Published on Jul 17, 2024 A Practice Note addressing Microsoft 365’s discovery tools. This Note discusses the various eDiscovery modules and features available to Microsoft Purview eDiscovery licensees and evaluates Microsoft Purview eDiscovery’s limitations related to search and creating family relationships involving hyperlinked documents (cloud-stored documents that are hyperlinked rather than attached to an electronic communication).
Microsoft 365 is a technology platform that allows users to generate and maintain data in a cloud-based storage repository. With the Microsoft 365 platform, users can gain access to widely used business applications including Outlook (email), Word (word processing), Excel (spreadsheets), PowerPoint (slide presentations), Teams (instant messages), and SharePoint and OneDrive (storage repositories). Microsoft 365 is ubiquitous and organizations (including private sector companies, federal government agencies, and the federal court system) rely on Microsoft 365 for communications, information generation, and storage.
Microsoft 365 offers users a multifaceted suite of features, including electronic discovery (e-discovery) functionality through its Microsoft Purview eDiscovery solutions (Purview eDiscovery). Those solutions ostensibly enable appropriately licensed users to handle some aspects of the discovery process for civil litigation. To varying degrees, Purview eDiscovery users may preserve and search data from Microsoft 365. Purview eDiscovery may also facilitate users’ ability to connect emails and Teams messages with hyperlinked documents referenced in those communications.
However, Purview e-discovery features are not straightforward. There is complexity that requires extensive and repeated research, particularly since Microsoft is consistently updating its e-discovery offerings. In addition, the nuances of Purview eDiscovery offerings may impact the quality and nature of users’ discovery. Moreover, Purview eDiscovery services do not have the same advanced functionality that a full-service e-discovery platform offers. As a result, counsel with clients who use Purview eDiscovery and are parties in litigation should understand the nature, extent, and limitations of its e-discovery functionality, including:
Purview eDiscovery offers users three grades of eDiscovery Modules: Content search, Microsoft Purview eDiscovery (Standard) (eDiscovery Standard), and Microsoft Purview eDiscovery (Premium) (eDiscovery Premium). Each module provides users with progressively more functionality, with Content search being the basic offering and eDiscovery Premium being the most advanced solution.
The Content search module offers elementary search functionality for Purview eDiscovery users. This includes the ability to perform basic keyword and Boolean searches across custodian data housed in Microsoft 365, subject to various limitations. (See Keyword queries and search conditions for eDiscovery, Microsoft, Nov. 28, 2023; Limits for Content search and eDiscovery (Standard), Microsoft, July 21, 2023.)
Users can also generate reports that summarize search results, together with certain search metrics. For example, a report may:
(See View statistics for eDiscovery search results, Microsoft, Oct. 1, 2023.) These reports, however, do not reflect advanced metrics (such as the number of unique hits) available in search term hit reports that traditional e-discovery platforms generate.
Users may also export search results, which can then be uploaded into an e-discovery platform for review and analysis. For emails, Content search allows users to export them in .PST format. Microsoft application files like Word, Excel, and PowerPoint are exported from either SharePoint or OneDrive in their native format. (See Export Content search results, Microsoft, June 13, 2024.) For Purview eDiscovery licensees who have not upgraded their service (for a fee) to access eDiscovery Standard or eDiscovery Premium, this is generally the extent of their eDiscovery functionality.
For Purview eDiscovery users who hold E3 (Enterprise), G3 (Government), or A3 (Education) licenses, eDiscovery Standard provides Content search features and rudimentary preservation, search, and export functionality under a case management umbrella. With eDiscovery Standard, users can create a separate case for each matter in which they preserve content, search for relevant materials, and then export the corresponding search results. The organizational feature of case management is not available to Purview eDiscovery licensees who only have access to Content search.
eDiscovery Standard allows licensees to place Exchange mailboxes (including Outlook emails and Teams messages), Microsoft 365 groups, SharePoint locations, and OneDrive accounts on legal hold and preserve that information in place. Users can also implement a legal hold that preserves only the data that matches a user-generated query rather than all data in the custodian email account or SharePoint site. (See Get started with eDiscovery (Standard), Microsoft, May 6, 2024.)
eDiscovery Standard users do not have access to more advanced search and analytics features found in eDiscovery Premium, nor can they use Purview eDiscovery to help connect communications (such as email and Teams messages) with documents hyperlinked in those communications.
eDiscovery Premium blends Content search, the case management and preservation functionality from eDiscovery Standard, and several other features to create Purview eDiscovery’s most inclusive e-discovery offering. For Purview eDiscovery users who hold E5 (Enterprise), G5 (Government), or A5 (Education) licenses, some of the key features available through eDiscovery Premium include:
(See Overview of Microsoft Purview eDiscovery Premium, Microsoft, May 14, 2024.) A full list of the services available under eDiscovery Premium for licensees can be found at Microsoft Purview eDiscovery solutions, Microsoft, Sept. 14. 2023.
Even with access to eDiscovery Premium, Purview eDiscovery’s features are more limited than those offered by a full service e-discovery platform. As a result, responding parties should be prepared to address the limitations with Purview eDiscovery to ensure that their productions of relevant information are defensible (FRCP 26(g)(1); see Deal Genius, LLC v. O2COOL, LLC, 2022 WL 17418933 (N.D. Ill. Oct. 24, 2022)).
For many organizations, the services that Purview eDiscovery provides are enough to meet the discovery challenges in many lawsuits or even certain government or internal investigations. Nevertheless, Purview eDiscovery does not provide the advanced features offered by a full service e-discovery platform needed to support discovery efforts in complex cases such as multidistrict litigation and class actions or regulatory investigations like Hart-Scott-Rodino Second Requests. Even small lawsuits that involve high volumes of ESI can present difficulties for organizations that wish to manage much of their discovery process with Purview eDiscovery. Responding parties that rely on Purview eDiscovery may not be able to perform a comprehensive search to reasonably identify relevant information.
Responding parties who wish to incorporate Purview eDiscovery functionality into their discovery workflows must understand its search limitations and take steps to address them so they can establish the defensibility of their discovery process. Two general limitations with Purview eDiscovery of which responding parties should be aware include:
Purview eDiscovery search features are more limited than those offered by a full service e-discovery platform that has a fully indexed database and an advanced search engine. While eDiscovery Premium users have some search capabilities beyond those available to Content search and eDiscovery Standard users, all Purview eDiscovery solutions have important limitations related to:
While Microsoft indexes much of the content in a user’s Microsoft 365 ecosystem, it does not comprehensively index all information encompassed within an organization’s Microsoft 365 environment. Microsoft makes clear that certain files, file types that are not supported by Microsoft 365, and file sizes can result in partially indexed items or indexing errors. (See Partially indexed items in Content search, Microsoft, June 13, 2024.) Without a fully indexed database, responding parties’ search results may be incomplete and vary from one search to the next (even when using the same search terms), and therefore be unreliable.
Microsoft provides some additional indexing capabilities for its eDiscovery Premium users that may ameliorate some of these issues. Referred to respectively by Microsoft’s marketing literature and technical instructions as deep indexing and advanced indexing, eDiscovery Premium users can have partially indexed SharePoint content (or content that generated indexing errors) reindexed.
However, Microsoft explicitly acknowledges that even this advanced reindexing option for eDiscovery Premium users does not extend to emails that have image attachments. Because attached images are not indexed, they will not be included in any search results. Since images may be critical evidence in certain litigation, this is a significant limitation with Microsoft’s search capabilities. (See Overview of Microsoft Purview eDiscovery (Premium), Microsoft, May 14, 2024; Advanced indexing of custodian and non-custodial data sources, Microsoft, July 21, 2023.) In addition, anecdotal reports suggest that indexing issues generally impact many organizations’ use of Purview eDiscovery to effectively handle ESI searches.
Purview eDiscovery does not enable users to run advanced eDiscovery searches. Users do not have access to:
These limitations may prevent responding parties from identifying relevant information within their Microsoft 365 environment using Purview eDiscovery search tools. Content search, eDiscovery Standard, and eDiscovery Premium users do have access to some Boolean connectors (such as AND, OR, NOT, and NEAR) and other operators to facilitate, for example, prefix, exclusion, and exact wording searches (see Keyword queries and search conditions for eDiscovery, Microsoft, Nov. 28, 2023). While these and other search features are helpful, traditional e-discovery platforms offer more advanced search functionality that can be used to more readily and defensibly identify relevant information for review and production (see Searching Guide, Relativity, May 30, 2024).
Purview eDiscovery generally does not provide Content search or eDiscovery Standard users with advanced analytics technology. This means that those licensees do not have access to search methodologies or analytics tools like concept search, near duplicate detection, data clustering, social networking analysis, sentiment analysis, and technology-assisted review (TAR), any combination of which can help responding parties identify relevant documents that search terms may overlook or otherwise fail to identify.
eDiscovery Premium users have access to analytics tools including email threading, near duplicate detection, and predictive coding. While these tools are an improvement over the Content search offering, they do not deliver the enhanced functionality that related tools available in full service e-discovery platforms provide. This is particularly the case with eDiscovery Premium’s predictive coding technology, which appears to offer only early generation, TAR 1.0 type functionality rather than the TAR 2.0 active learning workflow that parties now typically use. Moreover, predictive coding is now available only for existing cases in eDiscovery Premium as Microsoft has retired its predictive coding technology for new eDiscovery cases, effective March 31, 2024. (See Quick start: Predictive coding in eDiscovery (Premium) (preview), Microsoft, June 11, 2024; Practice Note, Continuous Active Learning for TAR.)
Anecdotal evidence suggests that Purview eDiscovery’s search features may perform poorly when searching large numbers of custodians or volumes of data. Microsoft clearly delineates in its technical specifications the parameters and limits for eDiscovery searches (see Limits in eDiscovery (Premium), Microsoft, Aug. 15, 2023). However, concerns have been raised regarding the ability of Purview eDiscovery to effectively handle searches when the Content search module is used to identify relevant information across greater numbers of custodians or higher data volumes. This scalability issue goes hand in hand with additional anecdotal observations that search results may be inaccurate, as indicated by the inconsistent results reached when repeating identical searches across large numbers of custodians or high data volumes. While only anecdotal, users should be on the lookout for these issues
in order to ensure their discovery process is defensible.
Purview eDiscovery does not offer Content search, eDiscovery Standard, or eDiscovery Premium users functionality to validate their search results and confirm that their searches satisfy the reasonable inquiry standard under Federal Rule of Civil Procedure (FRCP) 26(g)(1) (see Deal Genius, LLC v. O2COOL, LLC, 2023 WL 2299977, at *1 (N.D. Ill. Feb. 17, 2023), report and recommendation adopted, 2023 WL 2299976 (N.D. Ill. Feb. 23, 2023)). Validation is a quality assurance step in e-discovery. It is essential for providing reasonable assurance that a production of documents is complete and meets the reasonableness and proportionality requirements under FRCP 26(g)(1). (See City of Rockford v. Mallinckrodt ARD Inc., 326 F.R.D. 489, 494 (N.D. Ill. 2018).) Responding parties may choose among multiple methods to validate their search results, with elusion testing remaining the most common validation method (see Deal Genius, LLC v. O2COOL, LLC, 682 F. Supp. 3d 727, 734-35 (N.D. Ill. 2023)). Purview eDiscovery does not have built-in elusion testing technology or other methods to validate search and production results. This is a key limitation with Microsoft 365 of which users should be aware.
eDiscovery Premium users may automate the connection of documents in SharePoint and OneDrive with communications that include hyperlinks to those documents. In particular, Microsoft represents that eDiscovery Premium users can link an email or Teams message with both:
(See Overview of Microsoft Purview eDiscovery (Premium), Microsoft, May 14, 2024.)
Nevertheless, limitations may impede this process. Anecdotal reports suggest that the process of connecting communications with hyperlinked documents is not foolproof, and the technology may not always work as represented. Also, because Microsoft can only facilitate connections between communications and documents stored in SharePoint or OneDrive, users cannot use eDiscovery Premium to automate the connection of Microsoft Outlook emails or Microsoft Teams messages to Hyperlinked documents that were:
These factors (and others) that affect the ability to connect communications to hyperlinked documents do not necessarily reflect a limitation or weakness with eDiscovery Premium. Microsoft’s offering on this issue is better than what its competitors currently provide. (See, for example, Admins in Google Vault can now export hyperlinked Google Drive content from Gmail messages, Google, Dec. 5, 2023.) Instead, they represent human-driven interventions that dynamically impact the discovery process and which users should understand in order to effectively discharge their discovery duties.
Understanding the issues associated with Purview eDiscovery modules is essential for both responding parties and requesting parties. Responding parties should know how to get the most from their Purview eDiscovery features and also address limitations with their functionality. Requesting parties should also be focused on Purview eDiscovery and their ability to obtain a reasonable and proportional production of relevant information when responding parties use Purview eDiscovery tools in their discovery process.
Responding Parties
Know the Purview Discovery license. Responding parties must know the nature of their Purview eDiscovery license so they can understand the available discovery features. By so doing, parties can determine:
Determine the Proficiency of the Administrator for Purview eDiscovery. Responding parties should determine whether the administrator for their Purview eDiscovery accounts is proficient in handling the platform’s e-discovery features. Because administrators are ultimately responsible for executing preservation, search, and related e-discovery functions under Purview eDiscovery, responding parties should ensure administrators have been properly trained and that they continue to stay current on technological advancements to Purview eDiscovery.
Ensure mailboxes are properly preserved. Once a user profile is removed from Microsoft 365, the user’s emails will be permanently eliminated within 30 days unless they were previously placed on legal hold in Purview eDiscovery (see Donofrio v. Ikea US Retail, LLC, 2024 WL 1998094 (E.D. Pa. May 6, 2024)). To avoid this result, a responding party must take additional measures to preserve emails for users who are removed from the parties’ Microsoft 365 environment. Responding parties with:
Determine whether Purview eDiscovery search limitations should be addressed. Responding parties should determine whether the quality and nature of a particular matter require them to mitigate the limitations of Purview eDiscovery search capabilities. This should entail determining:
For smaller matters or where e-discovery issues may not be significant, responding parties may conduct searches in Purview eDiscovery without having the limitations with its search features predominate. However, for matters involving higher stakes or larger data volumes, parties should consider handling their discovery searches in a traditional e-discovery platform.
Consider how to address Purview eDiscovery search limitations. When a responding party uses Purview eDiscovery to handle e-discovery searches and determines that they must take steps to offset the technology’s search limitations, they may:
Consider whether and how much information to disclose to adversaries. A final issue for responding parties to explore is whether to disclose to litigation adversaries either their use of Purview eDiscovery or its search limitations. The defensibility of a discovery process may turn in certain circumstances on whether responding parties have identified, addressed, and disclosed particular search limitations or issues to adversaries. (See Garner v. Amazon.com, Inc., 2023 WL 6038011 (W.D. Wash. Sept. 15, 2023).) Nevertheless, doing so may lead to a host of other issues, including satellite litigation over an adversary’s real or perceived dissatisfaction with responding parties’ use of Purview eDiscovery (see Practice Note, Discovery on Discovery (Federal)).
Requesting Parties
Determine whether and to what extent Purview eDiscovery is being used. Requesting parties should determine whether responding parties are using Purview eDiscovery in their discovery process. If a responding party is using Purview eDiscovery, the requesting party should determine:
Learn whether limitations with Purview eDiscovery are being addressed. Requesting parties should inquire whether and to what extent a responding party is mitigating Purview eDiscovery’s limitations. For example, a requesting party should ascertain how the responding party:
Ascertain whether eDiscovery Premium is being used to facilitate family productions with hyperlinked
documents. Requesting parties may also wish to know whether responding parties are using eDiscovery Premium to connect documents with communications that include hyperlinks to those documents. Requesting parties should try to determine whether responding parties are identifying both historical and current iterations of a hyperlinked document and what issues (if any) they may be experiencing.
