How To Search Microsoft Teams for an eDiscovery Investigation

Many companies rely on platforms such as Microsoft Teams for their communication needs. This multifaceted tool can store conversation history and other data for later reference, which is vital to businesses of all sizes for eDiscovery purposes. Cloudficient explains how to search Teams for an eDiscovery investigation.

What Is Microsoft Teams?

Teams is a multi-functional communications platform and part of the Microsoft 365 suite. Around 270 million people are active users of this powerful platform. Using this software, large and small groups can:

• Chat
• Make cloud calls
• Video conference
• Share and edit files collaboratively
• Integrate workflows and apps

Whether users are across the hall or the country, Teams is reliable and available for Android, iOS, Mac, and Windows. Many Microsoft and third-party apps can integrate with Teams. Compatible apps are available for:

• Project management
• Customer support
• Translators
• Polls
• Billing, productivity, and employee tracking

You can also develop apps to use with Teams.

What Data Does Microsoft Teams Store for eDiscovery?

All Teams content isn’t available through eDiscovery. Using Microsoft’s tools, you can search for things such as:

• One-on-one and group chats and shared files
• Channel messages and shared files
• Wiki data
• Meeting metadata
• Images
• Audio and video recordings

Teams stores data and distributes it differently according to the type of channel used.

What Are Microsoft Teams Channels?

Teams users can be members of standard, private, and shared channels. Every channel has an individual SharePoint site.

• Standard channels are open to all members of a team; owners can limit permissions for individual members.
• Private channels are accessible by invitation only to have private discussions that all team members aren’t privy to. Guests can’t create private channels or access data when conversations end. Private channels link to the associated parent team.
• Shared channels are used to collaborate with people outside and inside organizations. Shared channels require an invitation to access them, and shared channel owners are the only ones permitted to share the channel or add members.

Standard channel data goes to the mailbox of the team. OneDrive for Business and SharePoint Online facilitate eDiscovery for standard channels. Users who record Teams meetings can access the data in their OneDrive for Business accounts.

Each member of a private channel receives compliance copies of data. eDiscovery, therefore, requires searching multiple user mailboxes for message contents.

The parent team’s mailbox receives the compliance copies for shared channels. Microsoft Teams doesn’t support single-system mailbox eDiscovery searches, so you must access the parent team mailbox.

What Is eDiscovery?

eDiscovery is the process of locating and extracting electronically stored information for legal purposes. Lawsuits or internal investigations often require documents such as:

• Emails
• Databases
• Documents
• Presentations
• Video and audio files

Because many aspects of business transpire on Microsoft Teams, investigators must access the platform to find relevant data. The original metadata is vital because it isn’t easily altered and can prove that associated data is authentic.

Metadata for calls and meetings includes:

• Starting and ending times, and total duration
• Each participant’s joining and leaving times
• Anonymous, federated user and guest joins
• VOIP calls and joins

Corporate managers and legal advisors set communications compliance guidelines for their organizations. All licenses for Microsoft 365 include Compliance Center / Microsoft Purview, although some licenses provide more robust eDiscovery features than others.

Microsoft Purview offers eDiscovery tools, but it has limitations.

Where Do You Need To Search?

When eDiscovery is necessary, you must search for all relevant data. The type of user, channel, and data determine where you need to look.

Private Channels

For private channels, you must first identify the parent team, the private channel owner, and the members. Use the current Teams PowerShell module version to locate this information. Use the resulting list of mailboxes with your eDiscovery tools to locate data.

SharePoint Sites

Shared and private channels store files using specific SharePoint sites. You’ll need to find the appropriate URL to access this data using SharePoint Online Management Shell. With the proper commands, you can locate site URLs for shared and private channels.

Guests

Guests can chat with members of your organization or solely with other guests. Microsoft Teams stores guest chat data that is accessible with eDiscovery tools. Use Azure AD PowerShell and Security & Compliance PowerShell to identify user principal names and search for all content related to that guest’s name.

Cards

Cards are user interface containers that apps or users within Teams can generate. Cards hold small amounts of content and may include multiple attachments and properties. Teams stores cards in spaces correlating to where they originated, in group or individual mailboxes. Teams provides tools to search for cards.

Is Microsoft Teams eDiscovery Always Permitted?

Individual meeting constraints, in some instances, govern who can use eDiscovery to search for content:

• Guests:Only authorized admins from the Teams meeting host organization can use eDiscovery; guests don’t have access.
• External access:Some Teams meetings allow attendees from external organizations to connect using external access. For these meetings, authorized admins from both organizations have access to meeting data for eDiscovery.

How Can Cloudficient Help With Microsoft Teams eDiscovery?

Cloudficient focuses on creating and offering products to meet ever-changing client needs. Our next-generation migration and eDiscovery technology solutions are revolutionizing how companies migrate their legacy systems and data to cloud-based storage. Our solutions are seamless, fast, and completely scalable.

Whether you’re looking for assistance with cloud migration to support eDiscovery with Microsoft Teams, compliance migration, data expiration, or restructuring, mergers, and acquisitions, Cloudficient can help. Use live chat, email us, or submit our contact form to learn more.

With unmatched next generation migration technology, Cloudficient is revolutionizing the way businesses retire legacy systems and transform their organization into the cloud. Our business constantly remains focused on client needs and creating product offerings that match them. We provide affordable services that are scalable, fast and seamless.

If you would like to learn more about how to bring Cloudficiency to your migration project, visit our website, or contact us.