The Good, The Bad and The Way Forward: What You Need to Know About eDiscovery with Microsoft 365

With so much enterprise data moving to the cloud in recent years, it has become easier to move eDiscovery processes further to the left of the EDRM model – to the point that it’s becoming more common to apply analytics and searching where the data lives. Given the enormous growth of data in the world – from 2 zettabytes in 2010 to 120 zettabytes today – it has become imperative for organizations to perform early data assessment for eDiscovery at the source to effectively manage timelines and (even more importantly) costs.

Perhaps the enterprise solution that best illustrates the huge move to the cloud today is Microsoft 365. Microsoft has not only moved its long popular Office apps (like Word, Excel, PowerPoint and Outlook) into the cloud, but M365 also includes apps like SharePoint and OneDrive for document management and Teams for collaboration and web meetings. It even provides data governance and eDiscovery capabilities through Microsoft Purview! M365 more than doubled their users between 2018 and 2022 and has over 345 million users today!

With so many organizations using M365, should you use it as your eDiscovery platform? Here’s what you need to know about M365’s eDiscovery capabilities and limitations to decide whether it’s right for you.

Microsoft Purview and eDiscovery

Microsoft Purview is a unified data governance solution to help manage and govern your organization’s data. Purview is a rebranding of what was formerly known as the Azure Purview and Microsoft 365 compliance solutions.

Purview also provides three eDiscovery solutions which have been rebranded as well:

• Content search: Enables you to search for content across M365 data sources and export the search results.

• eDiscovery (Standard): Formerly known as Core eDiscovery (or E3), it builds on the basic search and export functionality of Content search by enabling you to create eDiscovery cases and assign eDiscovery managers to specific cases.

• eDiscovery (Premium): Formerly known as Advanced eDiscovery (or E5), it builds on the existing case management, preservation, search, and export capabilities in eDiscovery (Standard), by providing an end-to-end workflow to identify, preserve, collect, review, analyze, and export potentially responsive content.

While all three solutions have basic capabilities, customers have become accustomed to a mature set of eDiscovery capabilities – including custodian management, legal hold notifications, advanced indexing, analytics, Optical Character Recognition (OCR), predictive coding models and more – that you would expect in an eDiscovery solution designed to support most cases.

Purview eDiscovery Limitations and Challenges

Still, if you’re using the Purview for eDiscovery, you have what you need, right? Not necessarily. There are several limitations you need to be aware of when it comes to using Purview that can impact your eDiscovery workflows:

Indexing Issues

I could stop right here. There are some files that Purview simply doesn’t index, such as files that are too large and files with too many attachments. Purview will also only parse and index the first 2 million characters of any document. If it’s not indexed, it’s not retrievable in a search, which means you could miss something important for your case.

Slow to Index and Search

Among other limitations, it's also slow to index and search. The maximum advanced indexing throughput is 2GB per hour! Searches slow down quickly as well – a search of 100 mailboxes takes an average of 30 seconds, while a search of 10,000 mailboxes takes 4 minutes per search. A large organization with 100,000 mailboxes? 25 minutes – per search.

Exporting Search Results is Slow

M365 is known to throttle the export of data to load balance environments, which can slow your exports down considerably. What does Microsoft say about that? Assuming your search has no errors, their troubleshooting guide says to “consider dividing searches that return a large set of results into smaller searches”. That may not be helpful when you have a deadline to meet.

Limited File Type Support

Purview also only supports 63 file types. While that might seem like a lot, it’s not – especially when you get beyond Microsoft solutions.

No In-Place Review and Analytics

Finally, you can’t conduct in-place review and analytics with Purview – you must copy the data into a case first, which can take hours. So much for the benefit of assessing the data in place!

Conclusion

So, how can you perform early data assessment for eDiscovery at the source for M365 data given the limitations of Microsoft’s eDiscovery module? Use a platform that was truly built for eDiscovery that indexes M365 data more comprehensively, enables you to search the data and export search results more quickly, support a much larger range of file types, and doesn’t make you wait to copy the data into a case to analyze it.

M365 is a terrific enterprise solution, it provides apps to support a variety of needs and its popularity is undeniable. But you should consider and evaluate its eDiscovery limitations before you proceed to invest in Purview for your eDiscovery solution. The good news is that you can “have your cake and eat it too”: capturing M365 enterprise office, communication and collaboration capabilities AND a terrific eDiscovery solution that supports your ability to target early data assessment for eDiscovery at the source – with Veritas.

Veritas Alta™ eDiscovery is a powerful, integrated, cloud-based solution that enables organizations to easily collect, review, and produce electronically stored information for legal and investigation needs. It’s a higher level of performance and efficiency that gives compliance professionals greater peace of mind.

Learn more about how this one-step cloud-based solution can support your M365 eDiscovery needs. Visit Veritas Alta eDiscovery to learn more.