Forum Discussion

Franck1304's avatar
Franck1304
Brass Contributor
May 15, 2019

AIP, eDiscovery and unindexed items

After reading different posts and the comments to it, i tested if eDiscovery can find AIP protected items in SPO and ODfB.

"Among other attributes, Office 365 indexes Exchange message properties including sender, recipients, message body, and attachments. Documents and messages encrypted with RMS and Azure RMS technology are also indexed and searchable."

from: https://www.microsoft.com/en-us/itshowcase/office-365-meets-evolving-ediscovery-challenges-in-a-cloud-first-world

 

However, my eDiscovery searches cannot find any word in an AIP protected document and I also get a notice that a number of documents cannot be indexed, which is the number of protected documents in my test tenant.

On the other side I just read the following on:
https://docs.microsoft.com/en-us/azure/information-protection/office-apps-services-support
"For libraries that are not IRM-protected, if you protect a file that you then upload to SharePoint or OneDrive, the following do not work with this file: Co-authoring, Office Online, search, document preview, thumbnail, eDiscovery, and data loss prevention (DLP)."
For me, this totally contradicts the above quote.

What is the true story on eDiscovery, DLP and AIP protected documents?
Thanks,
Franck

  • The first quote is explicitly for Exchange, the second is for SPO/ODFB, so there is no contradiction here. Exchange Online generally speaking can act as an "super user" for the purposes of eDiscovery. The same is not true for SPO/ODFB.

    • Franck1304's avatar
      Franck1304
      Brass Contributor

      Thanks Vasil, for your comments,

      unfortunately also eDiscovery in Exchange Online does not work for me.

      I created one additional protected document and attached it to a protected message that I sent to another user in my test tenant.

      So i have 3 more items:

      - the new document

      - the sent mail

      - the received mail.

       

      Exactly these 3 items appear as not indexed in my eDiscovery Search.

       

      • Franck1304's avatar
        Franck1304
        Brass Contributor

        P.S.:

        When I do a search eDiscovery can find content in the encrypted Mails but not in the encrypted attachments.

         

Resources