ARMA Greater Columbus Office 365 ediscovery and Information Governance Workshop. May 17, 2018

Transcription

1 ARMA Greater Columbus Office 365 ediscovery and Information Governance Workshop May 17, 2018

2 2

3 Both Sides Now by Joni Mitchell 3

4 Agenda O365: monumental impact on IG and ediscovery Background on O365 Dynamics introduced by moving to O365 What is O365? Key elements of O365 How does O365 work? Security & Compliance Center Information Governance features in O365 ediscovery features in O365 O365 Resources 4

5 IG considerations in context of O365 Executive Sponsor IG is primary stakeholder for O365 planning, strategy, and management Information policy development and communications Policies created to account for and/or adapt to O365 Information organization and classification Labels and auto-classification and what to use when Information security Identifying and protecting sensitive content with data loss prevention and information rights management Information accessibility Right people at the right time via Teams, Groups, SharePoint Information control Identify, classify, access, preserve, review, records management, ediscovery Information governance monitoring and auditing Data loss prevention, Supervision, Data Governance dashboards 5

6 Keep in mind Pros and cons of O365 adoption from your perspective What features and functions to adopt? Technology replacement opportunities? SourceOne DMS DLP Others 6

7 O365: monumental impact on information governance and ediscovery The widespread adoption of O365 is one of the most disruptive and significant trends to hit the Information Governance and ediscovery professions in the past 20 years 7

8 Why?

9 Reason #1: Office 365 is an evidence factory and warehouse Factory for creating ESI: Files: Word, Excel, PowerPoint, OneNote Web pages Chats: Instant Messages Warehouse for storing ESI: Mailboxes SharePoint document libraries OneDrive for Business Teams Yammer Groups 9

10 Reason #2: Office 365 is becoming the leading enterprise and business system worldwide is involved in MOST cases and frequently is KEY evidence Whatever system houses naturally is a focal point for discovery The system impacts in part or in whole: Where is stored How is stored How long is retained Whether is purged on a regular basis How easy or difficult it is to identify, preserve, and collect 10 10

11 Reason #3: Office 365 is a powerful reflection and amplification of general IT trends Cloud computing: Office 365 is THE quintessential cloud computing platform Massively scalable utility computing IT infrastructure owned and managed by provider (DR, backup, etc. under exclusive control of Microsoft) Apps with rapid development and deployment Social media infused user experience Facebook, Snapchat, Instagram Communicating using acronyms, emoticons, graphics, pictures, video, giphy 11 11

12 Reason #4: built-in ediscovery and Information Governance tools ediscovery tools: Identification Preservation Collection Processing Analysis Information Governance tools: Retention and disposition Compliance Information Security 12

13 Background 13

14 Some history 14

15 Adoption of O365 is fast and furious 35% growth in commercial seats 50k small businesses adopt Office 365 every month 80% of Fortune 1000 have Office 365 Office 365 is Microsoft s fastest growing commercial product ever Office 365 eclipsed Salesforce.com as the most widely used cloud-based business application 100 million active commercial Office 365 users 15

16 Why do organizations move to Office 365? Cost and financial implications Fixed predictable pricing /$ per user per month Operational vs. capital expense Reduced burden on IT: easier to deploy and manage than on-prem Less infrastructure to integrate and manage Basic patching, updates, server replacements handled by Microsoft New features and functions rolled out automatically Tools! Apps! Something for everyone to be more collaborative and productive Groups, Teams, Planner, StaffHub Built to be deployed on multiple devices and available 24/7 16 Mobile and cloud first! Microsoft s mantra

17 Dynamics introduced by the move to O365 17

18 Dynamics introduced by moving to Office 365 New content types 18 Conversations and Chat-based communications with emoji, emoticons, Memes, Giphy, etc. Planner Sway New storage locations OneDrive for Business Office 365 Groups Teams Yammer Change Persistent, continuous, and at high velocity Lower bar to deployment Heavy IT integration and configuration is handled by Microsoft Easier to deploy and consume features such as Instant Messaging, collaboration, Information Rights Management, etc.

19 Dynamics introduced by moving to Office 365: what ESI to move? Forklift move? Everything Information Governance cleanup prior to move? Identify Redundant Obsolete and Trivial ( ROT ) data Not subject to legal hold Not subject to legal, regulatory, or business retention Develop criteria (age, author, duplicate, etc.) Identify data subject to legal hold Identify data subject to legal, regulatory, or business retention requirements (records, work in progress, etc.) Document actions taken Approval for disposition What was disposed, when, by whom Information Governance cleanup after move? Move ESI into O365 then turn on policies 19 19

20 Dynamics introduced by moving to Office 365: adoption is typically 100% adoption PSTs Archive OneDrive for Business adoption: Will we adopt? Will it become our corporate standard for user file sharing? Will we migrate home share, My Documents? Server PST Archive PC Documents Home Share File Sharing Service OneDrive File shares to SharePoint Online document libraries adoption 20 Will we adopt? Will SPO replace file server based file sharing? Will me migrate file shares to SPO? Department Shares Public Shares Project Shares 20

21 Dynamics introduced by moving to Office 365: adoption Groups Teams Planner Yammer StaffHub PowerBI *Adoption of these tools have IG implications 21 21

22 What is Office 365?

23 What is Office 365? Suite of Services/Products , Instant Messaging, Collaboration, File Sharing Office (Word, Excel, PowerPoint, Access, etc.), Exchange, SharePoint, Skype for Business Cloud Quintessential example of cloud computing Hardware, storage, backup and disaster recovery are handled by Microsoft Cloud Software as a Service (SaaS) Individuals, companies, organizations subscribe to the service for a fixed monthly or annual fee 23

24 Elements of Office 365: The Periodic Table icsh.pt/o365table 24

25 Key elements of Office 365 Exchange Online - -Calendar -Contacts -Tasks -Notes -Journal -Exchange Public Folders SharePoint Online -Collaboration: Team Sites -Intranet/portals -Blogs/wikis -Application development Unique -Enterprise Content Management ESI -Document libraries -Enterprise NOT file sharing: OneDrive for Business & document libraries found in user s mailbox Yammer -Enterprise social media: Facebook for the corporation -Groups and communities -Posts: free-text entries, comments, conversations -Upload files (Word, Excel, etc.) Unique -Polls, praise ESI NOT -Like, share, unlike found in user s mailbox Built-In Information Governance Tools -Retention and disposition -Compliance -Information Security Skype for Business -Instant Messaging (IM chats) -Voice (call logs) -Online meetings -Presence Mashups Applications and tools that are cross-platform Subject to and/or built from the ground up in Office 365 ediscovery --Groups tools? -Planner Unique ESI NOT found in user s mailbox -Teams Install on up to 15 devices! Office ProPlus -Word -Excel -PowerPoint -Outlook -OneNote -Access -Publisher Built-In ediscovery Tools -Identification -Preservation -Collection -Analytics -Processing 25

26 Key elements of Office 365: OneDrive for Business What is it? Individual file storage tool that competes with DropBox, Box, GoogleDrive Potentially replace My Documents and home-share on file server Technically it s a SharePoint site Access via the web or local copy on user s device ediscovery and IG implications FYI ESI stored in OneDrive for Business is subject to ediscovery tools ESI stored in OneDrive for Business is subject to Information Governance tools Centralized repository reduces need to collect from desktop, laptop, tablet There is OneDrive for Business AND OneDrive consumer OneDrive consumer Consumer oriented service Work with files on local device Provided with certain Office and Office 365 subscriptions but your files are ALSO stored in the cloud Cloud 26

27 Key elements of Office 365: Groups What is it? Collaboration tool Each has a: Mailbox Stores messages and conversations SharePoint document library Calendar OneNote ediscovery and IG implications ESI stored in a Group is subject to ediscovery tools ESI stored in a Group is subject to Information Governance tools Centralized repository reduces need to collect from file shares (group, dept., project, etc.) Why are they of interest? Individuals can enable and invite others Upload and create Office files Participate in conversations s Calendar (SEPARATE FROM EXCHANGE!) 27

28 Key elements of Office 365: Planner What is it? Collaboration tool Each has a: Mailbox Stores messages and conversations SharePoint document library Calendar OneNote Also includes Planner or Plan, a Microsoft Project lite (very) ediscovery and IG implications ESI stored in a Group is subject to ediscovery tools ESI stored in a Group is subject to Information Governance tools Centralized repository reduces need to collect from file shares (group, dept., project, etc.) Why are they of interest? Individuals can enable and invite others Upload and create Office files Participate in conversations s Calendar (SEPARATE FROM EXCHANGE!) 28

29 Key elements of Office 365: Teams Chat oriented collaboration tool with heavy social media influence Each Team has Chat Files (SharePoint document library) Calendar Wiki Team Channels General team Sub-channels to address specific topics Desktop, web, mobile apps Business, Enterprise, Education, NOT Government Are they subject to ediscovery tools? Yes BUT 29

30 Key elements of Office 365: Yammer Private social network or Facebook for the company Internal External access is optional Employs concept of Groups Public or private (only group members see posts) Department, project, community of interest Features include: 30 Inbox for messages Post public or private messages File post (upload) Like posts Announcements, Praise Notes (free text) Notifications Follow people User profile Mobile app

31 Built for teamwork and calendar with Exchange Connect to people, content, and apps with SharePoint Voice, video, and chat with Skype and Microsoft Teams Network across the organization with Yammer Co-author with Office 365 ProPlus Office 365 Groups Cross-application group membership

32 Microsoft 365 Teamwork: Where to Start a Conversation Inner Loop Files Sites Content SharePoint Outer Loop 32 Office 365 Groups

33 How does Office 365 work?

34 How does Office 365 Work? Backend infrastructure resides in Microsoft s data centers Backup and disaster recovery controlled by Microsoft Highly specialized hardware configured specifically for Office

35 How does Office 365 Work? Unlike many SaaS applications, Office 365 has a robust locally installed client software component: Office 35

36 How does Office 365 Work? Backend infrastructure hosted and operated by Microsoft in their data centers Users connect to and consume resources via locally installed software and the web Subscribing company has control over certain features, functions, and capabilities 36

37 SINGLE OFFICE 365 TENANT SPANNING MULTIPLE GEOS Available geos & services in Multi-Geo GLOBAL GEOS Contoso.onmicrosoft.com 25K Office 365 Users Home: NAM Satellite: EUR & AUS Asia-Pacific Australia Canada European Union (EMEA) India 1 Japan United Kingdom United States (North America) South Korea 1 TO BE LAUNCHED France NAM 15K EUR 5K AVAILABLE SERVICES Exchange Online IN PREVIEW OneDrive for Business IN PREVIEW SharePoint Online IN DEVELOPMENT AUS 5K 1 India and South Korea Geos are currently only available for customers with licenses and billing addresses in those geos

38 Security & Compliance Center

39 Security & Compliance Center Overview Portal in Office 365 Only certain users have access Global Administrators Role Based Access Control (RBAC) Out of the box and custom roles Audit trail of who was assigned what access, when, and by whom Security trimmed (only see what you have access to) 10 tabs organized around thematic areas Data Governance (retention & disposition) Search and investigation (ediscovery) etc. Dashboard Customize the widgets you want to appear 39

40 Information Governance Features in Office 365

41 Information Governance features in Office 365 Retention and Disposition Retention Policies Labels Disposition Review Event based retention Data Loss Prevention (DLP) Supervision Preservation Lock Azure Evidence Protection 41

42 Information Governance features: retention and disposition Retain data Delete data Across multiple O365 locations Single or multiple policies Manual or automatic classification Data Governance (E3) Retention Policies Labels Advanced Data Governance (E5) Auto-classification via: Labels Retention policies 42

43 Data Governance: Retention Policies (E3): retain OR delete based on: Created Last modified (E5): auto-apply based on: Keywords Sensitive information types Apply to: Exchange OneDrive for Business SharePoint sites O365 groups Exchange public folders Teams channel messages* Teams chats* Skype for Business* Multiple policies allow for tailoring to department s requirements Maximum of 10 org-wide polices Maximum of 1,000 include/exclude policies (1,000 mailboxes and 100 sites max) * Auto-apply currently not available 43

44 Data Governance: Labels (E3): apply labels manually and to folders and libraries Apply manually retain OR delete OR label Retain-delete based on Created Last modified Date of labeling (E5): auto-apply labels Keywords Exchange, SharePoint, OneDrive for Business, Groups Sensitive information types SharePoint, OneDrive for Business (E5): disposition reviews (next slide) Labels appear in: OWA, Outlook 2010 or later, OneDrive, SharePoint, O365 Groups NOTE: labels can be applied to folders, document sets, and document libraries 44

45 Data Governance: Disposition Review Requires E5 license Disposition review options: Apply different label Extend retention period Permanently delete item Based on labels Includes ESI in SharePoint OneDrive for Business O365 Group sites Does NOT include Exchange, Skype, Exchange Public Folders, Group Mailboxes 45

46 Example framework Exchange Keep 5 years Set framework for retention and disposition as follows: 1) Set a retention policy calling for OneDrive Keep 5 years Team Messages Team Chats SharePoint Skype for Business Keep 5 years Deletion of items 3 years after last modified date Users can delete items sooner if they want 2) Provide labels for user s to retain items for 5 years Can apply labels to folder, document library, individual items NOTE: labels not currently available in Teams, Skype for Business 46

47 NEW! Event driven retention and disposition Create categories of events Contracts NDA Create label and choose an event to base retention/deletion Label items SharePoint, OneDrive include field for Asset ID Create event to target items 47

48 NEW! Label Activity Explorer Requires E5 How frequently a label is applied Who applied label Label changes Export information 48

49 Retention and disposition alternatives Out-of-the-Box SharePoint Records Management In-Place vs. Records Center site Managed Metadata Service, Content Types, Content Organizer, Policies, Document Sets Lacks key features such as event based retention, physical records mgt., Out-of-the Box PLUS 3 rd Party Tool File plan management, auto-classification, event based retention, bulk disposition Enterprise Content Management (ECM) or Enterprise Records Management (ERM) Centralized, integration with multiple repositories, physical records management 49

50 Data Loss Prevention (DLP) Detects sensitive data and information At-rest and in-motion Based on policy Educates users about sensitive data Reports for compliance, legal, and information governance Conditions If contains PII Actions Restrict access User Notifications Contains PII Currently addresses: Exchange (more robust capabilities for ) SharePoint OneDrive for Business User Overrides Ok to send Reports 50

51 Supervision Monitor and review messages sent or received by identified users Report on reviewed messages Create lexicon and choose sampling % Built-in review 51

52 Compliance: Preservation Lock Preserve ESI for a minimum period of time No alteration or changes permitted to policy once its locked Supports compliance with financial industry regulations SEC 17A-4 FINRA 2210 (12-29) FINRA 3012 Activation via PowerShell 52 52

53 Azure Information Protection Cloud based information protection Classification Manual or automatic Label and marking Information Rights Management (IRM) Two major components: 53 Administrator configuration Client

54 Data Import 54

55 ediscovery in Office 365

56 What types of ESI may be found in Office 365?

57 ESI available for discovery in O365 Exchange Online SharePoint Online Teams Sway - -Calendar -Contacts -Tasks -Notes -Files of virtually any type (maximum of 10 GB) -Web pages, such as blogs/wikis -Lists -App data -Chats (group and private) -Calendar -Files (SharePoint Document Library) -OneNote -SharePoint Team Site -Content creation tool -Content itself -Journal *Exchange Public Folders OneDrive for Business -Files created using web apps (Word, PowerPoint, Excel) -Files uploaded (maximum of 10 GB) -Files uploaded can be virtually any type Skype for Business -Instant Messaging (IM chats) -Voice call logs Groups and Planner -Conversations ( s) -Calendar -Files (SharePoint Document Library) -OneNote -SharePoint Team Site -Planner Yammer -Messages -Announcements -Notes -Files -Notifications ****Yammer can now have a Group Subject to builtin tools Not Subject to built-in tools 57

58 History of O365 s ediscovery tools Office 365 available 3/2011 Exchange 2010 Exchange Control Panel (ECP) Exchange 2013 Exchange Admin Center (EAC) SharePoint 2013 SharePoint ediscovery Center Equivio Acquisition Security & Compliance Center* Discovery Search Discovery Mailbox Litigation Hold Introduce In-Place Hold Improved indexing New search syntax (KQL) SharePoint and Exchange content Case model Filtering January 2015 acquisition date Structured analytics Technology Assisted Review Built from ground up in O365 More scalable, faster exports 2011 February 2013 February 2013 December 2015 Q ediscovery tools differ significantly between legacy and Security & Compliance Center Underlying PowerShell cmdlets are different Some organizations are still using litigation hold legacy cmdlets due to processes set up pre-security & Compliance Center: -LitigationHoldEnabled $True 58 Litigation Hold In-Place Hold 58

59 Legacy tools Exchange Admin Center (EAC) SharePoint ediscovery Center 59

60 In a nutshell: ediscovery Features in Office 365 Standard ediscovery (E3) 1. Search across one or more mailboxes, OneDrive for Business, SharePoint sites, O365 Groups, Teams Keywords, proximity, date range, metadata 2. Preserve In-Place (hold) No disruption to custodians they don t know they are on hold No collect or copy to preserve No journaling 3. Preview preserved content Not a review tool! 4. Collect and export Mailbox ESI PST or MSG ODB and SharePoint ESI Native 60

61 Standard ediscovery workflow Options Boolean, Proximity, Wildcard, date range, metadata Exchange = PST, MSG Mailboxes SharePoint Sites Skype for Business Exchange Public Folders SharePoint = Natives,.csv Groups OneDrive for Business Teams 61

62 In a nutshell: ediscovery Features in Office 365 Advanced ediscovery (Equivio Zoom) (E5) Advanced Analytics Near-duplicate detection Thread analysis Predictive coding ( relevance ) Themes * Advanced ediscovery E5 Processing: export review-ready load file Includes native files Metadata HTML Advanced analytic values Advanced ediscovery E5 62

63 Advanced ediscovery Workflow Options Options 1. Create case 2. Assign permissions 3. In-place hold on entire source or scoped 4. Create content search 5. Preview search results 6. Advanced ediscovery Express Analysis 7. Advanced ediscovery Relevance 8. Export loadready data 9. Eyeballs on data Boolean, Proximity, Wildcard, date range, metadata Themes Themes Mailboxes Skype for Business Near duplicate detention Near duplicate detention SharePoint Sites Exchange Public Folders threading threading Groups OneDrive for Business Predictive Coding Teams E3 E5 Provider Identification, Preservation, Collection Processing, Analysis Review, Production 63

64 What DOESN T Office 365 ediscovery do out-of-the-box? Legal hold notification and workflow Telling custodians they are on hold and tracking acknowledgements Sending out questionnaires Providing audit trail of when and who is on legal hold Does not identify, preserve, or collect ESI located outside of Office 365-for example: Desktop, laptop, tablet computers File (network) shares Smartphones Full ediscovery processing Review Production 64

65 Enabling defensible legal hold: Recoverable Items Folder Users do not have access to the recoverable items folder ediscovery search and hold does have access Has its own quota of 100 gig (if legal hold enabled) Can view via MFCMAPI client Deletions Contains all items deleted from the Deleted Items folder. This folder is seen by end users via Recover Deleted Items Versions If hold in effect, contains original and modified copies of the deleted items Purges If hold OR SIR in effect contains all items that are purged ( dumpster deleted/triple deleted) Audits If mailbox logging is enabled, contains mailbox audit entries DiscoveryHolds If scoped hold in effect this is where purged items go Calendar Logging Contains calendar changes that occur within a mailbox 65

66 Enabling Defensible Legal Hold: Preservation Hold Library A preservation hold library is created the first time a SharePoint site is put under hold. Users can continue to work on content without disruption Content on hold-including web pages, documents, lists, and other items are preserved as needed (if user edits an item it prompts preservation) Users don t see the preservation hold library To preserve all versions of content in a site versioning must be enabled 66

67 ediscovery permissions ediscovery Administrator Can see all cases Can create new cases Can assign cases to self or ediscovery managers ediscovery Manager Can see own cases or those assigned to him/her Can create new cases Can assign other ediscovery Manager to their cases Permissions filtering 67 Restrict the mailboxes and sites an ediscovery Manager can access May use recipient fields to limit (country, department, title, custom, etc.) Assign to outside counsel and service provider *Does not require a license Center-5b9a067b-9d2e-4aa5-bb33-99d8c0d0b5d7?ui=en-US&rs=en-US&ad=US

68 Permissions Filtering (Scoping ediscovery Manager Access) ediscovery Administrators and Managers by default can search all mailboxes, SharePoint sites, Groups, Teams, etc. Restrict ediscovery Manager to searching: Subset of mailboxes AND sites Content that meets specific search criteria (i.e., must contain word Microsoft ) Recipient filter City, Company, Country Code, Custom Attribute, etc. ( Searchable message property filter Managed via PowerShell (requires Organization Management membership) Requires connecting to BOTH Exchange Online and SCC Applies to inactive mailboxes Does NOT apply to Exchange Public Folders 68

69 ediscovery Permissions 69 Role Case Management Lets users create, edit, delete, and control access to ediscovery cases in the Security & Compliance Center. For more information, see Manage ediscovery cases in the Office 365 Security & Compliance Center. As previously explained, a user must be assigned the Case Management role before you can use the Add-eDiscoveryCaseAdmin cmdlet to make them an ediscovery Administrator. Compliance Search Lets users run the Content Search tool in the Security & Compliance Center to search mailboxes and public folders, SharePoint Online sites, OneDrive for Business sites, Skype for Business conversations, Office 365 Groups, and Microsoft Teams. This role allows a user to get an estimate of the search results, but additional roles are needed to perform actions such as previewing, exporting, or deleting search results. For more information about Content Search, see Run a Content Search in the Office 365 Security & Compliance Center. Export Lets users export the results of a Content Search to a local computer. It also lets them prepare search results for analysis in Advanced ediscovery. For more information about exporting search results, see Export search results from the Office 365 Security & Compliance Center. Hold Lets users place content in mailboxes, public folders, sites, Skype for Business conversations, and Office 365 groups on hold. When content is on hold, content owners will still be able to modify or delete the original content, but the content will be preserved until the hold is removed or until the hold duration expires. For more information about holds, see: Manage ediscovery cases in the Office 365 Security & Compliance Center Overview of retention policies Preview Lets users view a list of items that were returned from a Content Search. They ll also be able to open and view each item from the list to view its contents. Compliance Administrator ediscovery Manager & Administrator Organization Management X X X X X X X X X X Review Let's users see and open the list of the cases on the ediscovery page in the Security & Compliance Center that they are members of. They can't perform any other case management tasks. X X RMS Decrypt Let's users decrypt RMS-encrypted messages when exporting search results or preparing search results for analysis in Advanced ediscovery. For more information about decrypting search results during export, see Export search results from the Office 365 Security & Compliance Center. Search And Purge Lets users perform bulk removal of data matching the criteria of a content search. For more information, see Search for and delete messages in your Office 365 organization. X X X Reviewer

70 Versions: copy-on-write 70

71 File Formats Indexed by Exchange Search in Office 365 message Graphics Interchange Format JPEG Microsoft Excel Excel File Microsoft InfoPath Microsoft Office Binder Microsoft PowerPoint Microsoft Publisher Microsoft Word Microsoft XML Paper Specification OneNote OpenDocument Presentation OpenDocument Spreadsheet OpenDocument Text Outlook Item Portable Document Format Rich Text Text vcalendar vcard Visio Web archive Web page XML document ZIP archive 71.eml.gif.jpeg.xls,.xlt,.xlsx,.xlsm,.xlb,.xlc,.xlsb odbcexcel.infopathml.obt, obd.pptx,.pptm,.ppt,.ppsx,.ppsm,.pps,.ppam,.potm,.pot,.potx.pub.doc,.docm,.dotx,.dotm,.dot,.docx.xps.one.odp.ods.odt.msg.pdf.rtf.txt.vcs.vcf.vdw,.vsd,.vss,.vst,.vsx,.vtx,.vssx,.vssm,.vsdm,.vstx,.vstm,.vdx.mhtml.html.xml.zip Items Not Indexed Include AVI Bitmap MP3 MPEG PNG Microsoft Windows Wave Audio.avi.bmp.mp3.mpeg.png.wav

72 File Formats Indexed by SharePoint in Office

73 Security & Compliance Center Search Metrics 73 cb19ed3bff4a?ui=en-us&rs=en-us&ad=us#moreinfo

74 Limits: ediscovery cases & holds 74

75 Estimated vs. actual ediscovery search results Estimate search results are different than the search results generated when an export is created Live index (O365) vs. processed or journaled ESI What causes the differences? Estimated search results are based on the retrieval of message IDs Export search results are based on retrieval of the actual messages Changes that occur between time when estimate search is run versus export search Unindexed items Exporting results of a Content Search that includes all content locations Raw file formats versus exported file formats Document versions (for SharePoint, not included in estimate) De-duplication 75

76 Security & Compliance Center Exports You can export a maximum of 2TB from a single Content Search Maximum size of PST export is 10 GB (can be modified via registry setting on target computer) Max of 10 simultaneous exports Max of 3 per user Max of 2TB per day per tenant RMS encrypted items ( only) To decrypt must export as individual (.MSG) messages Will NOT decrypted RMS protected attachments only the Office 365 encrypted items located inside of Inbox are NOTE decrypted Reports Export Summary; content sources searched, estimated and actuals for search results and downloads Manifest: XML load file ResultLog: spreadsheet with information about each item downloaded Message location in mailbox Sent or received date of message Subject line from message Sender and recipients 76 URL for document URL for site collection from which document came Date document was last modified Name of the document Export: from-the-office-365-security-compliance-center-ed48d c42-85f5-10f75f6a4278 Change PST size: search-th box-and-onedrive-for-business-site-for-a-list-of-users-5f4f8206-2d6a-4cb2-bbc6-7a cc0

77 Security & Compliance Center Exports: best practices Increase download speed Launch and manage exports on separate machine Located in optimized network segment for bandwidth, minimal latency to internet Run 24 x 7 uninterrupted Multiple export accounts: single user able to launch 10 simultaneous exports Microsoft asserts exports run faster in bulk Create an export job of 22 mailboxes NOT 22 separate export jobs (one per mailbox) 77

78 Limitations and Caveats (Security & Compliance Center) 78 Description of Limit Maximum # of mailboxes searched in a single search: Maximum # simultaneous searches Maximum # of items per user mailbox presented in Preview 100 Maximum # of items from all user mailboxes presented in Preview Unlimited Unlimited 1,000 (Newest items) Maximum # of user mailboxes presented in Preview 1,000 (Mailboxes with most search results ) Maximum # of items from any given SharePoint site and ODB presented in Preview Maximum # of sites that can be presented in Preview Maximum # of items per Exchange Public Folder presented in Preview 100 Maximum # of items found in all Exchange Public Folders presented in Preview Maximum # of Exchange Public Folders presented in Preview 200 (Newest items) Limit 200 (Sites with most search results) (Mailboxes with most search results)

79 Limitations and Caveats (Security & Compliance Center) Description of Limit Maximum # of keywords in search 500 Maximum number of variants returned when using a prefix wildcard to search for an exact phrase in a keyword search query of when using a prefix wildcard and the NEAR OR ONEAR Boolean operator Maximum # of characters for the search query (including operators and conditions) for a Content Search Minimum # of variants returned when using a prefix wildcard to search for an exact phrase in a search query or when using a prefix wildcard and the NEAR or ONEAR Boolean operator Minimum # of alpha characters for prefix wildcards 3 10,000 Limit Mailboxes=10,000; Sites=4,000 when searching all sites OR 2,000 when searching up to 20 sites 10,000 79

80 Preview File types that can be previewed txt, html, mhtml eml doc, docx, docm pptm, pptx pdf Contain file types: can view list of files in the container zip gzip 80

81 De-duplication de-duplication based on hash value calculated using: InternetMessageId This property specifies the Internet message identifier of an message, which is a globally unique identifier that refers to a specific version of a specific message. This ID is generated by the sender's client program or host system that sends the message. If a person sends a message to more than one recipient, the Internet message ID will be the same for each instance of the same message. Subsequent revisions to the original message will receive a different message identifier. ConversationTopic This property specifies the subject of the conversation thread of a message. The value of the ConversationTopic property is the string that describes the overall topic of the conversation. A conservation consists of an initial message and all messages sent in reply to the initial message. Messages within the same conversation have the same value for the ConversationTopic property. The value of this property is typically the Subject line from the initial message that spawned the conversation. BodyTagInfo This is an internal Exchange store property. The value of this property is calculated by checking various attributes in the body of the message. This property is used to identify differences in the body of messages. If values for two or more of above are the same the message is deemed duplicate ****Messages a user edits but doesn t send are identified erroneously as duplicates US&ad=US 81

82 De-duplication 82

83 Unindexed Items Certain attachments Certain files uploaded to SharePoint, OneDrive for Business, and other repositories within O365 Examples of unindexed items Image files (TIFF, non-search PDF, etc.) CAD, CAM Large Excel files (4 MB+) Encrypted Password protected File formats that can t be indexed such as Bitmap, MP3 If the search that your exporting results from was a search of specific content locations or all content locations in your organization, only the unindexed items from content locations that contain items that match the search criteria will be exported to export unindexed items from all content locations for a search, configure the search to return all items (by removing any keywords from the search query) and then export only unindexed items when you export the search results If you create a query based hold, ALL unindexed items are placed on hold Indexing limit Maximum attachment size (excluding Excel files) Maximum size of Excel files Maximum value 150 MB 4 MB Maximum number of attachments 250 Maximum attachment depth 30 Maximum number of attached images 0 Maximum time spent parsing an item Maximum parser output Maximum annotation tokens Maximum body size in index Maximum unique tokens in body 30 seconds 2 million characters 2 million 67 million characters 1 million 83

84 Unindexed items Exchange SharePoint, OneDrive 84

85 Office 365 Resources

86 support.office.com 86 US&ad=US

87 docs.microsoft.com 87

88 TechNet 88

89 Trust Center 89

90 Excellent Reference 90

91 Video blog 91

92 Roadmap 92

93 Microsoft Ignite To access free recorded sessions go to: Annual conference 20k+ attendees Major product announcements Roadmaps ediscovery sessions with Microsoft experts, including E.J. Bastien and Rachi Messing Reduce legal fees and gain insight into your data leveraging Office 365 Advanced ediscovery How Microsoft Legal drives down ediscovery costs with machine learning in Office 365 Quickly find what s relevant and reduce risk with intelligent ediscovery in Office

94 White papers /Office-365-meets-evolving-eDiscovery-challenges-ina-cloudfirst-world