Office 365 Partner Community: focus on Security and Compliance – eDiscovery


by Michael Panciroli
US Partner Technology Strategist for Office 365

The Office 365 Partner Community is led by National Partner Technology Strategists from the Microsoft US Partner Team. Partner Community activities include blog posts, discussions on Yammer, newsletters, and community calls.

This is part 3 of our series about security and compliance in Office 365. You can read part 1 here and part 2 here.

eDiscovery in Office 365

eDiscovery is the process of finding, identifying, locating, preserving, retrieving and reviewing potentially relevant electronically stored information (ESI) in designated computer systems. To help understand the need for good eDiscovery tools, consider that 90% of US corporations are currently engaged in litigation right now. Companies with a valuation of over $1B are, on average, involved in 147 active lawsuits simultaneously.

These statistics are sobering—and so are the associated costs. The costs to find, review, and produce evidence related to a specific suit average one million dollars. This is a huge cost center so the return on investment is high. You will find that companies are usually eager to learn about how Office 365 can reduce both their exposure to risk and their costs. 

The eDiscovery process

In the eDiscovery process, a company will minimize the volume of the data to produce evidence that is increasingly relevant to a case. In the end, the goal is to produce data that is relevant, but does not expose any more information than needed, limiting exposure.

Here are the stages of eDiscovery, and details about what takes place in each stage:


Identify and Preserve

In this stage, a data custodian determines the resources, data locations, and scopes that may or may not be relevant to a case. Examples include specific SharePoint sites, file shares, users, and mailboxes. This stage is very important and can be a big challenge for many customers. Hefty fines are common for organizations that fail to include all of the related data stores. When complete, the Identify and Preserve stage determines what is the upper bound of information that might be included in a given case.

Search and Process

This stage is critical for reducing the cost of investigations, as it helps pare down the volume of data before attorneys get involved in the next phase—Review. During Review, an organization pays attorneys to look through all the identified data. Costs range from $10–$40K per gigabyte. To put things in perspective, just processing the data on your smartphone could cost $320K without filtering it. 100 gigabytes could cost an organization $1M.


The resulting dataset is typically exported and reviewed by outside council. The Office 365 pipeline and tooling ends at the Review stage.


In this stage, the final deliverable is the remaining set of documents that are deemed to be relevant. They are rendered in such a way that they are presentable in court.

Advantages of Office 365 eDiscovery

Office 365 offers unique capabilities that address these challenges and help your customers save time and money, and reduce their risk.


Quick investigation / Early case assessment

Office 365 provides a single location to be able to search and discover content in Exchange, SharePoint, and Lync. Machine tools and intelligent queries help pare the datasets down to the most relevant information to save clients money in the review. When a document is modified, or an email is sent, it almost immediately becomes discoverable by the continuously updated search index.

If your customer is involved in a lawsuit they might not know how much content they will be sending off to review. Without this real-time capability it can take days to weeks to determine if they will have a few gigabytes or a hundred gigabytes of data, and the difference can be a huge, unexpected cost. Attorneys may even use this information to decide to settle the lawsuit because the cost of investigating the volume or data may not be worth it.

The Office 365 tools are powerful, with a rich query syntax that includes proximity search, where you can issue queries like, “find me data that includes the company ‘Northwind Traders’ within 30 words of ‘merger’.” The results are presented include statistics that help you analyze and see the data’s source as well as how each search term affects your results. This is significant, as sometimes attorneys will negotiate these search terms, and they can see those resulting differences in real-time.


In-Place Hold

Another key advantage is in-place hold. Holds are used to ensure mail items (including calendar and tasks), SharePoint files, and Lync conversations are captured and retained for a defined period of time, even if a user attempts to delete or even purge it from the container. Without holds in place, the only way to make sure data are not tampered with or deleted is to copy it into a third-party data store, which can be both costly and time-consuming. Also, you are operating on the good faith of your users that nothing is modified or deleted. This can be challenging for IT departments, and is the root of the risk. With Office 365, the holds are “in-place,” making a third-party data store unnecessary. Holds can be placed on entire mailboxes and sites, or placed through a query to hold less content and optionally preserve future data. All of this can be done in a transparent way without the user needing to know and there is no impact to productivity.


Depending on what the information environment looks like, and where information resides, it can be difficult to get data exported and ready for the courtroom. With the eDiscovery Center you have a single place to get this done. It's easy to export your dataset and get all of your SharePoint, Exchange, and Lync content—you just specify a location. It is exported into an EDRM XML format, an industry standard for data interchange, which can then be ingested by many of the tools that customers use for readying the documents. It outputs native files, PSTs, lists, feeds, even SharePoint pages as MHTs for offline use. You can download just a results summary report with auditing without having to first export all of the content.

Final thoughts

Utilizing these powerful capabilities in Office 365 will save your customers time and money and reduce their risk. Being able to address compliance needs right out of the box is a great value proposition and you should be talking about it in your customer conversations.

If you don’t already know, why not ask your customer’s compliance officer, legal department, or IT team what they are doing today for compliance and eDiscovery? Asking that question will give you an opportunity to talk about the advantages I’ve noted above, should your customer be faced with a lawsuit.

Video – How to demo DLP and eDiscovery capabilities to customers

In this screencast, learn how to demo DLP and eDiscovery capabilities to your customers, including the recently released SharePoint sensitive information types data audit.

Blog series links

Office 365 Partner Community resources


Comments are closed.