When a regulatory notice arrives from the Financial Conduct Authority (FCA) or the Serious Fraud Office (SFO), or when an internal whistleblower triggers an urgent probe, Microsoft 365 is almost always the primary repository of contemporaneous evidence. Corporate communications, draft agreements, SharePoint file revisions, and internal Microsoft Teams messages reside within this single cloud tenant. For legal and compliance teams, the speed and technical defensibility with which that data is identified, preserved, and extracted dictates the credibility of the entire response.
Relying on basic administrative searches or generic IT exports creates immediate exposure. Compliance investigations require an evidentiary trail that withstands judicial scrutiny under Practice Direction 57AD or statutory inquiry standards. Microsoft Purview provides powerful capabilities for preservation and search, but it contains operational traps regarding modern attachments, deleted items, multi-custodian Teams chats, and Unified Audit Log retention. Successfully deploying M365 for compliance inquiries requires combining technical knowledge of tenant architecture with proven digital forensic methodology.
Purview eDiscovery Architecture and Licensing Realities
Microsoft Purview divides eDiscovery functionality between Standard and Premium tiers, determined primarily by whether custodians hold E3 or E5 licences. This distinction directly impacts how an investigator can preserve and analyse material.
Standard eDiscovery provides basic case management, core keyword searching, and static legal holds across Exchange mailboxes, OneDrive accounts, and SharePoint sites. However, it lacks advanced custodian management, deep indexing of unrecognised file types, optical character recognition (OCR), and conversational threading for Microsoft Teams. Searches executed in Standard eDiscovery return raw hits without context, leaving investigators to sift through disjointed fragments of group chats or nested email chains manually.
Purview eDiscovery (Premium) introduces custodian-based workflows, automated notification management, and advanced indexing. When custodians are placed on hold in Premium, the system tracks custodial and non-custodial data sources dynamically. Crucially, Premium indexes encrypted files and unsupported document types when a hold is applied, reducing the volume of unsearchable items. For UK investigations subject to tight regulatory deadlines - such as an FCA Section 165 request or an Information Commissioner's Office (ICO) inquiry - Premium significantly accelerates scoping. Even with Premium, however, Purview is an identification, preservation, and early culling tool. It is not an alternative to a dedicated review platform capable of complex batching, redaction, and disclosure production.
Scoping the Tenant and Custodian Mapping
Compliance investigations often suffer from premature search scoping. Before applying keywords, the investigation team must establish an accurate data map of the target custodians within the tenant. Custodian data is rarely restricted to a primary Exchange inbox and a single OneDrive folder.
A thorough mapping exercise within M365 must identify:
- Shared and functional mailboxes: Departmental mailboxes (such as compliance@, sales-invoicing@, or trading@) often hold vital correspondence. These require specific administrative identification because they are not tethered to a single named user account.
- Teams and Private Channels: Standard Teams channels store chat messages in the group mailbox and files in the associated SharePoint site. Private channels and Shared channels generate distinct, isolated SharePoint sites and route chat compliance records to individual user mailboxes. Omitting these sub-locations leads to severe evidentiary gaps.
- Inactive and de-provisioned accounts: When an employee departs, their licence may be removed. If an inactive mailbox retention policy or litigation hold was not in place prior to de-licensing, the mailbox enters a soft-deleted state for 30 days before permanent purging. Identifying and preserving inactive mailboxes is an immediate priority upon instruction.
- Unified Audit Log (UAL): The UAL tracks user actions, file downloads, sharing events, and administrative changes. While crucial for proving intent or establishing data exfiltration, the standard audit retention is only 180 days unless specific one-year or ten-year audit licences are assigned. Investigators must preserve audit logs immediately before historical records roll off the tenant.
Preservation Strategies and Defensible Legal Holds
Preservation must be silent, defensible, and immediate. Under UK legal frameworks, including the ACPO principles for digital evidence and the duty to preserve documents under PD 57AD, alteration of metadata or unrecorded destruction of relevant files can compromise an entire defence.
Purview enables in-place holds, preserving data without changing the user experience or moving files to a secondary repository. When a hold is applied, Exchange Online routes deleted or modified items to the hidden Recoverable Items folder (specifically the Deletions and Versions sub-folders). Similarly, SharePoint and OneDrive copy previous versions of modified or deleted documents into the Preservation Hold Library.
Investigators must coordinate holds carefully with existing organizational retention policies. If an organization enforces a policy that permanently purges deleted items after 30 days, placing an eDiscovery hold overrides the deletion command, ensuring the records remain discoverable to administrators while appearing deleted to the user. However, caution is required regarding retention tags applied directly by users. In addition, custodians should never be placed on notice via automated Purview notifications until the legal team has decided whether overt notification creates a tipping-off risk under the Proceeds of Crime Act 2002 or compromises an internal interview strategy.
Integrating M365 into the Electronic Discovery Reference Model
M365 operates across the early phases of the Electronic Discovery Reference Model (EDRM): Identification, Preservation, and Collection. Attempting to use M365 for downstream Analysis, Review, and Production often introduces significant procedural risk.
Identification and Preservation
Use Purview to isolate custodians, apply targeted in-place holds, and run preliminary Keyword Query Language (KQL) queries. KQL queries allow investigators to estimate hit volumes, test date ranges, and refine custodial boundaries without exporting data from the secure tenant environment.
Collection and Extraction
Extracting data from M365 must preserve forensic integrity. Purview exports provide options to export items as loose files (EML or MSG) or consolidated PST files. For complex compliance matters, export files using loose MSG format with complete directory manifests, forensic hash logs, and separate Teams conversation exports. This ensures that every individual message retains its original metadata, including internet headers, sent times, and transport information.
Processing, Review, and Production
Exported data should be transferred into an independent, ISO 27001-certified review platform such as Relativity. Purview does not provide native tools for redactions compliant with CPR 31 or PD 57AD, nor does it support automated Bates numbering, deduplication against non-M365 sources, or the production of an electronic Disclosure Review Document (DRD). Moving collected evidence out of Purview into an eDiscovery platform ensures that metadata is frozen and disclosure production sets can be formatted precisely to regulatory specifications.
Investigation Checklist: Executing a Defensible Tenant Inquiry
Follow these practical steps when instructed on an M365 compliance investigation:
- Step 1: Secure administrative privilege and forensic separation. Ensure that eDiscovery Manager or eDiscovery Administrator roles in the Purview compliance portal are granted strictly to named, independent investigators, segregated from day-to-day IT support staff who may be witnesses or subjects.
- Step 2: Deploy silent in-place legal holds. Apply tenant-level eDiscovery holds to the identified custodial mailboxes, OneDrive accounts, relevant SharePoint sites, and associated Teams environments prior to taking any overt investigatory steps.
- Step 3: Snapshot and preserve the Unified Audit Log. Query the UAL via PowerShell for activities involving the target custodians over the relevant historical period, including file access, external sharing, and sign-in records. Export and cryptographically hash these logs immediately.
- Step 4: Draft and test search syntax. Develop KQL search strings addressing the inquiry scope. Account for operators (AND, OR, NOT), wildcards, and proximity operators. Validate syntax by checking unindexed items and ensuring non-English characters or complex phrases are handled correctly.
- Step 5: Export with complete cryptographic records. Execute data extraction using the Purview eDiscovery export tool. Choose settings that retain full metadata, preserve native formats, and generate MD5 or SHA-256 hash values. Store outputs on write-blocked, encrypted physical storage or secure private cloud environments.
- Step 6: Maintain the chain of custody. Document the technical parameters of the export, including admin account IDs, date filters applied, search query text, total volume extracted, and output hash verification. This log forms the core of any subsequent witness statement.
Handling Modern Attachments, Teams and Ephemeral Messaging
One of the most complex technical challenges in modern compliance investigations involves modern attachments - files shared via links to OneDrive or SharePoint rather than static file attachments. When an employee sends an email referencing a cloud document, the recipient receives a hyperlinked pointer.
By default, traditional eDiscovery collection tools collect the pointer link, not the underlying document. If the document has been modified since the email was sent, an investigator reviewing the file may see a version that did not exist at the time of the event. Purview eDiscovery (Premium) addresses this by capturing the specific version of the document that was linked at the exact moment the email was sent, provided modern attachment capabilities are activated. Where standard licensing applies, digital forensics practitioners must manually cross-reference file version histories in SharePoint with email transmission timestamps to reconstruct the exact attachment state.
Similarly, Microsoft Teams messages present operational hurdles. Teams chats consist of continuous, dynamic conversation threads, dynamic edits, deletions, and emoji reactions that may carry legal significance (for instance, an agreement conveyed via a thumbs-up emoji). Investigators must extract Teams chats in conversational format rather than isolated single-message fragments. Purview export creates contextual HTML transcripts that preserve thread chronology, edits, and deletions, providing regulators with a clear, contemporaneous narrative of employee conduct.
Where employees have deliberately bypassed M365 using WhatsApp or personal webmail, M365 audit data remains vital. The Unified Audit Log and OneDrive synchronization histories frequently reveal traces of shadow IT, such as personal cloud sync clients, browser upload events, or outbound forwarding rules designed to exfiltrate corporate material. Combining M365 compliance tools with targeted mobile device forensics ensures that off-channel communications are detected and brought within the formal scope of the inquiry.