The popularity and use of collaboration tools has greatly increased over the past few years. New sources of data create new places from which data must be collected and reviewed for eDiscovery purposes. This is especially true as the world moves more toward distributed workforces.
One of the more widely used collaboration tools is Microsoft Teams. Teams allows users to collaborate through chat functions, audio/video meetings, screen sharing, and file sharing. All of these features create different types of data stored within the Microsoft Office 365 environment. Understanding where Teams data is stored and how it can be searched and exported is important when it must be collected for electronic discovery or for other legal and compliance reasons.
Understanding where Teams data and related data is stored is important to eDiscovery considerations. Generally, Microsoft data is hosted within Microsoft Azure. Azure is a cloud service provider powered by data centers around the world. More specifically, Teams data is located in the geographic region associated with an organization’s O365 environment.
For example, an organization located in Germany or France will have its data stored in those respective countries. For an organization located in another EU country, the data is likely stored in data centers located in Austria, Finland, France, Ireland, or the Netherlands.
Aside from the physical location, Teams data is decentralized, meaning that data is not stored in one location or server. Often, data is stored this way for security reasons or to protect against service outages.
Teams data is decentralized based on the app associated with the content: Microsoft Exchange (messages), Microsoft Stream (recordings), Sharepoint (files), and OneDrive for Business (files). Data from other Microsoft apps may be displayed and accessible within Teams even though it is stored elsewhere. Further, Teams data may also be stored with a third party when integrations with third-party apps are enabled. For example, Teams supports integration with Box, a cloud-based file sharing and content management service.
The storage location for Teams data depends on the feature or content. The below table breaks down the storage location for common Teams content.
|Direct messages||Exchange Online mailbox of all participants|
|Files shared in direct messages||OneDrive for Business account of the participant who shared the file|
|Group messages||Exchange Online mailbox of all participants|
|Files shared in group messages||OneDrive for Business account of the participant who shared the file|
|Channels||Exchange Online mailbox associated with the team that belongs to the channel|
|Files shared in channels||Sharepoint site associated with the team that belongs to the channel|
|Private channels||Exchange Online mailboxes of all participants|
|Files shared in private channels||A dedicated Sharepoint site associated with the private channel|
|Channel meeting recordings||Sharepoint site associated with the team that belongs to the channel|
|Ad hoc/scheduled meeting or call recordings||OneDrive for Business account of the participant that selected the Record option (for example, if the organizer of a scheduled meeting clicks Record, the recording is stored on the organizer’s account)|
Collecting and searching Teams data using Microsoft’s eDiscovery features may require a certain degree of technical expertise to ensure that all data is accounted for. This expertise includes knowledge of PowerShell. Users must be able to run PowerShell commands and scripts to search for all content types and data sources not stored in their Exchange Online mailboxes (i.e. file shares, call recordings, meetings, etc). For example, to search for the content of a guest user you first need to obtain the guest’s user principal name, or UPN, via a PowerShell command.
Further, users must select the correct data sources per custodian for proper Teams data collection and preservation using Microsoft’s eDiscovery features. For example, the failure to select the proper Sharepoint site as a data source could result in files shared in a private channel not being collected.
Teams data is generally exported as a collection of .PST files. This data is unorganized and unstructured. Channel and chat messages are not nicely displayed one after the other as you see within the Microsoft environment. Instead, you may see a collection of individual messages which are difficult to interpret. Outside help and technologies may be needed to organize the data so the messages appear as threads and are connected in a logical sense when receiving an export of Teams data for review. Loading them into eDiscovery software can help. This is an important consideration for processing Teams data because wasted time due to inefficient workflow can greatly increase review costs.
To ensure all desired Teams data is collected, it is important to note a few requirements and limitations of Microsoft eDiscovery.
As demonstrated above, identifying, collecting, and reviewing data for eDiscovery is becoming more complex. It’s important to maintain a consistent eDiscovery workflow to simplify the collection and review of complex data like Teams. This consistency is essential for supporting defensibility. Mistakes and oversights with Teams data could prove costly if a court requires you to do over a collection due to missed data.
If you need assistance with Teams data for eDiscovery, let us know. We can help.