Office 365 Subject Access Requests

[Deleted]

Wondering what processes other companies follow when they receive a Subject Access Request.

In the UK we have 30 days to supply an extract of data when requested against search criteria - although we don't get many the process we typically follow is

•  Security & Compliance Admin Centre
• New e-Discovery search - When we're happy search is good
• Export to PST - Supply the Compliance dept the PSt, who then review, remove anything from there which isn't suitable for release - Case closed

The business have now decided they want to deploy a GPO to disable the users ability to open any PST's at all in Office which screws our process, so I'm thinking of something along the following

• Security & Compliance Admin Centre
• New e-Discovery search - When we're happy search is good
• Create a new shared mailbox
• Upload PST to Azure Ingestion storage and them use the 365 import PST to inject into shared mailbox
• Give local HR rep access to shared mailbox, they can review, remove anything which needs removing (export to pst and supply to the user)

It's a bit messy and time consuming but was wondering what other companies do

[#2]

Or you can just use the good old "Copy to Discovery mailbox" functionality available in the EAC: https://docs.microsoft.com/en-us/exchange/policy-and-compliance/ediscovery/copy-results-to-discovery...

Or go even more old school and use the Search-Mailbox cmdlet to copy the content of the SAR mailbox to a shared mailbox directly.

[#3]

Hi Steve,

Many organisations in the UK use journaling to an archive to achieve this, usually a gateway archive service such as Mimecast, or another third party archive like Global Relay. These just use transport rules and send connectors in EAC to do the journaling. The organisation will upload a copy of their PST's when the archive starts and everything new (internal and external) goes straight in the archive. After that, no more need to worry about PST's as there is a tamper proof compliant copy of all email in the archive which has e-Discovery and where a copy exported as required.

I know this isn't utilising the native Microsoft functionality as Vasil outlined, but its just an observation having worked in cloud in the UK for over 10 years.

Best, Chris