Many, many moons ago when talking to clients about what was then Advanced eDiscovery in M365, now named Purview Premium eDiscovery, we would go through how to do a collection. Usually, somewhere between the collection steps and opening up the collected items in the review set they would have a question.
Where are the reports?
Sometimes the question was more along the lines of “What was collected?”
However, the answer did not make them happy. There was really only a search hit report, and nothing more. What happened during the collection and processing phases was a black box. Your search could show an estimate of 100 items and when you opened the review set there could be 150 and there was no explanation of where the extra 50 items came from.
We could guess. We know that adding cloud attachments or contextual Teams/Yammer messages would add to the collection. We knew that the individual messages being combined into HTML transcripts would remove some items. (3-4 messages could turn into one HTML file in review, for example)
But we had no hard numbers.
Microsoft, to their credit, did realize this was a problem and started adding more reporting. Some of it was pretty clear, while some of it was a little more confusing, but what I realized this week was that I’ve never really dug into these new reports to figure out the important thing. Could the reporting be used to audit the process?
The answer appears to be maybe. But it’s inconsistent.
I’ll show you what I saw from some test collections:
Keep reading with a 7-day free trial
Subscribe to Mike McBride on M365 to keep reading this post and get 7 days of free access to the full post archives.