange 2013 and will bring you my test results. Have you already been playing with the beta release? Shoot me a note and let me know what you think of it at Greg@eDJGroupInc.com.eDiscoveryJournal Contributor – Greg Buckles