So, You’re Using Microsoft 365 Now. Should it Be Your eDiscovery Solution As Well?

Written by Doug Austin, Editor of eDiscovery Today

Last week, I discussed the move toward cloud-based office suite technologies, which has only accelerated since the pandemic with so many workforces working remotely. As part of that, Microsoft 365 is now used by over a million companies worldwide, with over 650,000 companies using it in the United States alone.

So, even though more of you in the cloud use Google’s G Suite for your office suite needs (surprise!), many of you are using M365. So, should you use it as your eDiscovery solution as well? Here are three factors to consider, based on my experience.

The Version of M365 You Need for eDiscovery

Not all Microsoft 365 subscriptions provide access to eDiscovery licenses and there are two versions of eDiscovery modules for M365: Core eDiscovery and Advanced eDiscovery. Accessing Core eDiscovery requires at least Microsoft 365 E3 or Office 365 E3 subscription-level access.

With either, a user can be assigned the E3 license, which supports placing eDiscovery holds on mailboxes and sites. Access to Advanced eDiscovery requires either the E5 Compliance Management add-on to E3, Microsoft 365 E5 or Office 365 E5 subscription-level access.

What’s the difference between the two? As the name implies, Core eDiscovery provides basic features like mailbox, site and SharePoint holds, content search to run search queries, ability to export results and duplicate detection. Advanced eDiscovery provides several additional features like custodian specification, review sets, tracking of performed jobs, email threading, near duplicate detection and optical character recognition (OCR), which (in my experience) is needed in pretty much every case.

Unless your discovery needs are extremely basic, you’ll need Advanced eDiscovery to manage your discovery workflow. The cost for E5 licenses is almost twice as much as the cost for E3 licenses, so keep that in mind.

Repositories and File Types Supported

Here is one of the biggest questions you should ask yourself when considering any eDiscovery solution, whether it’s M365 or any other eDiscovery solution: where is my potentially responsive data? If all or most of it is in M365, great; if not, those are sources of data that won’t be accounted for in M365’s eDiscovery modules.

Do you have on premise data that needs to be discovered? Legacy data? Mobile device data? Data from social media platforms? Do you use something other than Teams for collaboration?

Many companies use multiple collaboration app platforms. If so, none of those sources will be addressed in M365 eDiscovery.

And the number of file types supported is important as well. Per their documentation, Advanced eDiscovery supports (according to my count) 63 file types. Does that seem like a lot? It’s not.

Take IPRO® for enterprise, for example – it supports over 500(!) file types. There are many types of files that you might encounter in a typical discovery project – a lot more than you might think.

Unless your sources of data and file types are significantly limited, you’ll still need an eDiscovery solution to address the ones that M365 doesn’t have.

Search Considerations

Certainly, you need robust search capabilities in your eDiscovery solution, right? Here are four limitations with Advanced eDiscovery that I’ve observed:

  • Content search preview is limited: If you want to review your search results to evaluate the effectiveness of your search, you’re limited to a view of 100 to 1,000 items to do so per mailbox, which means that the most important items may not appear if they’re well down the list.
  • Limit to 50 key words per search: You think 50 key words is plenty? You haven’t worked with some of the attorneys I’ve worked with. Also, you don’t get a unique hit count per term to identify the terms that are driving up the size of the result set.
  • Limited wildcard capabilities: Advanced eDiscovery only supports prefix wildcard searches and the prefix must include at least 3 characters. Suffix, infix and substring wildcard searches are not supported.
  • Searches are slow and/or tedious: Complex searches tend to be slow in M365 eDiscovery modules and you often have to search multiple locations or mailboxes independently, which is tedious and time consuming.

Those are just a few of the search limitations to be aware of when considering M365 eDiscovery.


There are plenty of other considerations when considering M365 as your eDiscovery solution – more than will fit in a single blog post. It’s important to do the research and address the tough questions you need to make an informed decision.

With that in mind, here’s a link to download a white paper by Osterman Research (sponsored by IPRO) that looks at several other considerations and many additional questions you should ask about using M365 as your eDiscovery solution.

Additionally, IPRO and Osterman Research are presenting the webinar Why your Data and Governance Should Never Be Held Hostage–Preventing Single-Vendor Simplicity from Becoming Platform Lock-in on Tuesday, June 22nd at 1pm ET.

During this webinar, IPRO’s Innovation Catalyst Pierre Chamberland will be joined by Michael Osterman, President of Osterman Research, who has been tracking the Data Governance and Retention/Archiving market for close to 20 years. They will discuss questions that will help you determine the long-term policy and financial consequences of a Microsoft-only (or indeed any Single Vendor) approach and offer some valuable tools and models you can use to reach the long-term economic outcomes your organization wants to achieve.

For more educational topics from me related to eDiscovery, cybersecurity and data privacy, feel free to follow my blog, eDiscovery Today!