eDiscovery Inside and Outside M365

Brian Tuemmler


The eDiscovery world is a fickle market. Seemingly normal and mundane tasks take on an important air of formality in the legal world. Consistency is key because the risks involved with a lack of consistency can be devastating. Did you produce everything you had? Are you hiding something? At the core, the evidence found in your structured and unstructured; governed and ungoverned information is critically important to uncovering the truth.

At Infotechtion, we spend a lot of time helping organizations with cobbled together solutions for eDiscovery, Information Governance, and content management streamline their workflow and technology stacks.

Ediscovery Reference Model

Microsoft is creating a critical decision point for a number of our clients with their continued development of eDiscovery capabilities for content within M365. There are many necessary and sophisticated eDiscovery features available, from case management, predictive coding classifiers, near duplicate analysis, threading, and legal export found in many of the best tools out there. The limitation is that it works if you already have all your content in the cloud. If you don’t, you have three ways to respond:

  • Get your content in the cloud. Long term, this is feasible and perhaps a goal of many organizations. It is a limited short-term answer as migration takes time and serves practically little other purpose without adding appropriate governance and moving users to the new world.

  • Index your on-premise and cloud content using traditional eDiscovery tools. Many tools can reach into SharePoint, Exchange and Teams content as well as a wide variety of other sources from social media to phones. You have the decision here as to the price of an eDiscovery tool versus E5 licenses.

  • Choose a hybrid approach and do some of each. This last option creates the risk of multiple workflows which can reduce your ability to respond consistently. It does, however meet short term eDiscovery needs while enabling longer term IG capabilities.

The real reason to choose number three is that new WORK is currently being done in M365. The highest value, biggest risk and largest volume of new content already resides in a platform that can now do your eDiscovery, Legal holds and document management. This last option actually provides amazing benefits if you have a technology savvy legal department. There is no need to keep a separate paper evidence management system, a separate legal hold system, a separate subject access request system. You might find that you need some technology help to cover these Office 365 compliance features for legacy content, but over time that need will diminish. When that happens, the licensing costs and technical support efforts to maintain similar and overlapping systems will also go away.


A strategic view of the EDRM model, leveraging M365 capabilities allows you to minimize manual processes, redundant technologies, and provides greater control, efficiency and consistency. Our approach includes:

  • Review of existing supporting eDiscovery technologies from collections, legal hold, culling and analysis, preservation, and production to identify workflow efficiencies, license rationalization and cost savings

  • Information Governance strategy to examine related tasks around data minimization, content organization, classification, and compliance to identify positive impact opportunities for the eDiscovery function

  • Workflow analysis to identify ways to streamline and automate the eDiscovery function leveraging the systems where the content already resides.

The good news from a consistency perspective is that creating a similar response between 2 platforms can be made without too much anguish. Here’s why:

  1. The queries you build between an eDiscovery tool and the KQL queries in M365 are pretty close in format and capability, with some planning and conversion you can trust in getting similar responses

  2. Functional of some of those advance features are also quite similar and you can synchronize your collection, culling, analysis, and production tasks without missing too much

  3. Information governance activities (on the left of the EDRM) can be leveraged effectively for both M365 and ungoverned locations. One of the greatest points of duplication, for example, is not within, but between, shared drives, email systems and SharePoint sites. Your definitions for expired records and useless content don’t generally care in which environment the content resides

  4. With more careful planning about metadata capture, you can be in a position to ensure that legal work product in tagging responsiveness and privilege can be re-used I future litigation. This work is expensive and reusing it can add significant value

The point to remember is, when a discovery request comes, in you don’t want to have to suddenly migrate your content to M365 just in order to respond to the litigation. However, migrating it there with intent, purpose and governance over time will have benefits in many other areas as well. It can make more sense in the short term to use a data discovery tool in a hybrid environment, especially if you already have access to such a tool, for both IG and eD.

When you recognize that a single platform, where all your new work happens, also meets your legal needs, you also realize that the same platform, with no additional technology is also meeting your compliance mandates, records management imperatives, and business collaboration needs in a viral way. That is what true information governance really looks like.

Adopting an M365 platform is easy. Making it work well for all these constituents does require strategy and planning. Making it work in a hybrid legal environment also requires some experience in process management and integration. If you would like to discuss potential data discovery architectures that co-exist with M365, please give our team a call.

 © 2024 Infotechtion. All rights reserved 


By submitting this form you agree that Infotechtion will store your details and send future resources. You may opt-out any time.

Recent posts

Job application.

Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorestandard dummy text ever since.

Please fill the form

Job application.

Join Infotechtion for an impactful career filled with passion, innovation, and growth. Embrace diversity, collaboration, and continuous learning. Discover your potential with us. Exciting opportunities await!

Please fill the form

By submitting the form, you confirm that you do not require a visa sponsorship to work in the country of application.