Home

AIP, eDiscovery and unindexed items

%3CLINGO-SUB%20id%3D%22lingo-sub-568282%22%20slang%3D%22en-US%22%3EAIP%2C%20eDiscovery%20and%20unindexed%20items%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-568282%22%20slang%3D%22en-US%22%3E%3CP%3EAfter%20reading%20different%20posts%20and%20the%20comments%20to%20it%2C%20i%20tested%20if%20eDiscovery%20can%20find%20AIP%20protected%20items%20in%20SPO%20and%20ODfB.%3C%2FP%3E%3CP%3E%22%3CSPAN%3EAmong%20other%20attributes%2C%20Office%20365%20indexes%20Exchange%20message%20properties%20including%20sender%2C%20recipients%2C%20message%20body%2C%20and%20attachments.%20Documents%20and%20messages%20encrypted%20with%20RMS%20and%20Azure%20RMS%20technology%20are%20also%20indexed%20and%20searchable.%3C%2FSPAN%3E%22%3C%2FP%3E%3CP%3Efrom%3A%26nbsp%3B%3CFONT%3E%3CA%20href%3D%22https%3A%2F%2Fwww.microsoft.com%2Fen-us%2Fitshowcase%2Foffice-365-meets-evolving-ediscovery-challenges-in-a-cloud-first-world%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fwww.microsoft.com%2Fen-us%2Fitshowcase%2Foffice-365-meets-evolving-ediscovery-challenges-in-a-cloud-first-world%3C%2FA%3E%3C%2FFONT%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHowever%2C%20my%20eDiscovery%20searches%20cannot%20find%20any%20word%20in%20an%20AIP%20protected%20document%20and%20I%20also%20get%20a%20notice%20that%20a%20number%20of%20documents%20cannot%20be%20indexed%2C%20which%20is%20the%20number%20of%20protected%20documents%20in%20my%20test%20tenant.%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20466px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F113327iFF7C37BEBA50B8DC%2Fimage-dimensions%2F466x146%3Fv%3D1.0%22%20width%3D%22466%22%20height%3D%22146%22%20alt%3D%22Screen3.PNG%22%20title%3D%22Screen3.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3EOn%20the%20other%20side%20I%20just%20read%20the%20following%20on%3A%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Finformation-protection%2Foffice-apps-services-support%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Finformation-protection%2Foffice-apps-services-support%3C%2FA%3E%3CBR%20%2F%3E%22For%20libraries%20that%20are%20not%20IRM-protected%2C%20if%20you%20protect%20a%20file%20that%20you%20then%20upload%20to%20SharePoint%20or%20OneDrive%2C%20the%20following%20do%20not%20work%20with%20this%20file%3A%20Co-authoring%2C%20Office%20Online%2C%20search%2C%20document%20preview%2C%20thumbnail%2C%20eDiscovery%2C%20and%20data%20loss%20prevention%20(DLP).%22%3CBR%20%2F%3EFor%20me%2C%20this%20totally%20contradicts%20the%20above%20quote.%3C%2FP%3E%3CP%3EWhat%20is%20the%20true%20story%20on%20eDiscovery%2C%20DLP%20and%20AIP%20protected%20documents%3F%3CBR%20%2F%3EThanks%2C%3CBR%20%2F%3EFranck%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-568282%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EInformation%20Protection%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ERights%20Management%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-570212%22%20slang%3D%22en-US%22%3ERe%3A%20AIP%2C%20eDiscovery%20and%20unindexed%20items%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-570212%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20first%20quote%20is%20explicitly%20for%20Exchange%2C%20the%20second%20is%20for%20SPO%2FODFB%2C%20so%20there%20is%20no%20contradiction%20here.%20Exchange%20Online%20generally%20speaking%20can%20act%20as%20an%20%22super%20user%22%20for%20the%20purposes%20of%20eDiscovery.%20The%20same%20is%20not%20true%20for%20SPO%2FODFB.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Franck Marteaux
Occasional Contributor

After reading different posts and the comments to it, i tested if eDiscovery can find AIP protected items in SPO and ODfB.

"Among other attributes, Office 365 indexes Exchange message properties including sender, recipients, message body, and attachments. Documents and messages encrypted with RMS and Azure RMS technology are also indexed and searchable."

from: https://www.microsoft.com/en-us/itshowcase/office-365-meets-evolving-ediscovery-challenges-in-a-clou...

 

However, my eDiscovery searches cannot find any word in an AIP protected document and I also get a notice that a number of documents cannot be indexed, which is the number of protected documents in my test tenant.

Screen3.PNG

On the other side I just read the following on:
https://docs.microsoft.com/en-us/azure/information-protection/office-apps-services-support
"For libraries that are not IRM-protected, if you protect a file that you then upload to SharePoint or OneDrive, the following do not work with this file: Co-authoring, Office Online, search, document preview, thumbnail, eDiscovery, and data loss prevention (DLP)."
For me, this totally contradicts the above quote.

What is the true story on eDiscovery, DLP and AIP protected documents?
Thanks,
Franck

4 Replies

The first quote is explicitly for Exchange, the second is for SPO/ODFB, so there is no contradiction here. Exchange Online generally speaking can act as an "super user" for the purposes of eDiscovery. The same is not true for SPO/ODFB.

Thanks Vasil, for your comments,

unfortunately also eDiscovery in Exchange Online does not work for me.

I created one additional protected document and attached it to a protected message that I sent to another user in my test tenant.

Screen5.PNG

So i have 3 more items:

- the new document

- the sent mail

- the received mail.

 

Exactly these 3 items appear as not indexed in my eDiscovery Search.

 

Screen4.PNG

P.S.:

When I do a search eDiscovery can find content in the encrypted Mails but not in the encrypted attachments.

 

Highlighted

That depends on how you've protected the document. The feature only works if the attachments "inherit" the template applied to the email message. 

Related Conversations
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
Tabs and Dark Mode
cjc2112 in Discussions on
30 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
29 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
9 Replies