Understand Office 365 Advanced eDiscovery in the Real-world Microsoft 2016 5/10/2018 11:54 AM THR3074 Understand Office 365 Advanced eDiscovery in the Real-world Brett Trizzino Chas Meier © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

5/10/2018 11:54 AM eDiscovery Today, corporations face overwhelming amounts of electronically stored information. This data can result in a variety of complex issues and substantial costs when responding to litigation matters, government requests, and investigations. eDiscovery is the process of Preserving, Collecting, Processing, Reviewing, and Producing Electronic Information used as evidence in Investigations, Litigation, or Regulatory Request © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

The Cost of eDiscovery 5/10/2018 11:54 AM © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

The eDiscovery Reference Model http://edrm.net/ 5/10/2018 11:54 AM The eDiscovery Reference Model http://edrm.net/ Information Management Identification Preservation Collection Processing Review Analysis Production Presentation Functions Typically Performed Internally Functions Typically Performed Externally $$$ $$$$ $ $ $$ Volume Relevance © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Traditional eDiscovery Cost Model 5/10/2018 11:54 AM Traditional eDiscovery Cost Model © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Key Points To Consider Data Volume Drives eDiscovery Costs 5/10/2018 11:54 AM Key Points To Consider Data Volume Drives eDiscovery Costs A Small Percentage of the Data Processed and Reviewed is Ultimately Responsive Identifying and Removing Non-Responsive Data Earlier can Significantly Reduce eDiscovery Costs © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

eDiscovery Workflow using Office 365 5/10/2018 11:54 AM eDiscovery Workflow using Office 365 © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Preservation Step 1 - Create a Case 5/10/2018 11:54 AM Preservation Step 1 - Create a Case Security & Compliance \ eDiscovery \ Cases Tips: Role Based Access Control using pre-built groups eDiscovery Administrator and eDiscovery Manager Reference: https://support.office.com/en-us/article/Manage-eDiscovery-cases-in-the-Office-365-Security-Compliance-Center-edea80d6-20a7-40fb-b8c4-5e8c8395f6da © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Preservation Step 2 - Create a Hold Add Mailboxes Add OneDrive Sites 5/10/2018 11:54 AM Preservation Step 2 - Create a Hold Add Mailboxes Add OneDrive Sites Optionally Add Terms and Other Conditions Tips: What is Held? Exchange items, such as messages, site and individual mailboxes, calendar items, and tasks Skype conversations that have been archived in Exchange Documents, newsfeed posts, and other SharePoint content Content on file shares OneDrive https://kpmgftech-my.sharepoint.com/personal/<user>_<domain>_onmicrosoft_com Reference: https://technet.microsoft.com/en-us/library/dn790612.aspx © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Collection Step 3 - Create a Search Select Sources for the Search 5/10/2018 11:54 AM Collection Step 3 - Create a Search Select Sources for the Search Add Conditions (e.g. Date Range) Tips: Search All Case Content Feature Coming Be Aware of Unindexed Files Maximum of 500 Keywords per Query 3 characters for prefix wildcards (pre*) and suffix wildcards (*fix) Reference: https://support.office.com/en-us/article/Keyword-queries-and-search-conditions-for-Content-Search-c4639c2e-7223-4302-8e0d-b6e10f1c3be3 © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Collection Step 4 – Prepare Results For Advanced eDiscovery 5/10/2018 11:54 AM Collection Step 4 – Prepare Results For Advanced eDiscovery Select supported items (first option) Include versions for SharePoint Documents Reference: https://support.office.com/en-us/article/Prepare-search-results-for-Office-365-Advanced-eDiscovery-0b6fac2d-8627-4b05-9df0-03609db6248b © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Office 365 Advanced eDiscovery 5/10/2018 11:54 AM Office 365 Advanced eDiscovery With Advanced eDiscovery, you can better understand your Office 365 data and reduce eDiscovery costs. Advanced eDiscovery streamlines and speeds up the document review process by Identifying redundant information with features like Near-duplicates detection and Email Thread analysis. The Relevance feature applies predictive coding technology to identify relevant documents and calculates the relevance of each document in the data set. Advanced eDiscovery uses a proven technology leveraged by major service providers and eDiscovery platforms © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Advanced eDiscovery Step 5 – Load and Process 5/10/2018 11:54 AM Advanced eDiscovery Step 5 – Load and Process Create Advanced eDiscovery Case Load Documents from SCC Prepare and Process Create Issues for Relevance Reference: https://support.office.com/en-us/article/Prepare-search-results-for-Office-365-Advanced-eDiscovery-0b6fac2d-8627-4b05-9df0-03609db6248b © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Advanced eDiscovery Step 6 – Train the Classifier 5/10/2018 11:54 AM Identify an SME to Code Documents as Relevant Not-Relevant Skip Code an Assessment Set and Subsequent Training Rounds (Approximately 2,500 documents) Until the Classifier Reaches Stability Takes Approximately a Day Reference: https://support.office.com/en-us/article/Using-the-Advanced-eDiscovery-Relevance-module-5d671821-d188-42da-a9ce-9cfe92beedfd © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Advanced eDiscovery Step 7 – Export Relevant Documents 5/10/2018 11:54 AM Advanced eDiscovery Step 7 – Export Relevant Documents A Relevance score will be applied to all Documents Choose a Cutoff Score Export Relevant Documents Reference: https://support.office.com/en-us/article/Deciding-based-on-the-results-aed65bcd-0a4f-43e9-b5e5-b98cc376bdf8?ui=en-US&rs=en-US&ad=US © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Advanced eDiscovery Cost Model 5/10/2018 11:54 AM Advanced eDiscovery Cost Model vs Traditional eDiscovery Cost $1,093,703 © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Considerations Handling Unrecognized File Types 5/10/2018 11:54 AM Considerations Handling Unrecognized File Types Select unsupported supported items (last option) Include versions for SharePoint Documents Include in Document Review Process © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Considerations Collect Audit Log Events 5/10/2018 11:54 AM Considerations Collect Audit Log Events Add Conditions (i.e. Date Range) Tips: Start recording user and admin activity Disambiguate document versions shared via Modern Attachments Identify Document Change Activity Identify Document Sharing Activity Reference: https://support.office.com/en-us/article/Search-the-audit-log-in-the-Office-365-Security-Compliance-Center-0d4d0f35-390b-4518-800e-0c7ec95e946c?ui=en-US&rs=en-US&ad=US © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

5/10/2018 11:54 AM Automation © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

TechNet: Office 365 Security & Compliance Center cmdlets 5/10/2018 11:54 AM TechNet: Office 365 Security & Compliance Center cmdlets Auditing Content Search Data Loss Prevention eDiscovery Case (Steps 1-4 Can be Automated) Preservation policy Security and Permissions User and Group Reference: https://technet.microsoft.com/en-us/library/mt587093(v=exchg.160).aspx © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Practical Examples To Get Started… Create, report on, and delete multiple Content Searches https://technet.microsoft.com/en-us/library/mt694128.aspx Use Content Search to search the mailbox and OneDrive for Business site for a list of users https://support.office.com/en-us/article/Use-Content-Search-to-search-the-mailbox-and-OneDrive-for-Business-site-for-a-list-of-users-5f4f8206-2d6a-4cb2-bbc6-7a0698703cc0?ui=en-US&rs=en-US&ad=US © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Deploy, ramp-up on new services and onboard new users with Microsoft FastTrack: http://fasttrack.microsoft.com/

Join the Microsoft Tech Community to collaborate, share, and learn from the experts: http://techcommunity.microsoft.com

Please evaluate this session 5/10/2018 11:54 AM Please evaluate this session Your feedback is important to us! From your PC or Tablet visit MyIgnite at http://myignite.microsoft.com From your phone download and use the Ignite Mobile App by scanning the QR code above or visiting https://aka.ms/ignite.mobileapp © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Thank You Brett Trizzino - btrizzino@kpmg.com Microsoft Ignite 2016 5/10/2018 11:54 AM Thank You Brett Trizzino - btrizzino@kpmg.com Chas Meier - csmeier@kpmg.com © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

5/10/2018 11:54 AM © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.