Table of Contents
But Only for Premium eDiscovery
Yesterday, I discussed how to count the Teams compliance records captured by the Microsoft 365 substrate in a tenant. I wrote about this topic because of MC387229, posted on May 31, which informs customers that Microsoft Purview Advanced (Premium) eDiscovery will soon uncover the reactions to Teams messages. This is Microsoft 365 roadmap item 65130 and it’s due for preview in June and general availability in August 2022.
The Problem of Reactions
eDiscovery searches can easily find the content of Teams messages. That’s been the case since Teams first started to accumulate these records in 2017. However, since that time, Microsoft has struggled to find a way to let investigators know about reactions to messages. This is important because someone participating in potentially problematic activities might indicate their willingness to perform an action through a reaction.
Take the example shown in Figure 1. Someone proposes murder and assent comes in the form of a thumbs-up reaction. This is an important signal that indicates the state of mind of the respondent. The problem for investigators is that compliance records don’t capture the reaction.
The Formal Story
In 2019, Microsoft commissioned a report from Cohasset Associates about how Microsoft 365 meets regulatory requirements for data lifecycle management and records management in the financial sector. Specifically, SEC17a-4(f), FINRA 4511©, and CFTC 1.31 (c)-(d). The report is available as part of Microsoft’s records management documentation, but you can only download the report from the Microsoft 365 Service Trust site if you have an account from a tenant. The latest version of the report is dated 2 November 2020, and it contains the rather startling assertion that:
“Reactions (e.g., likes, thumbs up) applied to Teams channel messages and Teams chats are tracked in the Microsoft 365 unified audit system…”
The report repeats the same statement multiple times. However, I’ve never seen any evidence of audit records for reactions. Clearly, the authors were misinformed on this point.
Later (2.4.3.1), the report says that “reactions… are not captured as a communication in Exchange. Therefore, the reaction history cannot be reproduced with the communication.”
In other words, the compliance records captured in Exchange Online don’t contain reactions. The report makes the same point in 2.4.4. and the conclusions.
Over the years, Microsoft has committed to closing this compliance gap, and that’s what is due to happen when the feature announced in MC387229 arrives.
Where are the Reactions?
All we’re told for now is that eDiscovery will be able to discover Teams reactions to provide “additional user sentiment context.” There’s no mention of how this will happen.
However, we know that responding to a chat or channel conversation with a reaction does not cause the Microsoft 365 substrate to capture any information. By comparison, if you update a message in a chat or channel conversation, the substrate captures a copy of the edited message.
This behavior makes me think that Premium eDiscovery makes a request to Teams to return reactions along with message contents when viewing items recovered in an eDiscovery collection (the set of items found by a search). This makes sense because it’s like the call made by a Teams client to load messages in a conversation.
No Luck for Standard eDiscovery
Microsoft hasn’t said if the ability to see reactions alongside Teams messages will appear in standard eDiscovery. I don’t think this will happen. Standard eDiscovery searches return relatively raw material (the compliance records captured by the substrate) and don’t attempt to present the information in context (reassemble items to form a coherent message thread), which is a big added value delivered by Premium eDiscovery. Given this logic, I’m afraid you need to invest in some Office 365 E5 or Microsoft 365 E5 compliance licenses to close this Teams compliance gap and see reactions in eDiscovery.
Keep up to date with developments like changes in eDiscovery and Teams compliance capabilities by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers understand the most important changes happening across Office 365.