Microsoft Office 365 eDiscovery Strategies

Home » News and Insights » Insights » Microsoft Office 365 eDiscovery Strategies

Microsoft Office 365 eDiscovery Strategies and Best PracticesMicrosoft Office 365 – Q&A on eDiscovery Strategies and Best Practices

As more corporations move their enterprise data to the cloud, many choose to migrate to the Microsoft Office 365 environment. This transition requires legal professionals—both in-house and at law firms—to adjust their current eDiscovery processes and workflows. We recently held a webinar on this subject titled “Managing eDiscovery in Microsoft Office 365: Strategies and Best Practices,” Joined by our colleague Allan Johnson, Senior Attorney at Southern California Edison, we discussed how to use Office 365 to support litigation and regulatory discovery, considerations around updating an internal eDiscovery program to incorporate Office 365, and the risks that may arise for downstream processes and workflows after a migration to Office 365. We also explored how organizations with an Office 365 environment can integrate information governance into eDiscovery workflows, develop strategies for leveraging analytics, and adopt best practices for information search and retrieval.

During the webinar, attendees submitted a number of questions that we ran out of time to answer in our live program. So we decided to address those questions, and some of the associated issues they raised, here on our blog.

Q: Is there a way to create a legal hold from the “back-end” of Office 365 (separate from the eDiscovery legal hold)?

Legal holds can be created and applied in either the eDiscovery Module or the Exchange Administration Module, but each type of hold works slightly differently. The chart below explains some of these operational differences.

Microsoft Office 365 eDiscovery Features

Think about the practical and operational goals of your legal hold to determine which type of hold to create.

For example, within the eDiscovery Module, data on hold can be used as the foundation for additional searches and exports. And because the hold is tied to the case, it’s simpler to remove the hold when the case is over.

The hold functionality within the Exchange Administration module can be applied on a more global level, rather than on the case level. For example, a hold can be placed on critical mailbox stores like c-level employees, or on shared mailboxes that could potentially be searched & collected on multiple matters. With this approach, even if these mailboxes are also included as a source or custodian in a particular case, the global hold would maintain those records after the conclusion of that case.

Q: Does the hold functionality in Office 365 apply only to email?

It depends on the type of hold applied. The Exchange Administration module allows for in-place holds on mailboxes only, but the hold functionality within the eDiscovery module is broader. Using the eDiscovery Module, OneDrive and SharePoint locations can be placed under legal hold. Full mailboxes and shared locations can be placed on hold, or you can apply keyword or other qualifiers to the hold. Result sets are available for preview and export.

Q: Is there a way to gain access to the full mailbox to export a single mailbox folder, rather than exporting the entire mailbox?

Not at this time. eDiscovery mailbox searches target the entirety of the mailbox and cannot be “drilled down” to a lower level. The name of a folder contained within the Exchange Online mailbox isn’t an indexed characteristic, so it is not possible to target a single user folder within the eDiscovery search.

However, PSTs exported from Office 365 will contain the original folder structure from the online mailbox, and traditional processing tools could locate these messages.

Q: You mentioned transfer rates/speed of download as a potential challenge. Are there eDiscovery tools or data migration methodologies that can speed this up?

DiscoverReady and other eDiscovery providers are able connect to the Office 365 environment to retrieve data, and we plan to share our experiences testing some of the available tools here on the DiscoverReady blog.

As we discussed on the webinar, migrating data to a cloud-based system like Office 365 will require changes to established ediscovery processes. Significantly, because data won’t be on-location, local IT staff cannot perform server or network drive collections to speed up retrieval times for a particular data set or case. Instead, internal teams must pull data back to the enterprise from Office 365 using tools provided by Microsoft. However, Microsoft provides state-of-the-art data transfer technology, and strives to reduce retrieval lag times by locating your data in nearby server farms.

Various tools and delivery methodologies will also chip away at the transfer rates. But compared against a local source-to-drive collection, there’s no doubt that cloud- or network-based collections will be slower. Setting realistic expectations for turnaround times will be important in avoiding headaches—both with internal teams and with outside counsel.

Q: How do you recommend getting an entire team on board with using Office 365 to its best potential?

Although moving to Office 365 may initially have the biggest impact on the IT function, its consequences will be felt throughout the corporation. A move to Office 365 will affect the Legal Department, Compliance, Records Retention, and potentially other groups, so all these stakeholders should be consulted in advance of a possible move to Office 365. To ensure a thoughtful migration plan, we recommend gathering all stakeholders together and soliciting all points of view. What will be moved? Are there any programs and/or data that cannot reside outside the corporate environment? Who will perform the collections from Office 365 after migration, and how does that affect the existing eDiscovery process? How will those collections integrate with others made locally? These and other questions need to be considered before any migration to a cloud based solution.

If you attended our webinar, we hope this follow-up discussion has been useful. If you missed the live event, you’re invited to listen to the webinar on-demand through our website. And if you have any further questions about eDiscovery in an Office 365 environment, please feel free to reach out to us personally at



Author Details
Chief Technology Officer
Phil oversees the development of cutting-edge technology solutions, and ensures the stability and security of the infrastructure that enables all of DiscoverReady’s offerings. Phil joined us from Bank of America, where his work included executive leadership of advanced quantitative analysis and technology management related to e-discovery, cyber forensics, and anti-phishing processes. Phil’s accomplishments have generated multiple patents related to automated data collection and processing. As a fellow in the Massachusetts Institute of Technology’s Leaders for Manufacturing program, Phil graduated with a double MS in electrical engineering and computer science, as well as an MBA.
Posted on