Your one stop shop with answers to the most commonly asked questions regarding Teams compliance. Don't miss these Microsoft Docs with further information on these topics:
- Microsoft Teams Retention Policies
- Conduct an eDiscovery investigation of content in Microsoft Teams
- Place a Microsoft Teams user or team on legal hold
- Search the audit log for events in Microsoft Teams
eDiscovery
1. Can you collect 1:1 chats?
All Teams 1:1 or group (1:N) chats reside in the respective users’ Exchange Online mailboxes. Files that a user attaches to a Chat conversation are stored in the OneDrive account of the user who shares the file. Therefore, you have to add the individual user mailboxes and OneDrive for Business accounts as content locations to search conversations and files in the Chat list.
2. Can you collect from users with on-premises mailboxes?
In an Exchange hybrid deployment, users with an on-premises mailbox might participate in conversations that are part of the Chat list in Teams. In this case, content from these conversations is also searchable because it's saved to a cloud-based storage area (called a cloud-based mailbox for on-premises users) for users who have an on-premises mailbox. For more information, see Searching cloud-based mailboxes for on-premises users in Office 365.
3. Can you collect messages from individual Channels within a Team?
Conversations that are part of a Teams channel are stored in the mailbox that's associated with the team. Individual messages are archived to the Team mailbox as standalone messages, with the Channel name and Thread ID listed in the Subject line.
Similarly, files that team members share in a channel are stored on the team's SharePoint site. Therefore, you have to add the team mailbox and SharePoint site as a content location to search conversations and files in a channel.
Microsoft Teams data will appear as IM or Conversations in the core eDiscovery export.
4. Are historical Teams memberships considered when performing a search?
Utilize the unified audit log to find when a user was added or removed from a team. This is on our roadmap for integration in AeD.
Activities: Added Member, Removed Members
5. When Teams meetings are recorded, the content is stored in Stream. Is stream discoverable? Can it be disabled?
The meeting recordings are stored in Microsoft Stream, which is Office 365 Tier-C compliant. To support e-Discovery requests for compliance admins who are interested in meeting or call recordings for Microsoft Streams, the recording completed message is available in the compliance content search functionality for Microsoft Teams. Compliance admins can look for the keyword "recording" in the subject line of the item in compliance content search preview and discover meeting and call recordings in the organization. A prerequisite for them to view all recordings is that they will need to be set up in Microsoft Stream with admin access. Learn more about assigning admin permissions in Stream.
The Stream content is not currently discoverable using the eDiscovery search tools in O365. Both discovery and retention of Stream is on our roadmap.
If you wish to block a user from recording a Microsoft Teams Meeting, you must grant a TeamsMeetingPolicy that has AllowCloudRecording set to $False.
6. Are reactions (likes, heart, laugh, etc.) discoverable?
No. This is currently on the roadmap.
7. Are emojis, memes and gifs discoverable?
While you cannot query these specifically, they will return within the conversation reconstruction.
8. Can you collect messages from Private Channels?
Yes. Records for messages sent in a private channel are delivered to the mailbox of all private channel members, rather than to a group mailbox. The titles of the records are formatted to indicate which private channel they were sent from.
Because each private channel has its own SharePoint site collection that's separate from the parent team site, files in a private channel are managed independently of the parent team.
9. Can we collect guest-to-guest chats?
Presently, for a scenario where only guests are participating in 1:1 or 1:N chat, we don't support eDiscovery of those chat messages.
10. Can you collect/retain VMs?
Yes. Voicemail messages are delivered to users' Exchange mailbox via SMTP routed through Exchange Online Protection. To enable successful delivery of these messages, please be sure that Exchange Connectors are configured correctly between your Exchange servers and Exchange Online Protection; Use Connectors to Configure Mail Flow.
11. How does the conversation thread in AED handle Channel chats?
Each message in a Channel will have its own ConversationID. Replies to Channel chats are threaded with the same ConversationID.
Retention
1. Do eDiscovery case hold policies support Teams?
Yes. Please use the chart found here to understand what needs to be placed on Legal Hold based on data requirements.
In Feb 2020, we turned on legal hold or case hold on private channels (private channel chats are stored in user mailboxes, normal channel chats are stored in that Teams’ group mailboxes). If there is already a legal hold in place for a user mailbox, the hold policy will now automatically apply to private channel messages stored in that mailbox. There is no further action needed for an admin to turn this on. Legal hold of files shared in private channels is also supported.
2. Do Retention policies support Teams?
By default, Teams chat, channel and files are retained forever. You can set up a Teams retention policy for chat and channel messages to decide proactively whether to retain the messages, delete the messages, or retain and then delete.
Remember that in Teams, files that users share in 1:1 or 1:N chats are stored in the OneDrive for Business account of the user who shared the file. Files that team members upload to a channel conversation are stored in the team's SharePoint site. Therefore, to retain or delete files in Teams, create retention policies that apply to OneDrive for Business and SharePoint Online.
Please note that Retention policies do not yet support the retention of Private Channel messages. Since files shared in channels or chats are stored in SharePoint Online, retention of these shared files IS supported.
The eDiscovery case hold policies currently support the retention of Private Channel messages.
Thanks!
Stefanie_Bier on behalf of the MIP and Compliance CXE team
Microsoft
