SQL Database Design For Developers at php[tek] 2024
Commsverse 2022 eDiscovery and Microsoft Teams - SlideShare.pptx
1. This presentation is confidential.
Classified as Confidential
eDiscovery and Microsoft Teams
Albert Hoitingh
2. This presentation is confidential.
Classified as Confidential
About Me
Albert Hoitingh
Sr. Consultant Microsoft Compliance, Risk & Security
InSpark
@alberthoitingh
https://linkedin.com/in/appieh
https://alberthoitingh.com
3. This presentation is confidential.
Classified as Confidential
Session objectives
• Look at Microsoft 365 eDiscovery options
• How to use eDiscovery with Microsoft Teams
• See what does and doesn’t work
• Demonstrate both core and advanced eDiscovery
4. This presentation is confidential.
Classified as Confidential
Some things we won’t talk about….
• Compliance boundaries
• Predictive coding
• Encrypted documents
• Attorney-client privilege
Blog article on this:
5. This presentation is confidential.
Classified as Confidential
eDiscovery
According to Wikipedia…
“Electronic discovery (also e-discovery
or eDiscovery) refers to discovery in
legal proceedings such as litigation,
government investigations, or Freedom
of Information Act requests, where the
information sought is in electronic
format (often referred to as
electronically stored information or ESI”
6. This presentation is confidential.
Classified as Confidential
Identification
Add custodians (data custodians) and additional data locations.
Preservation
Place a legal hold on the data and communicate.
Collection
Search and collect live data from the custodial data sources (and
non-custodial data sources, if applicable)
Processing
Static view of the case data.
Review
Reduce data to what is most relevant by running additional
queries. Use the annotate view to apply markup.
Analysis
Easy and efficient review process.
Production and Presentation
Export documents
Electronic Discovery Reference Model
(EDRM)
7. This presentation is confidential.
Classified as Confidential
Terminology
Case Member
An eDiscovery investigator which is member of a
specific case
Custodian & custodian data
• A specific user within the Office 365 tenant, who is
part of the investigation
• Data sources of the custodian (e-mail, OneDrive,
Teams)
Microsoft Purview eDiscovery
(Standard)
Core eDiscovery, search and export content
Microsoft Purview eDiscovery
(Premium)
End-to-end workflow to preserve, collect, review,
analyze and export data
In-Place Hold
Provides granular hold capability based on query
parameters
Litigation Hold
Places all items on hold
8. This presentation is confidential.
Classified as Confidential
https://docs.microsoft.com/en-us/microsoft-365/compliance/ediscovery
Content search | eDiscovery
(Standard) | eDiscovery (Premium)
9. This presentation is confidential.
Classified as Confidential
Licensing
Content search &
eDiscovery (Standard)
Office 365/Microsoft 365 E3
Microsoft 365 F5
Separate licenses for mailbox holds
(if not part of E3/E5)
eDiscovery (Premium)
Office 365 E5 | Microsoft 365 E5
Microsoft 365 E3
- E5 Compliance
- E5 eDiscovery & Audit
Office/Microsoft 365 Education A5
10. This presentation is confidential.
Classified as Confidential
Microsoft Teams
Information Architecture
11. This presentation is confidential.
Classified as Confidential
Microsoft Teams architecture - previous
12. This presentation is confidential.
Classified as Confidential
Watch out –
Meetings and Loop
• Channel/non
channel
• Recordings
• Transcripts
• Breakout rooms
OneDrive
Mailbox
SharePoint
Online
Microsoft Teams architecture now
16. This presentation is confidential.
Classified as Confidential
Card
Kind:Microsoftteams (look for
“appname”)
All Microsoft Teams (chats,
meetings and calls)
Kind:Microsoftteams
Search for Teams information
Conversation or chat
Kind:IM (beware Skype for
Business)
Meeting summary
Kind:Meeting (can take 8 hours)
Call summary
Kind:Call (can take 8 hours)
17. This presentation is confidential.
Classified as Confidential
Demo-time!
Content Search & eDiscovery (Standard)
18. This presentation is confidential.
Classified as Confidential
eDiscovery (Premium)
A closer look at the dashboard
19. This presentation is confidential.
Classified as Confidential
https://docs.microsoft.com/en-us/microsoft-365/compliance/ediscovery
eDiscovery Premium workflow
21. This presentation is confidential.
Classified as Confidential
eDiscovery (Premium) dashboard
Custodians & other data sources
22. This presentation is confidential.
Classified as Confidential
eDiscovery (Premium) dashboard
Subsets of information based on queries
Either is draft or final mode (committed – cannot be altered).
23. This presentation is confidential.
Classified as Confidential
eDiscovery (Premium) dashboard
Used to review found information
Allows you select information, annotate information and export results
24. This presentation is confidential.
Classified as Confidential
eDiscovery (Premium) dashboard
Stored export jobs
25. This presentation is confidential.
Classified as Confidential
eDiscovery (Premium) dashboard
Information on job status. Crucial to get an insight.
26. This presentation is confidential.
Classified as Confidential
• Difference in Standard and
Premium
• Creates an export file for
selected or all requested
information
• If configured, redacted PDFs are
included
• When possible, information is
also converted to text
• Conversations are stored as
HTML
Exporting information
27. This presentation is confidential.
Classified as Confidential
• Difference in Standard and
Premium
• Creates an export file for
selected or all requested
information
• If configured, redacted PDFs are
included
• When possible, information is
also converted to text
• Conversations are stored as
HTML
Exporting information
28. This presentation is confidential.
Classified as Confidential
Demo-time!
eDiscovery (Premium) and Microsoft Teams
29. This presentation is confidential.
Classified as Confidential
Advanced subjects
Private/shared channels, Breakout rooms and Loop
30. This presentation is confidential.
Classified as Confidential
Breakout Rooms
• Documents stored in the
sender’s OneDrive
• Chats (substrates) stored in
the sender’s mailbox
• Recordings are stored in the
initiator’s OneDrive
31. This presentation is confidential.
Classified as Confidential
Private/shared channels - documents
• Stored in a separate SharePoint
Online site-collection
• Use PowerShell to find all site-
collections
• Include in eDiscovery query
32. This presentation is confidential.
Classified as Confidential
Private channels - conversations
• Conversations in a private
channel are stored in the
mailbox of the private channel
members, not the group
mailbox!
• Conversations are formatted,
so they are visible using filters
33. This presentation is confidential.
Classified as Confidential
Shared channels - conversations
• Conversations in a shared
channel are stored in a
separate system mailbox – this
cannot be selected!
• Instead – select the mailbox for
the Teams itself (as the shared
channel is associated with this
one)
34. This presentation is confidential.
Classified as Confidential
Loop and Microsoft Teams
• OneDrive for Business
• .fluid files are discoverable
• No preview
• Export is tricky
35. This presentation is confidential.
Classified as Confidential
Remember
• Need to add all users’ mailboxes and OneDrives if you have
breakout rooms and need to collect chats, documents and recordings
• Private channels have a different permissions model & any member
of a private channel can start and contribute to conversations
• You will need find and include all site-collections and users'
mailboxes for the shared channel…..
• Loop is still somewhat difficult but can be done!
More information: