All About Microsoft Teams

Let’s start with getting an understanding of Microsoft Teams.

As more companies opt for remote and hybrid workplaces, there is increased usage of apps such as Microsoft 365 and Microsoft Teams. Microsoft Teams is one of the most popular communication platforms. However, when it comes to eDiscovery, it can be difficult to manage Teams data. This is because Microsoft Teams stores data in different places, which makes it difficult to perform the eDiscovery process.

How-to-Collect-Microsoft-Teams-and-Microsoft-365-Data-During-eDiscovery-Graphic-1

Where is Data Stored?

Before we can even start talking about eDiscovery, you need to know the different storage locations used by Microsoft Teams. This app uses a multitude of Office 365 services for handling the data, which makes everything more complex.

  • Chat and Channel Messages

    The chat and channel messages of Microsoft Teams are stored with Exchange Online. This means that whenever a message is posted, the eDiscovery Office 365 substrate stores the message’s compliance record in the Exchange Online. All the chat participants receive the compliance records of chats in their mailboxes. In the case of channel messages, the owner of the channel receives the compliance records.

  • Files

    Microsoft Teams is integrated with SharePoint, which contains the Teams document library with different folders for each channel. The files for Microsoft Teams will either be in SharePoint Online or OneDrive for Business. As soon as the user sends a file on chat, a folder is created in their OneDrive named “Team Chat Files.”

  • Meeting Recordings

    The recordings of all the Teams meetings are either stored in SharePoint or OneDrive. In OneDrive for Business, there is a folder named “Recordings” containing recordings of ad hoc Teams meetings. The recordings for channel meetings are stored on SharePoint Online.

Using eDiscovery to Collect Microsoft Teams Data

  • Create a Case

    Before you can start collecting Teams data, you have to create a case. To do this, head to the Compliance Admin center of the application and navigate to the eDiscovery section. You will find the option to create a new case there.

  • Create a Hold

    For each case, you can create multiple holds in order to preserve the data for Microsoft eDiscovery. The content will be preserved until you delete it. Even after the retention period has been reached, the data will be retained in Microsoft 365.

    Open the case and select the Holds tab for creating a hold. You will have to enter a name and description. Next, you will have to select the hold’s location. For Teams data, you must define the SharePoint site and the Group mailbox. To do this, you will have to search for the name of the Team.

    In the case of a query-based eDiscovery hold, you must provide a query condition. It is also possible to select keywords and conditions such as date, subject, and sender. You can also create a hold without any conditions. Simply click Next and Submit, and your new hold will be created. It can take 24 hours for the hold to take effect.

  • Create a Search

    Once you have created the hold, you can create a new search by selecting the Searches tab. Name your search by following the prompts. You can choose the location in Exchange and SharePoint. Make sure that you search for the SharePoint team site and Group mailbox for the Team. There is also an option to add conditions such as keywords. Once you are done, click Save.

    You will be able to find the search in the Searches tab. Select it to see the search results, along with a sample data preview.

  • Export Results

    It is possible to export the search results of the eDiscovery to a .pst file. For this, go to your search, select Actions, and Export results. There is an option to define the output options in the export results, allowing you to exclude encrypted items. Then, you can select how you want to export the data.

    You can scroll down to get a numerical view of the results and find the SharePoint duplication and versioning options. After you hit Export, you will be able to view the results under the Exports tab. Once the eDiscovery export tool has finished, the results will be available to download.

    It is important to note that the data you will get in the .pst file will be unstructured and unorganized. You won’t see the chat and channel messages displayed in order. What you will get is a collection of messages that are difficult to translate. To avoid this, you need the help of an eDiscovery solution such as Casepoint that can help you interpret this data and understand the relevance of the conversation.

Features and Limitations for Microsoft eDiscovery

With different Microsoft 365 licenses, you will get different eDiscovery options. At the very least, you need to get the Microsoft E3 plan that will give you access to the Compliance Center eDiscovery capabilities. Let’s start with understanding the features of each license:

Features

  • Microsoft 365 E3 ($23/month)

    • Manage sensitivity labels and retention policies

    • Security audits

  • Microsoft 365 E5 ($38/month)

    • Manage sensitivity labels and retention policies

    • Core and advanced eDiscovery

    • Extra

      • Communication DLP for Teams

      • Compliance

      • Communication

      • Email Archiving

      • Customer Lockbox

      • Privileged Access Management

      • Advanced-Data Governance

Limitations

  • Third-Party Sources

    The advanced compliance tools of Microsoft only work with their own tech stack. They cannot mirror third-party apps’ retention policies via connectors for Microsoft Teams. Moreover, the sync across third-party apps only happens once a day.

  • Search Performance

    Microsoft doesn’t offer instantaneous searches. The searches are processed in batches, which means that depending on the scope, volume, and size of the search, it can take a lot of time.

  • Indexing and Retention

    The images sent as email attachments are not indexed. Sending large files can be a problem for the software as well. If you send content such as emoji reactions in Teams, it won’t be indexed, meaning it cannot be searched. Also, the chat of a participant without an Exchange Online mailbox won’t be preserved.

  • Data Protection

    Microsoft stores the original as well as the archived copy in the same environment. This puts your data at an increased risk of theft, corruption, and loss.

  • Usability

    The process of setting up and using the Microsoft Compliance Center is complex. To perform certain actions, Compliance Center uses Powershell, which makes it prone to errors.

As you can see from these features and limitations, Microsoft eDiscovery can be a complex process. However, you can take certain steps in order to ensure that your organization has an effective Microsoft eDiscovery plan.

Microsoft eDiscovery Plan

Now that you have a basic understanding of Microsoft and what its eDiscovery entails, you can start creating a plan of action. Since no legal team, organization, or legal matter is the same, what you need is an adaptive guide that fits your needs.

Understanding Your Needs

The first step in creating a Microsoft eDiscovery plan is pinpointing your organization’s needs. Here is what you need to consider:

How-to-Collect-Microsoft-Teams-and-Microsoft-365-Data-During-eDiscovery-Graphic-2

  • Size of your company

  • Industry regulations

  • Your budget

  • Frequency of litigations and investigations (internal and external)

  • People engaging with Microsoft Teams

  • Frequency of people engaging with Microsoft Teams

  • Teams data you need

  • Other Microsoft apps relevant to eDiscovery

Once you consider these factors to understand your organization’s needs, you will know how to prioritize. Consider the scope of your goals. Depending on your goals, do you need an eDiscovery package that offers full security and compliance? Will your needs be taken care of by simply maintaining the retention of data and searching the channel messages? Is the content search too limited for what you need?

Regardless of the scope, you need something that can preserve data, collect what you need, understand the context, and export the results.

Re-evaluating Your License

Once you have an understanding of your needs and goals, you can check if your current Microsoft 365 license can help you achieve that. If your needs exceed the capabilities of your current license, you can upgrade the license, buy required add-ons, or find an eDiscovery solution such as Casepoint.

For instance, if your company has over 300 employees working remotely, more people will be using Microsoft Teams and other apps. So, the E3 license might not be enough to fit these requirements, and you will have to upgrade to the E5 license. However, if you have a small company, you can simply opt for add-ons. However, you will have to make sure that your employees know how to use eDiscovery Office 365.

It’s important to remember that regardless of your initial needs, you should ensure your Teams data is accessible and private. If you are unsure of this, find a plan that best suits your eDiscovery goals.

Establishing a Company Teams Policy

Now that you have the right Microsoft license, it’s time to start working on creating a Teams Policy for your company. This policy should outline all the technology, processes, and people who will be driving the discovery and use of Teams data. Although your company’s Teams policy will depend on your needs, here are a few basic things to consider:

  • Outline the roles of the user and configure permissions

  • Optimize user permissions and admin roles for extra security and compliance

  • Identify relevant data types that you must delete or retain

  • Put restrictions in place in regard to the user behavior

  • Identify your eDiscovery limitations and create a plan to mitigate these

How-to-Collect-Microsoft-Teams-and-Microsoft-365-Data-During-eDiscovery-graphic-1 (1)

Having a well-documented policy will ensure that the teams are able to communicate well. You will be able to avoid risk and continuously improve the processes for Microsoft eDiscovery.

Making a Long-Term eDiscovery and Preservation Plan

To facilitate a successful Microsoft eDiscovery plan, there are several elements to consider, including data retention, archiving, legal hold, search, and more. The current architecture of Microsoft Teams doesn’t provide easy visibility. There are several challenges, such as fragmented retention policies and unreliable indexing. In order to mitigate these challenges, you need the support of a trusted eDiscovery solution, such as Casepoint.

Conclusion

Microsoft Teams is just one of the many eDiscovery Microsoft challenges that organizations face today. The best way for you to maintain control over the data is to implement an eDiscovery software that can centralize your Teams data, along with data from other communication platforms. Having a sustainable solution by your side will ensure that your data is both private and accessible.