X1 recently cherry picked a quote of mine in their blog, “Special Master Determines Microsoft Purview Does Not Comply With Frcp 26(G) Due To Unreliable And Incomplete Search Results” that is taken out of context and is misused to support an assertion that I do not agree with. Being quoted after an analyst briefing is generally a compliment and appreciated, but not when it is wrong.
The X1 quote attributed to me (although it links to another X1 blog):
“This is not the only instance of significant negative industry peer review of MS 365 Purview. The eDiscovery Journal also notes that Microsoft Purview “can struggle to meet the stringent eDiscovery/compliance requirements.” Specifically, the author determined that Microsoft Purview faces significant throughput limitations as documented by his own performance testing.”
My actual original comment in full context:
“Archiving and enterprise search products like Autonomy IDOL struggled to deliver a ‘universal index’ for decades. Cloud platforms like Microsoft 365 and Google Workspace provide content search across their primary cloud data sources via a variety of connectors and compliance copies behind the scenes. While these federation methods meet or exceed end user search requirements, they can struggle to meet the stringent eDiscovery/compliance requirements and may require premium licenses.”
I was drawing a contrast between the legacy systems that failed to deliver live enterprise search and modern cloud platforms that now provide near instantaneous end user search for their content. Anyone who recalls me railing against index lag measured in days-weeks should appreciate the engineering that now indexes new email and documents in minutes for search. EVERY search system has limitations and exceptions that may impact your recall relating to file type, size, encryption, language, etc. I pointed peers to Microsoft’s “Limits in eDiscovery (Premium)” because you need to understand your technology’s known limitations and perform acceptance testing on your own content prior to relying on it. This is forensics 101. My comment is NOT a ‘negative industry peer review of MS 365 Purview’. In my opinion EVERY enterprise cloud system was built for business consumer search and not designed for a mythical ‘perfect recall’ for eDiscovery.
Providers with eDiscovery Bugs….
I report a LOT of potential issues found in client validation testing. I have never conducted search testing on large scale enterprise unstructured content that did not find documented and new recall exceptions. Most exceptions relate to edge case scenarios or custom business practices/systems. Every enterprise environment and ESI composition is unique. Even the world’s largest software companies cannot anticipate and test every possible variation of ESI. If we all performed reasonable acceptance testing and reported the results our technology would improve. For too long, our eDiscovery providers hid software bugs behind the service veil and created an unrealistic customer expectation of ‘CSI perfection’. It is our responsibility to regularly test our systems and report errors so that our tech providers can address or document them for other customers. That should be part of your ‘reasonable reliance’ before certifying a complete document production.
I want to call attention to the phrase X1 dropped from my quote.
“…and may require premium licenses.”
Microsoft Purview currently provides three solutions for different eDiscovery scenarios. Many M365 customers use eDiscovery (Standard) to apply broad custodial holds and export those holds for their external eDiscovery platform. eDiscovery (Standard) requires the common E3 license for custodians whom are searched, held or exported. eDiscovery (Premium) adds ‘advanced indexing’ and other eDiscovery functionality for the premium E5 license. The important point here is that Microsoft has provided an internal eDiscovery platform to reprocess unindexed or partially indexed items in place for complex Boolean searches and selective refinement prior to export.
X1 ‘rephrasing’ my Purview performance comment:
“Specifically, the author determined that Microsoft Purview faces significant throughput limitations as documented by his own performance testing.”
My actual original comment in full context:
“Replicating the existing M365 search could be considered redundant. X1’s distributed index approach allows them to expand a user’s M365 sources to include desktops, fileshares and 3rd party content such as Dropbox. It offloads much of the processing overhead to endpoint devices and avoids some of Purview Premium’s throughput limits for larger custodial matters. Past Purview advanced indexing performance testing for eDJ corporate clients resulted in limiting SLA’s to 1-3 full custodians per day. Microsoft’s infrastructure is evolving at amazing speed, so expect continued feature and performance improvements.”
First, Microsoft documents the Purview eDiscovery’s throughput limits at the link I provided. I specifically called out the advanced indexing performance because it was the rate limiting step for larger matters. I also made sure to emphasize how fast the Microsoft infrastructure and functionality has been improving. Somehow all of that was lost in X1’s rush to make my client tenant performance testing apply to every Microsoft 365 tenant or tier. If I had conducted more formal performance testing across a diversity of customer tenants you can be sure I would have published my results after sharing them with Microsoft. The advanced indexing needs to be improved if it is intended to support short deadlines with typical 5-10 custodian matters. However, I am seeing corporate legal and IT teams push back on the traditional full custodial ‘pump and dump’ exports in favor of more selective holds and collections. Microsoft’s own legal team has long advocated a narrowly focused eDiscovery scope approach that does not require Purview to process large volumes.
In conclusion, I stand behind my original opinions. If you are going to quote or attribute opinions to me, please keep them in context and do me the courtesy of a review before publishing them. I do not have knowledge of the Deal Genius matter specifics, so I will leave Special Master Phillip Favro’s report conclusions alone for now.
Greg Buckles wants your feedback, questions or project inquiries at Greg@eDJGroupInc.com. Contact him directly for a free 15 minute ‘Good Karma’ call if he has availability. He solves problems and creates eDiscovery solutions for enterprise and law firm clients.
Greg’s blog perspectives are personal opinions and should not be interpreted as a professional judgment or advice. Greg is no longer a journalist and all perspectives are based on best public information. Blog content is neither approved nor reviewed by any providers prior to being published. Do you want to share your own perspective? Greg is looking for practical, professional informative perspectives free of marketing fluff, hidden agendas or personal/product bias. Outside blogs will clearly indicate the author, company and any relevant affiliations.
Greg’s latest nature, art and diving photographs on Instagram.
