Microsoft Removing Legacy Office 365 eDiscovery Tools

Legacy eDiscovery Tools Due for Removal by Mid-2020

Update: On March 27, Microsoft announced that they are postponing the scheduled retirement of the legacy eDiscovery tools for three months. The new retirement date is July 1, 2020.

Over the holiday period, Microsoft issued a note on December 30, 2019 about their retirement of Legacy eDiscovery tools. The original version of the note dealt with the retirement of the Exchange eDiscovery tools and version 1 of Office 365 Advanced eDiscovery. Microsoft subsequently refreshed their note on January 8, 2020 to add more information about the retirement of:

• Exchange Online in-place holds and eDiscovery.
• Office 365 Advanced eDiscovery V1.
• The Search-Mailbox cmdlet.

Although Microsoft had flagged its deprecation since 2018 the inclusion of the Search-Mailbox cmdlet in the revised document came as a surprise. Quite why Microsoft decided to issue a stripped down version on December 30 and a much more comprehensive version nine days later is not understandable. All it did was cause confusion.

Exchange Online in-Place Holds and eDiscovery

Unless you’re in the habit of running Exchange Online searches through PowerShell, you might have missed the news that Microsoft has been warning about the deprecation of the *-MailboxSearch cmdlets (the foundation of in-place hold and searches) for some time. These cmdlets first appeared in Exchange 2010 when the email server gained the ability to set in-place holds on mailbox content uncovered by eDiscovery searches. If you run searches through PowerShell (Figure 1), you see the warning that new searches cannot be created from April 1, 2020 (now July 1, 2020) and the cmdlets will disappear on July 1, 2020 (now October 1, 2020).

The Exchange Online Admin Center (EAC) gives much the same information. (Figure 2)

Office 365 Advanced eDiscovery

Office 365 Advanced eDiscovery (Figure 3) came from the Equivio acquisition in 2015 to become part of Office 365 E5 (also available as an add-on).

Version 1 of dvanced eDiscovery is replaced by a new version which is a more developed and easier-to-use edition of the original technology designed to serve the same function: make it possible for investigators to find relevant and interesting content in very large eDiscovery sets (think millions of items). V2 is still part of Office 365 E5.

Dealing with massive eDiscovery cases is a specialist business and it’s unlikely that large numbers of Office 365 tenants are affected by the deprecation, a feeling underlined by the fact that V2 of Advanced eDiscovery has been live inside Office 365 for several months now.

Moving from Exchange Online In-Place Holds

Microsoft’s original announcement posted on December 30 said:

“The In-Place eDiscovery and Holds tool in the Exchange admin center is also being retired. This tool is used for searching, holding, and exporting mailbox content in Exchange Online. Similar functionality is available in the Microsoft 365 compliance center.“

The similar functionality referred to in the statement comprises of Office 365 content searches and eDiscovery cases. Office 365 searches are faster, scale to deal with much more data, and include more than Exchange mailbox data, so there’s really no good reason to continue using the Exchange Online variant. Unless of course you have to because the organization has live eDiscovery cases running.

Microsoft’s document points to detailed steps for tenants to use PowerShell to recreate in-place holds and replace them with holds in Office 365 eDiscovery cases. The process works (eventually – you might need to tweak the PowerShell code), but tenants are advised to consult their legal advisors to ensure that the steps taken to establish new holds, test that the holds retain the right information, and release the old holds are documented in such a way that they can survive legal challenge.

No Export to Discovery Mailboxes

One piece of functionality that isn’t available with Office 365 eDiscovery cases is the ability to export search results to an Exchange discovery mailbox where the items can be reviewed. Microsoft suggests that you should use Advanced eDiscovery Review sets instead. This is fine, until you find out that Advanced eDiscovery requires Office 365 E5 or Microsoft 365 licenses, a substantial cost bump over E3. With that fact in mind, their other suggestion to export the results from an Office 365 content search to a PST and import the PST into a discovery mailbox is more practical, even if it uses a PST (a thing always to be avoided) and requires a lot more manual interaction.

Final Deprecation of Search-Mailbox

After warning that its deprecation was coming since 2018, Microsoft has given a date for removal of the very useful Search-Mailbox cmdlet. I covered this topic elsewhere last August and concluded that it would be unwise for Microsoft to remove Search-Mailbox because the replacement capabilities offered by Office 365 content searches don’t cover all the cmdlet’s functionality, not least in the ability of Search-Mailbox to remove more than 10 items from a mailbox at a time.

Microsoft originally said that they would remove Search-Mailbox from Exchange Online on April 1, 2020, subsequently revised to July 1, 2020. The cmdlet is still available in December 2020 (the last time I checked), complete with a notice that it is unsupported.

Although I understand Microsoft’s desire to remove what they view as an old cmdlet that can only handle a single workload and replace it with new cmdlets that work across Office 365, it is a pity that they have chosen to pursue this deprecation without upgrading Office 365 content searches to deliver the same features.

---

eDiscovery is covered in Chapter 20 of the Office 365 for IT Pros eBook. We stopped covering workload-specific eDiscovery technology several editions ago. Not because the technology isn’t interesting: we just had better material to discuss.