The popularity and use of collaboration tools has greatly increased over the past few years. New sources of data create new places from which data must be collected and reviewed for eDiscovery purposes. This is especially true as the world moves more toward distributed workforces.

 

One of the more widely used collaboration tools is Microsoft Teams. Teams allows users to collaborate through chat functions, audio/video meetings, screen sharing, and file sharing. All of these features create different types of data stored within the Microsoft Office 365 environment. Understanding where Teams data is stored and how it can be searched and exported is important when it must be collected for electronic discovery or for other legal and compliance reasons.

 

 

Where is Microsoft Teams Data Stored?

 

Understanding where Teams data and related data is stored is important to eDiscovery considerations. Generally, Microsoft data is hosted within Microsoft Azure. Azure is a cloud service provider powered by data centers around the world. More specifically, Teams data is located in the geographic region associated with an organization’s O365 environment.

 

For example, an organization located in Germany or France will have its data stored in those respective countries. For an organization located in another EU country, the data is likely stored in data centers located in Austria, Finland, France, Ireland, or the Netherlands.

 

Aside from the physical location, Teams data is decentralized, meaning that data is not stored in one location or server. Often, data is stored this way for security reasons or to protect against service outages.

 

Teams data is decentralized based on the app associated with the content: Microsoft Exchange (messages), Microsoft Stream (recordings), Sharepoint (files), and OneDrive for Business (files). Data from other Microsoft apps may be displayed and accessible within Teams even though it is stored elsewhere. Further, Teams data may also be stored with a third party when integrations with third-party apps are enabled. For example, Teams supports integration with Box, a cloud-based file sharing and content management service.

 

 

Storage Locations

 

The storage location for Teams data depends on the feature or content. The below table breaks down the storage location for common Teams content.

 

Content Storage Location
Direct messages Exchange Online mailbox of all participants
Files shared in direct messages OneDrive for Business account of the participant who shared the file
Group messages Exchange Online mailbox of all participants
Files shared in group messages OneDrive for Business account of the participant who shared the file
Channels Exchange Online mailbox associated with the team that belongs to the channel
Files shared in channels Sharepoint site associated with the team that belongs to the channel
Private channels Exchange Online mailboxes of all participants
Files shared in private channels A dedicated Sharepoint site associated with the private channel
Channel meeting recordings Sharepoint site associated with the team that belongs to the channel
Ad hoc/scheduled meeting or call recordings OneDrive for Business account of the participant that selected the Record option (for example, if the organizer of a scheduled meeting clicks Record, the recording is stored on the organizer’s account)

 

 

Using Microsoft eDiscovery to Collect Teams Data

 

Collecting and searching Teams data using Microsoft’s eDiscovery features may require a certain degree of technical expertise to ensure that all data is accounted for. This expertise includes knowledge of PowerShell. Users must be able to run PowerShell commands and scripts to search for all content types and data sources not stored in their Exchange Online mailboxes (i.e. file shares, call recordings, meetings, etc). For example, to search for the content of a guest user you first need to obtain the guest’s user principal name,  or UPN,  via a PowerShell command. 

 

Further, users must select the correct data sources per custodian for proper Teams data collection and preservation using Microsoft’s eDiscovery features. For example, the failure to select the proper Sharepoint site as a data source could result in files shared in a private channel not being collected.

 


Let's discuss your data collection needs! hbspt.cta.load(2664666, ‘c4bcf994-3a24-4071-be4a-99a1866a83da’, {“region”:”na1″});  

Exporting Microsoft Teams Data

 

Teams data is generally exported as a collection of .PST files. This data is unorganized and unstructured. Channel and chat messages are not nicely displayed one after the other as you see within the Microsoft environment. Instead, you may see a collection of individual messages which are difficult to interpret. Outside help and technologies may be needed to organize the data so the messages appear as threads and are connected in a logical sense when receiving an export of Teams data for review. This is an important consideration for processing Teams data because wasted time due to inefficient workflow can greatly increase review costs.

 

 

Be Aware of Microsoft eDiscovery Requirements and Limitations

 

To ensure all desired Teams data is collected, it is important to note a few requirements and limitations of Microsoft eDiscovery.

 

  • Microsoft has minimum licensing requirements to use retention policies for Teams data and for access to its complete suite of eDiscovery capabilities. Organizations need the O365 E3 license at minimum to have access to eDiscovery capabilities. However, some of the more robust capabilities require a higher-tier license.
  • Teams data requires separate retention policies than the organization-wide retention policies for Exchange Online. Exchange Online policies do not apply to Teams data even though part of the data is stored in Exchange Online mailboxes. Teams retention policies need to be created through the Teams admin center.
  • Some content types within Teams are not discoverable using Microsoft eDiscovery. One such content type is activity feed notifications. These notifications provide information about the activity of users within Teams. The notifications can show the user that initiated the activity, the reason for the activity, and the time stamp of when it occurred.
  • Microsoft’s eDiscovery capabilities do not support searching a single channel. Searches are conducted at the team/custodian level. Therefore, the Exchange Online mailbox associated with the team that belongs to that channel must be searched.

 

 

The Importance of a Consistent eDiscovery Workflow

 

As demonstrated above, identifying, collecting, and reviewing data for eDiscovery is becoming more complex. It’s important to maintain a consistent eDiscovery workflow to simplify the collection and review of complex data like Teams. This consistency is essential for supporting defensibility. Mistakes and oversights with Teams data could prove costly if a court requires you to do over a collection due to missed data.

 

If you need assistance with Teams data for eDiscovery, let us know. We can help.

 

hbspt.enqueueForm({
portalId: 2664666,
formId: “ad7118d7-b543-47cf-993b-c90a49e416a2”,
target: “#hbspt-form-1636572676000-9161028165”,
shortcode: “wp”,
region: “”,

});