ediscovery features of sharepoint 2013 and...

eDiscovery Features of

SharePoint 2013 and

Exchange 2013

Paul Branson

Solution Architect

Microsoft

Agenda

On-Premises vs. Online

eDiscovery in SharePoint, Exchange and Lync

Notes on Implementation

How Microsoft does eDiscovery

Getting Help

On-Premises vs.

Online

Deployment Scenarios

On-Premises Hybrid Cloud

eDiscovery in

SharePoint, Exchange

and Lync

eDiscovery Architecture

SharePoint

Content + File Shares

Lync IMs Exchange Admin Center

SharePoint eDiscovery

Center

File Shares

SharePoint

...

SharePoint eDiscovery Center

eDiscovery Center & Case Management

Dataset Management

SharePoint Legal Holds

Demo SharePoint eDiscovery Center

Source Search In-place Preservation Export

SharePoint 2010 and SharePoint 2007 Yes No Yes

Exchange 2010 No No No

SharePoint 2013 Yes Yes Yes

Exchange 2013 Yes Yes Yes

File shares Yes No Yes

Content from External systems No No No

Sources and Capabilities

How it fits with the EDRM Model

Information Management

Identification

Preservation

Collection

Processing

Review

Analysis

Production Presentation Information Management

Identification

Preservation

Collection

Processing

Analysis

Information Management

Identification

Preservation

Collection

Processing

Review Analysis Production Presentation

Evolution of the EDRM Model

Exchange Management

User Mailbox

(6a) Messages purged by DIRW

Policy (or maintained for

Litigation Hold)

(4b) Message “purged” by

user (In-Place Hold)

(3) Message deleted

(1) Message

delivered

Recoverable Items

Deletions

Inbox

Purges

Versions

Audits

Deleted Items

…

DiscoveryHold

Calendar Logging

(5) Message Edited

(4a) Message “purged” by

user (Litigation Hold / Single

Item Recovery)

(6c) MFA evaluates item against

hold queries set on mailbox

(6b) Mailboxes with SIR and In-

Place Hold enabled have

expired messages moved

(2) Message moved

to Deleted Items

(4a)

(4b)

Exchange Legal Holds

Lync archives content into Exchange mailboxes when user is on In-Place Hold Includes instant messaging and meeting content In-Place Hold, eDiscovery, MRM of Lync data consolidated to Exchange tools

Lync 2010 Exchange 2010

Compliance

Archive

Compliance

Lync 2013 Exchange 2013

Preserving Lync Content

Demo Exchange Admin Center

Notes on

Implementation

Implementation Steps

Configure Cases

Grant Permissions

Create eDiscovery Center

Configure SharePoint Search

Configure trust relationship in Exchange

Configure trust relationship in SharePoint

Install Exchange Web Services API in SharePoint

Configure Lync to use Exchange Archiving

Enable Archiving in Exchange

Install SharePoint, Exchange, and Lync

Configure Cases

Grant Permissions

Create eDiscovery Center

On-Premises Online

Multiple Farm Scenarios

eDiscovery Centers

are tied to a Search

Service Application

The Hybrid Scenario

SharePoint Online

On-Prem

SharePoint

content and

other content

SPO

content

2 separate search indexes

Each contains only local content

Hybrid and eDiscovery

SharePoint Online

On-Prem

SharePoint

content and

other content

SPO

content

HTTP

File shares

SharePoint

User profiles

Lotus Notes

Documentum

Exchange folders

Custom - BCS

SharePoint

SP Apps

Devices

Non-SP UX

SharePoint 2013 Search Architecture

Public API

Unit of scale/role boundary

Access Considerations

eDiscovery does not override search security filtering

Users responsible for eDiscovery need to have permissions to the

select content

Grant users access using a web application user policy

Add users as a site collection administrator

For file shares, this must be done at the file share level

Use Groups instead of users

Access to the group(s) can be controlled easier than adding individual

users

Prevents search from needing to reindex items

Don’t forget the crawl log

Access to the crawl log needed for items that could not be indexed

Storage Considerations

In-Place Holds

Preservation Libraries only created when content is edited –

documents, pages, lists

Two places where queries can be made

Rate of disk increase will be dependent on rate of change

Search

Amount of content will dictate architecture

Current guidance is 500 GB disk for 10M items – 10M items per

index

Different types of content will have different storage impacts

Search Considerations

Complex queries are more taxing than simple queries

More terms, more operators (AND, OR, NEAR)

eDiscovery features within the eDiscovery feature leverage search

Adding more Exchange sources to a Set increases the number of

queries

Adding more SharePoint/File Share sources to a Set increases the

complexity of queries

Preview functionality, document counts, query statistics, applying

refiners

If shared with Enterprise Search, users could be impacted

Recommend running large queries off hours or properly manage

discovery sets

Export Considerations

Content is downloaded individually using respective

protocols (SharePoint, file shares)

Search is not used during the export process

In general, exports are not expected to affect a SharePoint

environment

How Microsoft Does

eDiscovery

Average Microsoft Case in 2012

12 Custodians Collected & Processed 368.4 GB

Reviewed 18.4 GB

Produced

4 GB

Used 249 pp.

42 Custodians Preserved 1.26TB, or approx. 77,490,000 pages

12 Custodians Collected & Processed 370GB, ~22,140,000 pages

Reviewed 18.4GB, ~1,107,000 pages

Produced 4GB, ~249,254

pages

Used 249pg

Exchange Mailbox Copies Local Data SharePoint File Shares

Litigation Data

Repository

Data Minimization Tool

Linear Review Tool

Review Attorneys

Tiffing and Production Tool

Production Set

• Completely

Outsourced

• Inside Corp Firewall

• Managed by MSIT

• Entirely MS technology

• Outside Corp Firewall

• Co-managed by MS

FTEs and Data Center

Vendor

• Third party technology

Pre-SharePoint 2013

• Completely

Outsourced

• Inside Corp Firewall

• Managed by MSIT

• Entirely MS technology

Local Data

SharePoint

Linear Review Tool

Review Attorneys

Tiffing and Production Tool

Production Set

File Shares Exchange Servers

Post SharePoint 2013

Getting Help

Where do I get help?!

Microsoft Services eDiscovery Quick Start

Overview of eDiscovery

Collection of your use cases

Set up of full (SharePoint, Exchange, Lync) POC with pre-

built VMs

Import of your SharePoint data

Configuration of eDiscovery features and your use cases

10 weeks, Architectural Guidance, Roadmap,

Documentation

Datasheet available on ILTA site or Microsoft Booth

Questions?

Thank You! Paul Branson

paul.branson@microsoft.com