eDiscovery Features of
SharePoint 2013 and
Exchange 2013
Paul Branson
Solution Architect
Microsoft
Agenda
On-Premises vs. Online
eDiscovery in SharePoint, Exchange and Lync
Notes on Implementation
How Microsoft does eDiscovery
Getting Help
On-Premises vs.
Online
Deployment Scenarios
eDiscovery in
SharePoint, Exchange
and Lync
eDiscovery Architecture
SharePoint
Content + File Shares
Lync IMs
Exchange Admin Center
SharePoint eDiscovery Center
File Shares
SharePoint ...
Demo
Source Search In-place Preservation Export
SharePoint 2010 and SharePoint 2007 Yes No Yes
Exchange 2010 No No No
SharePoint 2013 Yes Yes Yes
Exchange 2013 Yes Yes Yes
File shares Yes No Yes
Content from External systems No No No
How it fits with the EDRM Model
Information Management Identification Preservation Collection Processing Review Analysis Production Presentation Information Management Identification Preservation Collection Processing AnalysisInformation Management Identification Preservation Collection Processing Review
Analysis Production Presentation
User Mailbox
(6a) Messages purged by DIRW Policy (or maintained for Litigation Hold)
(4b) Message “purged” by user (In-Place Hold)
(3) Message deleted (1) Message delivered Recoverable Items Deletions Inbox Purges Versions Audits Deleted Items … DiscoveryHold Calendar Logging (5) Message Edited
(4a) Message “purged” by user (Litigation Hold / Single Item Recovery)
(6c) MFA evaluates item against hold queries set on mailbox (6b) Mailboxes with SIR and In-Place Hold enabled have expired messages moved (2) Message moved
to Deleted Items
(4a)
(4b)
Lync archives content into Exchange mailboxes when user is on In-Place Hold Includes instant messaging and meeting content
In-Place Hold, eDiscovery, MRM of Lync data consolidated to Exchange tools
Lync 2010 Exchange 2010
Compliance
Archive
Compliance
Lync 2013 Exchange 2013
Demo
Notes on
Implementation Steps
Configure Cases Grant Permissions Create eDiscovery Center Configure SharePoint Search Configure trust relationship in Exchange Configure trust relationship in SharePoint Install Exchange Web Services API in SharePoint
Configure Lync to use Exchange Archiving Enable Archiving in Exchange Install SharePoint, Exchange, and Lync
Configure Cases Grant Permissions Create eDiscovery Center
On-Premises
Online
Multiple Farm Scenarios
eDiscovery Centers
are tied to a Search
Service Application
The Hybrid Scenario
SharePoint Online On-Prem SharePoint content and other content SPO content2 separate search indexes Each contains only local content
Hybrid and eDiscovery
SharePoint Online On-Prem SharePoint content and other content SPO contentHTTP File shares SharePoint User profiles Lotus Notes Documentum Exchange folders Custom - BCS SharePoint SP Apps Devices Non-SP UX
SharePoint 2013 Search Architecture
Public API
Access Considerations
eDiscovery does not override search security filtering
Users responsible for eDiscovery need to have permissions to the select content
Grant users access using a web application user policy Add users as a site collection administrator
For file shares, this must be done at the file share level
Use Groups instead of users
Access to the group(s) can be controlled easier than adding individual users
Prevents search from needing to reindex items
Don’t forget the crawl log
Storage Considerations
In-Place Holds
Preservation Libraries only created when content is edited – documents, pages, lists
Two places where queries can be made
Rate of disk increase will be dependent on rate of change
Search
Amount of content will dictate architecture
Current guidance is 500 GB disk for 10M items – 10M items per index
Search Considerations
Complex queries are more taxing than simple queries
More terms, more operators (AND, OR, NEAR)
eDiscovery features within the eDiscovery feature leverage search
Adding more Exchange sources to a Set increases the number of queries
Adding more SharePoint/File Share sources to a Set increases the complexity of queries
Preview functionality, document counts, query statistics, applying refiners
If shared with Enterprise Search, users could be impacted
Recommend running large queries off hours or properly manage
discovery sets
Export Considerations
Content is downloaded individually using respective
protocols (SharePoint, file shares)
Search is not used during the export process
In general, exports are not expected to affect a SharePoint
environment
How Microsoft Does
eDiscovery
Average Microsoft Case in 2012
12 Custodians Collected & Processed
368.4 GB Reviewed 18.4 GB Produced 4 GB Used 249 pp.
42 Custodians Preserved
1.26TB, or approx. 77,490,000 pages
12 Custodians Collected & Processed
370GB, ~22,140,000 pages
Reviewed
18.4GB, ~1,107,000 pages
Produced
4GB, ~249,254
pages
Used
249pgExchange Mailbox Copies Local Data SharePoint File Shares
Litigation Data Repository
Data Minimization Tool
Linear Review Tool
Review Attorneys Tiffing and Production Tool Production Set • Completely Outsourced
• Inside Corp Firewall • Managed by MSIT • Entirely MS technology
• Outside Corp Firewall • Co-managed by MS
FTEs and Data Center Vendor
• Third party technology
• Completely
Outsourced
• Inside Corp Firewall • Managed by MSIT • Entirely MS technology
Local Data
SharePoint
Linear Review Tool
Review Attorneys Tiffing and Production Tool Production Set File Shares Exchange Servers
Post SharePoint 2013
Where do I get help?!
Microsoft Services eDiscovery Quick Start
Overview of eDiscovery
Collection of your use cases
Set up of full (SharePoint, Exchange, Lync) POC with
pre-built VMs
Import of your SharePoint data
Configuration of eDiscovery features and your use cases
10 weeks, Architectural Guidance, Roadmap,
Documentation
Thank You!
Paul Branson
