Why Microsoft 365 Is Not the Answer for eDiscovery

Microsoft 365, formerly known as Office 365, has exploded in popularity in recent years. It’s no wonder four in five Fortune 500 companies now use the subscription-based productivity suite.

When you factor in the data management, compliance, and eDiscovery capabilities through Microsoft Purview, many organizations have even turned to M365 as their preferred eDiscovery technology solution to conquer the data avalanche. 

After all, you have it already, right? 

But did you know using M365 to manage every part of the eDiscovery process might actually not be as efficient as you think, and could even be costing you valuable time and resources?

Before we dive into some of the limitations of using Microsoft Purview for eDiscovery, let’s look at Purview’s three licensing levels for eDiscovery capabilities.

Microsoft Purview’s Licensing Levels

1. Content Search: Content Search enables you to search for content across M365 data sources and export the search results.
2. eDiscovery (Standard): eDiscovery (Standard), formerly known as Core eDiscovery (or E3), builds on the basic search and export functionality of Content search by enabling you to create eDiscovery cases and assign eDiscovery managers to specific cases. 
3. eDiscovery (Premium): Formerly known as Advanced eDiscovery (or E5), eDiscovery (Premium) builds on the existing case management, preservation, search, and export capabilities in eDiscovery (Standard) by providing an end-to-end workflow to identify, preserve, collect, review, analyze, and export potentially responsive content.

Why Microsoft 365 is Probably Not the Answer to Support Your eDiscovery Use Cases 

• License Requirements: While all three Purview licensing levels have basic capabilities, only eDiscovery (Premium) has the set of advanced features — including custodian management, legal hold notifications, advanced indexing, analytics, Optical Character Recognition (OCR), predictive coding models and more — most organizations would expect in an eDiscovery solution. So, your organization may have M365, but may need to pay more for the licensed version to access the eDiscovery features you need. Furthermore, suppose you’re willing to invest in the plans that unlock eDiscovery (Premium) capabilities — could you then effectively manage your discovery process with them? 
• Potential Exposure of Sensitive Data: Using Purview, Microsoft-specific metadata is often appended to your production by default, which could include sensitive information that should be private, exposing your organization to unnecessary risks.
• Slow to Index and Search: eDiscovery Premium is slow to index and search. The maximum advanced indexing throughput is 2GB per hour and searches slow down as data sets grow. A search of 10,000 mailboxes takes 4 minutes per search, while a search of 100,000 mailboxes for a large organization can take as long as 25 minutes per search. This is time you simply don’t have.
• Exporting Search Results is Slow: M365 has been known to throttle the export of data to load balance environments, which can reduce the throughput for your exports. Microsoft says, “Retry your search. If your search still fails, split your search into smaller searches,” but that adds steps to workflows that often have tight timeframes.
• No In-Place Review and Analytics: This is one of the most significant limitations of using Purview for eDIscovery. You cannot conduct in-place review and analytics with Purview. To conduct review and analytics, you must copy the data into a case first. This can often take hours and eliminates any benefit you may have thought you had to work with the data in place.
• Limited File Type Support: Finally, Purview also only supports 64 file types, many of which are Microsoft file types. That is simply not enough coverage for organizations having to collect and discover hundreds of file types. This can result in important data getting swept under the rug or missed altogether. This also makes it very challenging to search. Searches are both exhaustive and overinclusive while missing out on important files and attachments. Okta recently released a study that concluded, companies today use, on average, somewhere between 73–200 external applications, depending on their size. So regardless of the size of your organization, the likelihood that all your responsive documents are Microsoft file types is slim. 
• Unreliable Bulk Redactions: Redaction is the process of removing or obscuring sensitive information found in an original document or electronic data. The content that remains after redaction stays intact and maintains its context for legal and business purposes. Redactions, as you can imagine, are a critical part of discovery. However, applying redactions to a large dataset can be incredibly time-consuming, because you have to ensure nothing gets missed. Bulk redaction, in theory, is supposed to streamline this process, but that’s assuming it works correctly. In Purview, the redaction tool requires you to double and triple check to make sure you thoroughly redacted all sensitive information. Not only does this defeat the purpose of a bulk redaction tool — it also exposes you to unnecessary risk since it leaves room for human error.

Instead of M365

While M365 can be useful for preserving and managing the data generated in the Microsoft ecosystem, using M365 to manage your whole eDiscovery process is likely to cause headaches. You’d be better served choosing a platform that allows you to process, review, produce, and analyze data from any source. 

Instead of using M365, opt for a more reliable, application-agnostic eDiscovery solution offering the power, scale, and broad feature set to reliably collect from all your enterprise applications. To achieve the full benefits from a platform, users will need to work with a provider partner that clearly understands these challenges and can offer flexible solutions and workarounds to help with your organization’s unique workflows.

Download “The Data Avalanche” whitepaper to get access to seven readiness steps that you can take today to overcome your most complex eDiscovery data challenges.