Maybe you’re normal, and you don’t see a new feature like chat inside of a Planner task and immediately wonder where that data lives and if it’s discoverable.

We all know by now that I’m not wired like that.

I saw it and had to test it. So, when I created a couple of messages in the task chat for a given Planner task, could I find them?

The short answer is yes. They exist in the Exchange mailbox substrate of the group where the plan is shared. The longer answer is that there might also be other data available if you @-mention another user, because that will create an email notification. This is similar to the email notification you would get when someone else assigns a task to you, versus when you assign it yourself.

This likely doesn’t surprise many of you, but if you’re interested in the details, here you go:

Read more

Have you seen this feature in your tenant yet?

Microsoft Teams Finally Makes Draft Messages Easy to Find

If you have, you may have noticed that if you start typing a message in Teams, get distracted, click on a different chat, go to a meeting chat, and hours later remember that you started typing a Teams message somewhere, you can easily find it in the Quick View Drafts location.

It works really well.

It’s simple.

I am very happy about it.

Of course, new data also gives me another newsletter topic! The question is, where are those drafts? Is it like email, where we can collect them from a “Draft” folder in the mailbox? (Or the Teams equivalent of such a folder in the same Substrate area where Teams messages are stored?)

Not so much.

They may, in fact, be saved locally in the Teams app and not accessible for eDiscovery at all. Maybe that’s not a big deal, but if you’re expecting draft Teams messages to show up in the same way that draft email messages show up, you’re going to be disappointed.

Let’s look at the details:

Read more

First off, let me put this out there. I do not see the option to share a Loop page with external users in every tenant I have access to, but I do see it in one.

Most tenants show me a screen that permits me to share with anyone inside the organization when I try to share from Loop:

But this one shows me the option to share inside or outside of my tenant.

This is a feature that I find interesting. One, because external collaboration is the final frontier for Loop adoption. Every time I’ve talked about Loop or given a demonstration of the tool, it’s one of the first questions: “Can I share with people outside of my tenant?”

The answer has been no for a long time. That’s changing. This is exciting.

It’s also a little scary because the most interesting thing about Loop is how easy it is to use Loop without knowing you’re using it. For example, with Teams meeting agendas.

As of now, the agenda/Notes from a Teams meeting are shared with all internal participants, but outside folks can’t see them. I know a few people who depend on it working that way. They keep notes or use Copilot Facilitator to take notes that shouldn’t be seen by the external parties in the meeting.

That was the test I wanted to run first: are external users now getting access to the notes/agenda from a Teams meeting? The answer seemed to be yes, sort of. My external user didn’t see them in the Meeting, but they did have access if they had a link to access them outside the meeting.

It all felt a little unfinished. Honestly, I think it may change as this moves through the preview process into production.

Here are the details of the testing:

Read more

Copilot News:

The big news -

Microsoft 365 E7: A New Agent-Centered Subscription Plan Expected Soon

What do you think about this? Does it make sense for most users to move to E7? I’m not sold that it’s going to move the needle. If we consider the potential to price E5 + Copilot at $90/month, but this new e7 is reportedly $99/month, is there value for the average user here?

Microsoft published more information yesterday - There is a lot to digest. https://blogs.microsoft.com/blog/2026/03/09/introducing-the-first-frontier-suite-built-on-intelligence-trust/

From the blog:

Worth Reading - 4 obstacles impede paid Microsoft 365 Copilot adoption

Speaking of knowing the differences, for security and compliance, this is a good resource - INFO: References for Microsoft 365 Copilot & Copilot Chat Security & Privacy.

Other Copilot things:

• New Security Dashboard for AI is Now in Public Preview

• Start here: essential Microsoft Copilot hubs for employees

• How to Deploy Microsoft Copilot Safely Using SharePoint Advanced Management

• AB-900, AB-100, AB-730, AB-731: Making Sense of Microsoft’s New Copilot Certifications

• Copilot can reschedule conflicting events in Outlook

• Copilot Cowork: A new way of getting work done - what kinds of artifacts will this create that become eDiscovery issues?

Non-Copilot News:

I’ll admit, this upcoming change has me concerned. Not because guest accounts are a huge danger, but because many of us use Conditional Access Policies that will break the ability for users to share files from OneDrive and SharePoint without them. It’s going to be a lift to figure out how to reconfigure those. At least, I think it will. I’m not feeling clear about what I’ve read so far.

Guest Accounts Now Used for SPO External Access to Files

Setting aside the not-so-subtle advertising in this post, this is an eDiscovery challenge for many larger organizations:

Managing Multiple eDiscovery Cases in Purview: Where Things Go Wrong

This is a security feature to be aware of with compromised accounts:

Other Microsoft things:

• Microsoft 365 – New SharePoint experience! - I haven’t had it long enough to have an opinion. How about you?

• Planner’s Newly Redesigned Interface

• Microsoft adds powerful image editor to PowerPoint

• Microsoft Is Auto-Enabling Passkeys in March 2026

• Microsoft introduces new security tool for IT admins managing AI infrastructure

• Microsoft delays enterprise Outlook switchover to 2027 - I think we all know that “new” Outlook is not ready for the enterprise. Maybe next year.

That’s what I’ve got for this month. I’m going to be doing some initial testing with Loop components and the new ability to share them externally before the next issue. I’m nervous about whether users will end up sharing Meeting Notes, etc. with external users that used to be internal only. It’s one thing to purposefully copy a Loop link into an external chat, where you mean to share it. It’s quite another to just use the Notes feature in a meeting and not realize that permission changed.

We’ll see if that’s what is happening with it. Loop has always had a tremendous collaborative potential, and that only grows with the ability to share the content externally now. Governance, however, just got a little more complicated, I fear.

Like it always does. ;-)

Before we get lost in the deep recesses of my mind, I wanted to share a small update to my last article about Outlook reactions.

Because this showed up in my email shortly after sending that issue out:

Yes, a daily digest email showing me reactions to my previous-day email messages. I’ve never seen that before. It hasn’t shown up in other environments when someone reacted to my email before, and I’m not sure it reliably exists. But, there it was.

Color me even more confused.

Later this week, I’m presenting to a local group about the many ways users can collaborate in M365, even when they may not even know they’re using the tool. Loop is, of course, the center of the presentation, because it shows up in so many places, even if you never open the Loop app or know it exists.

Every time I give a presentation like this, I’m always thoughtful about the governance side of Loop Workspaces, Pages, and Embedded Containers, because, frankly, it can be a bit overwhelming to consider.

It also reminds me that, during testing, I was able to search for and collect Loop content in the SharePoint embedded space, but only because my tenant is small enough that running a tenant-wide search for a keyword is not unreasonable.

For many of you, running a search like that may be a non-starter. I’ve talked to folks from large orgs with tens of thousands of users who will never run a search like that; thus, content in embedded containers is essentially uncollectable. (Not to mention the need to know what key terms to use with your search to begin with!)

Of course, it’s not just Loop. It’s also the difficulties in collecting Copilot interactions, chat message metadata, shared files across different channel types, linked chat, SharePoint versions, Planner tasks, and audit logs. That list doesn’t even include the various policies that may be in place and impact collection, such as short retention schedules, priority deletions, and other compliance rules.

My point is that collecting data from complex ecosystems like this is a multi-disciplined role. You’re not just the eDiscovery professional, you’re also the technical expert on how all of these tools work and store data, the security expert who identifies who has access to the relevant data, and the information governance expert who understands the lifecycle of data in the environment.

Frankly, that’s asking a lot. I don’t think it's sustainable. What is sustainable is a partnership, working with the people who are experts in those other areas, and with the custodians, to identify where they were working and creating data.

The question I have for small to mid-sized organizations, though, is whether those experts exist. Is there someone who understands where Copilot Pages are stored, where Teams data is stored, or what a Copilot interaction looks like in the Exchange mailbox? What about those custodians? When they say “I saw that in Teams,” do they know the difference between chat, channel posts, a shared file, meeting notes, etc.? Because it matters. Collecting every possible location related to a user in Teams because they can’t tell you where in Teams they saw that super relevant message.

It’s daunting to me to think about how I could build the most exhaustive custodian interview process, connect with every other IT and related expert in my organization, and still not have enough knowledge to properly collect relevant data for litigation.

If it were you, where would you direct them to find that expertise? Who out there is equipped to assist these organizations with eDiscovery collections fully?

And if those resources aren’t realistic, what should the courts consider reasonable?

These are the things I think about. It’s entirely possible that I’m not normal, and now you get to see inside the madness that drives me to do this testing and write this newsletter, because we all need to know more.

If you want to help in this journey, share the newsletter. Also, sign up for the Teams channel and join the conversation there. Let’s build a community that helps folks overcome some of these hurdles!

Share Mike McBride on M365

A few weeks ago, I dug into Outlook reactions since it came up in an email group that I am part of:

Mike McBride on M365

Quick Test - Outlook Reactions

An email hit my inbox a couple of weeks ago from a mailing list dedicated to Information Governance about Outlook reactions, questioning what kind of “record” they might be considered…

Read more

2 months ago · 1 like · Mike McBride

After I posted that, my good friend, Maureen Holland, and I chatted and decided to do some further testing, but it didn’t work. She and I exchanged emails from our respective work accounts and “liked” each other's messages, but those likes never appeared in the sent message.

I made a mental note because when I tested the feature, I was working with two accounts in the same tenant. Maybe it worked differently across tenants.

Before I could set aside time for that testing, I awoke one morning to an actual email notification on my work account: someone external had “loved” the email I'd sent the day before.

Which was weird, given what I saw everywhere else.

This week, I tried to send myself an email across two tenants I have access to that are not owned by the law firm where I work, for obvious reasons, and I got a third set of results.

This time, I could see the reaction, but there was no email notification.

Why were things so different? I don’t know. At first, I theorized that one of the work tenants was blocking reactions from being shared across tenants, but then I got on with someone else. It’s still possible that was the case. But then we get into why, in one set of circumstances, an email notification appeared, while in the other, only a reaction notification appeared in Outlook.

Why, Microsoft, why?

What configuration option is creating this? I don’t believe I’ve changed anything that would block reactions, but then again, I don’t recall ever seeing an option like that documented. Is this a result of another option I’ve misinterpreted as something else, or is it pulling this in with that option?

I’m not sure, but it creates an interesting collection problem. I’m not sure you can count on capturing reactions as things stand. It’s too confusing.

Speaking of reactions, another thought occurred to me while I was thinking so much about reactions. For Teams, the reaction is “burned in”, for lack of a better term, when the HTML transcript is created using that option in the Review Set. What happens if you don’t choose that option?

More confusion.

Read more

Case in point:

Microsoft 365: Change Meeting Organizer via PowerShell Cmdlet in Exchange Online

Allows the administrator of an Exchange Online tenant to change the organizer of an existing meeting or meeting series via a PowerShell cmdlet. This can be used, for example, to maintain continuity and history of a long-running meeting series in cases where the meeting organizer has a new role, is on leave, or during the offboarding process. Once the meeting is transferred, the new organizer will be able to maintain all properties of the event including meeting time and recurrence, attendees, and description. Meeting attendees within the Exchange Online tenant will not need to re-RSVP and the existing event on their calendar will be silently updated with the new meeting organizer information.A subsequent feature will enable users to to change the organizer via Modern Calendar in OWA, New Outlook, and Teams. For user-initiated transfers the new organizer must accept the meeting before the transfer completes.

GA date: May CY2026

How many meeting series have had to be erased and recreated when someone on your team left the organization? IYKYK. 😏

Copilot News:

Here’s a resource you may want to keep handy:

Deploying Microsoft 365 Copilot in five chapters

This is true, it’ll find stuff you didn’t know you had access to:

The 365 Edge

Copilot Won’t Fix Your M365—It Will Expose It: 8 Pre-Go-Live Repairs for IT Leaders

“Copilot only accesses data that an individual user is authorized to access… Copilot can’t access data that the user doesn’t have permission to access…

Read more

2 months ago · Brad Holt

File both of these under “But how well do they work” for now:

• Create Agents in One-Click from your OneDrive

• Introducing M365 Copilot Agents in Office Apps

I like the idea of blocking individual SharePoint sites from Copilot. I haven’t been able to get it to work yet, but I’m troubleshooting. Has anyone else had a similar issue where you change the setting, but Copilot and Search still locate the documents anyway?

Non-Copilot News:

There were a number of educational articles about both existing and new features, especially in Purview, that I have seen over the last few weeks:

• Ediscovery for Teams Chat: The Complete Guide

• Deploying Purview Data Loss Prevention for Microsoft 365

• Protect your Sensitive Information in Remote Desktop Sessions

• Purview Auto-apply Retention Labels and SharePoint Autofill

• General Availability of Microsoft Purview eDiscovery Graph API for E3 Customers

This is a very interesting idea - a snapshot of your tenant configuration that you could rollback to?

Entra.News - Your weekly dose of Microsoft Entra

Automating Governance: The New Standard for Microsoft 365 Tenant Snapshots and Remediation

Governance in Microsoft 365 has always been hard. Not because the tools didn’t exist, but because scale, complexity, and change made consistency almost impossible. As tenants grow, so do the challenges of configuration drift, manual admin changes, and inconsistent environments…

Listen now

2 months ago · 8 likes · Merill Fernando

This is also interesting. Viva Engage is one of those tools I occasionally look at with interest because its functionality isn't exactly the same as Teams', but it’s similar enough that I'm fairly certain I won’t be able to get users to use both. But what happens when communities can show up in Teams in the same Chat tab?

Introducing communities in Teams: Unifying company communication and connection

Also, pay attention to this:

EdTech IRL

M365 Compromised Account Triage: OAuth Persistence

I’ve been working on an article on what I do when I encounter a potentially compromised account in Microsoft 365. It’s one I’ve stopped and started several times over the past year, and one of the main reasons for stoppage is because when I got to the Refresh Token section, it kept growing and growing. So, I’ve decided to pull it out into it’s own artic…

Read more

2 months ago · 2 likes · 1 comment · Andy Lombardo

What M365 news is catching your attention this month?

Leave a comment

Would you be interested in meeting via a Teams channel to discuss M365, eDiscovery, and related topics with other subscribers? Perhaps even schedule some chats from time to time? (Paid subscribers, I’ve got some ideas just for you as well.) If you are interested, sign up here. Our small, but merry, band is starting up today. Will you join us?

Before I get into this, I had a handful of people sign up. Not many, but I’m going to send invites this week to the brave few who want to start this and see how it goes. Do you wish to join us?

Would you be interested in meeting via a Teams channel to discuss M365, eDiscovery, and related topics with other subscribers? Perhaps even schedule some chats on occasion? (Paid subscribers, I’ve got some ideas just for you as well.) If you are interested, sign up here. If there’s enough interest, we will definitely get this going in the next few weeks.)

Leave a comment

My eDiscovery Spidey sense started tingling when I saw a reference to this Message Center item:

Microsoft Teams: Automatic removal of EXIF data from shared images

Summary

Microsoft Teams will automatically remove EXIF metadata from images shared in chats and channels starting early 2026, enhancing privacy by hiding location and device info. The image itself remains unchanged, no admin action is needed, and users can share EXIF data via OneDrive links if required.

Is this summary helpful?

Introduction

Microsoft Teams will soon automatically remove hidden metadata (EXIF) from images shared in chats and channels. This helps protect sensitive details such as photo location and device information from being shared without user awareness, improving privacy and security.

This message applies to Teams for Windows desktop, Teams for Mac desktop, and Teams for the web and is associated with Microsoft 365 Roadmap ID 542795.

When this will happen:

• Targeted Release: Rollout begins in late January 2026 and completes by early February 2026.

• Worldwide and GCC: Rollout begins in mid-February 2026 and completes by early March 2026.

• GCC High: Rollout begins in late February 2026 and completes by mid-March 2026.

• DoD: Rollout begins in early March 2026 and completes by late March 2026.

How this affects your organization:

• Who is affected: All users sharing images in Microsoft Teams chats and channels.

• What will happen:

  • EXIF metadata (e.g., GPS location, camera model, manufacturer info) will be automatically removed from images shared in Teams conversations.

  • The visible image content remains unchanged.

  • No admin action is required; this feature is enabled by default.

  • If users need to retain EXIF data, they can upload images to OneDrive and share a link via Teams.

What you can do to prepare:

• Inform end users, security, and compliance stakeholders that EXIF data will no longer be available in Teams-shared images.

• Update internal documentation or training that references sharing metadata via images.

• Review workflows, diagnostics, or integrations that rely on EXIF data and plan alternatives.

Compliance considerations:

No compliance considerations identified, review as appropriate for your organization.

From a security and privacy perspective, I think this is a good idea. There’s no reason not to protect users from themselves when it comes to photo data they may not be aware of.

On the eDiscovery side, I couldn’t help but wonder how often EXIF data comes into play. I can think of only a handful of cases where the location and time of a photo were relevant, but when they were, they were highly relevant. I’ve worked with enough forensic examiners to know how important this is when doing cell phone examinations.

But much of that is from cell phone data, not from photos shared in Teams. It might not be a major issue, but it may be worth starting a conversation with legal teams.

What about you? Has EXIF data been an issue worth worrying about? Will you miss it when collecting data from Teams?

An email hit my inbox a couple of weeks ago from a mailing list dedicated to Information Governance about Outlook reactions, questioning what kind of “record” they might be considered.

I had previously tested reactions in Teams but hadn’t given much thought to what the eDiscovery tools would do when someone clicked “like” on an email in Outlook. So, I sent my demo user an email and used that account to click “like".

Then I collected the email and looked for any indication that someone had liked it.

It was obvious, looking at the Source document in the review set, that the like was noted in the ReactionsSummary section of the email header:

What was a little more complicated was the metadata, because there was no indication that any reactions existed in the metadata visible in the review set.

There was no metadata item for ReactionsSummary in the review set or in the export item list.

That was only the first complication. The second came from exports. I exported the message as a .msg file and then opened it in Outlook. The like appeared in the message; however, there was a catch.

My Outlook was connected to the M365 tenant when I opened the exported MSG file. When I moved over to a different machine where Outlook did not have my tenant account set up and opened the email, the reaction was not visible.

I assume it needs a connection to the Graph API to read and display reactions; once the message is removed from that connection, they are no longer available.

I imagine this would mean the data is lost when exported from M365 to a PST and then ingested into a review platform, but without a review platform available, I can’t confirm that.

Does anyone else want to do that test and let us know? I would imagine it is possible that a different eDiscovery processing tool may extract the metadata that Microsoft does not. I’ve seen that before, when Teams first introduced reactions. There was a long JSON metadata field in the Exchange item that showed the reactions, but that field wasn’t available in the M365 exports; you needed access to the original PST export from Exchange and some sophisticated processing tools. (In our case, Nuix.)

My assumption is also based on what happens when we export Teams messages where the reactions are added to the HTML file:

This doesn’t appear to happen with the email reactions, though, while reviewing it in the M365 environment, they are displayed.

The only workaround would be to download a PDF version of each relevant reaction whenever a reaction is relevant to the case. That won’t scale well, and it will create an issue tying the PDF back to the correct message metadata. Yuck.

Leave a comment

Latest posts on the Blog:

• The New Teams Calendar is Coming – Complete with a bug with Loop agendas

• Worth Reading – Nobody knows how large software products work

• Worth Reading – How to Prevent Microsoft Teams Sprawl

• Worth Reading – Carvana and the New Hyperlink Fight: “Contemporaneous” Isn’t Automatic—It’s Earned

• Any interest in chatting about M365 and eDiscovery?

I took a break during the holidays for my own reasons, but it did help that Microsoft also seemed to make fewer announcements and roll out fewer new features for a few weeks.

It also didn’t hurt that many other sources were taking a similar break. So, while this issue might seem a bit light on news, things are starting to pick up, especially with the change to making Claude available by default, and some other new Copilot features related to that. Not to mention a few new things that I have some security concerns about, like Computer Use inside the Researcher agent.

What new features have caught your eye recently?

Leave a comment

Before we jump into the news, a reminder about the survey I shared last week:

Would you be interested in getting together over a Teams channel to discuss M365, eDiscovery, and other related topics with other subscribers? Perhaps even schedule some chats on occasion? (Paid subscribers, I’ve got some ideas just for you as well.) If you are interested, sign up here. If there’s enough interest, we will definitely get this going in the next few weeks.)

Copilot News:

In December, we saw Copilot add the ability to access some different models:

• Available today: GPT-5.2 in Microsoft 365 Copilot

• The Model Choice Era: What Anthropic Means for Microsoft 365 Copilot

• Anthropic now a Microsoft Subprocessor - Claude had been available but this change made it more palatable for those of us with confidentiality concerns.

I spent some time looking at this and came away thinking it’s essentially a shortcut to things I could do before, but maybe a bit easier to get to. - Files Agent in Microsoft 365 Copilot!

Similarly, this agent makes it easier to work directly with files as you browse OneDrive - Meet Agents in OneDrive: Your AI assistant built with your own content.

I have not spent any time experimenting with the Purview agents yet, mostly because my test tenant is too small to do much with Copilot for Security that would provide much insight. But, if you’re curious:

This is a good overview of one of my favorite MS-built agents - Copilot Agents: Getting Real Work Done with the Researcher Agent

I understand that it can be confusing to know which one to use - Copilot Pages vs. Copilot Notebooks

Non-Copilot News:

Somewhat related to Copilot, but this is really about Information Governance and Security - Strengthen Microsoft 365 Copilot Security

Keep this one handy - 2026 End-of-Support Milestone in Microsoft 365

I would agree that Purview is good at some things, but not at others. Mostly because some people want it to do things it was never designed for. - Microsoft Purview: What It Is (and Isn’t) Designed to Do

Also - A Quick Look at Purview Data Security Investigations

And this:

This is important to know - Why Purview eDiscovery Slows to a Crawl with Legacy Journal Data.

This is something Tony flagged from the Message Center that I’m keeping an eye on. I’ll have more when it rolls out - Purview eDiscovery Simplifies Content Searches in Feb 2026

If you’re using labels and want to extend permissions to files after they’ve been downloaded, this might also interest you - Extend Permissions to Downloaded Files in SharePoint Online.

That’s what I’ve been reading lately. I’ve got some tests I want to run over the next couple of weeks. More on those to come in the coming weeks!

As I am often wont to do, I sent the newsletter last week and immediately had another question. Because, of course, my brain couldn’t move on.

I’m not obsessed, honest. Ha!

Before we get to that, however. I have a question for you. Would you be interested in getting together over a Teams channel to discuss M365, eDiscovery, and other related topics with other subscribers? Perhaps even schedule some chats on occasion? (Paid subscribers, I’ve got some ideas just for you as well.) If you are interested, sign up here. If there’s enough interest, we will definitely get this going in the next few weeks.)

As I showed last week, when I sent the invitation to a biweekly meeting and then used the keyword in the title to collect it, my query only returned 4 items. The sent invite, the received invite, and the single instance of the meeting on each calendar.

There was no evidence that the meeting would continue beyond that date.

BUT.

What if I changed one of the future events and sent an update?

So, I went out and changed the January 29 occurrence to the next day, January 30th. Then I ran the query again.

Now there are nine items returned.

• The original four, obviously.

• Two emails (an updated invite sent and also received)

• Three additional calendar items.

The first two items on that list were expected. It was the additional calendar items that had my attention.

Would those show me the details of what changed?

Not so fast…

Isolating the five items where item.class=IPM.Appointment, I was first interested in seeing where they came from.

Two were directly from each user's calendar. Just the way they were previously. They each displayed the meeting start and end dates from the first date of the meeting, January 1.

The other three were in the Recoverable Items portion of the Exchange mailbox.

In other words, they’d been deleted when that scheduling change was made.

Yet they also all displayed metadata showing the start and end dates as January 1st.

Cue the eye-roll.

The only metadata that indicated a change to one recurrence was the updated invite, which shows as being sent on January 11.

That invite, which has a different item class due to being an invite as opposed to a calendar item, does indicate the change:

To sum up, here’s what you can expect for a recurring meeting using the native eDiscovery tools:

• Copies of the invitation are in all user mailboxes. (They are usually deleted, however.)

• One calendar item per user - metadata only indicating the first occurrence.

• If one occurrence is changed, an updated invitation email is sent to all users with the new date and time. (Also likely deleted when accepted.)

• Old versions of the calendar item in the sender's mailbox all indicate only the first occurrence.

I’m suddenly looking at one of the items I would least likely consider to be important as an end user, the updated invite, as the only way an eDiscovery professional would be able to determine any future dates of this recurring meeting.

Let’s not start with the number of recurrences that happen on the scheduled date and time that are not indicated in the collection at all!

As I mentioned last week, exporting calendar data from Outlook is the way to go here. Or am I crazy to suggest that?

Have you seen this issue crop up in a real-world case? How have you handled it?

Leave a comment

Recently, I recorded an interview with Anna Bordioug and Justine Wolters from the International Data Security User Group.

The group hasn’t yet posted the full video. Still, they released this clip about the difficulty of searching for dates, because the metadata fields MeetingStateDate and MeetingEndDate are not searchable in eDiscovery queries. The only date you can use to search is the date of the meeting invitation, which may have been weeks or even months prior.

The workaround I suggested is valid. Once the calendar items are in the review set, you can filter on those fields, but before then, the fields don’t seem to be part of the index.

That’s a problem many don't foresee until they run a query and start seeing very odd results.

That conversation also reminded me of another area where meetings are challenging.

Recurring meetings.

You may be thinking to yourself that recurring meetings would present a problem because the invite may be sent in January to cover an entire year, or more. How far back in your date range would you need to go to capture calendar information for a user who regularly attends team meetings?

It turns out that’s not even the worst of it.

No, the worst of it is that those recurring events don’t exist past the first occurrence.

To demonstrate this, I created a New Year’s Day meeting and set it to recur every 2 weeks for 6 months. I deliberately included the term “20260101” in the meeting title.

I ran a tenant-wide search for the term 20260101.

I got four hits. I pulled them into a Review Set.

I have two emails and two calendar items. (One of each from the organizer and the invitee mailboxes. Since I sent the invite to the other user, this makes sense; it would be the same for a one-off meeting.)

That’s all. There are no calendar entries beyond that, even though I can clearly see the events on my calendar. In fact, there’s nothing in the Review Set to indicate that this was a series of meetings rather than a one-time event.

This could be a problem.

Let me share the details:

Read more

Before we dig into the roadmap, this will be the last newsletter for 2025. I’m taking some time away from the newsletters over the holidays, mainly to deal with a merger becoming effective after the 1st at the day job and to avoid losing my mind. Also, I’d like to get a little time to enjoy the holidays. I hope you do as well!

I’ll be back in January with some new ideas, possibly new resources for subscribers, and ways for y’all to get involved in building that community I’ve been talking about for keeping up with M365! More on that coming in January.

If you have any ideas for that, or want to talk about what you’re tracking going into the new year, let us know!

Leave a comment

Now, let’s talk about the roadmap. Here’s the list of things that are directly related to eDiscovery:

Microsoft Purview compliance portal: eDiscovery (Premium) - CMK (Customer Managed Keys) encryption support for data at-rest in Review sets

Microsoft Purview compliance portal

IN DEVELOPMENT

PREVIEW AVAILABLE

June 2026

ROLLOUT START

August 2026

This release of eDiscovery features the implementation of customer-managed key (CMK) options, allowing users to manage their own encryption keys for the data stored in eDiscovery review sets in addition to the default, strong Microsoft-managed encryption already in place.

Roadmap ID

117569

Microsoft Purview compliance portal: eDiscovery - Advanced Review Set Query Editor

Microsoft Purview compliance portal

IN DEVELOPMENT

PREVIEW AVAILABLE

February 2026

ROLLOUT START

July 2026

The Advanced Review Set Query Editor empowers reviewers to harness the power of real-time big data analytics on their review set data. This tool enhances data analysis by offering insights such as identifying top item types, spotting patterns, and trends within the review set. Reviewers can utilize powerful query constructs like complex filtering, pattern-based text extraction, and data format parsing to analyze and find key information specific to their case or organization. The results can then be visualized using time charts, histograms, and other flexible charting solutions, providing a comprehensive understanding of the data’s story.

Roadmap ID

484086

Microsoft Purview compliance portal: eDiscovery (Premium) – Hold reports

Microsoft Purview compliance portal

IN DEVELOPMENT

PREVIEW AVAILABLE

December 2023

ROLLOUT START

June 2026

Out-of-the-box reports that contain information about all legal holds associated with eDiscovery cases in the Microsoft Purview compliance portal. Sort and filter your view based on various criteria and download the aggregated information for further analysis. Note: The status and release month has been updated to reflect the current state. We apologize for any inconvenience this may cause.

Roadmap ID

93268

Microsoft Purview compliance portal: eDiscovery - Efficient Review with Advanced Minimization Algorithms

Microsoft Purview compliance portal

IN DEVELOPMENT

PREVIEW AVAILABLE

December 2025

ROLLOUT START

June 2026

Sophisticated algorithms analyze the review set and pick out the best set of documents to review while hiding redundant information. A new analytics relationship view and detailed reports for each analytic run through the new unified reporting format allow you to have confidence in the results. The analytical information is available in both our new insights experience and export load files, allowing you to easily adopt this efficiency boost into any workflow.

Roadmap ID

485766

Microsoft Purview: eDiscovery - Add Sample to Review Set

Microsoft Purview compliance portal

IN DEVELOPMENT

ROLLOUT START

February 2026

This feature allows users to add only a sampled subset of search results to a review set, rather than adding the entire query output. Users can configure sampling parameters—such as confidence level and sample size—to ensure the subset meets their review objectives while reducing unnecessary data ingestion.

Roadmap ID

516578

Microsoft Purview compliance portal: eDiscovery - Generate keyword query language from natural language prompt in eDiscovery with Copilot for Security

Microsoft Purview compliance portal

IN DEVELOPMENT

ROLLOUT START

January 2026

Copilot for Security is embedded in eDiscovery to enable users to provide a search prompt in natural language and will translate into keyword query language to help expedite the start of an eDiscovery search.

Roadmap ID

505444

Cloud instances(s)

GCC

Microsoft Purview compliance portal: Import Non-M365 data into review set for modern eDiscovery

Microsoft Purview compliance portal

ROLLING OUT

ROLLOUT START

December 2025

Microsoft Purview modern eDiscovery experience now enables legal and compliance teams to import non-Microsoft 365 data directly into review set as part of the modern eDiscovery workflow. This feature allows organizations to consolidate all their data into a single secure review environment for streamlined review.

Roadmap ID

497638

Cloud instances(s)

Worldwide (Standard Multi-Tenant), GCC, GCC High, DoD

I’m intrigued by the new capabilities coming to review sets. Adding non-M365 data was there before the new interface, so I am curious if they brought it back as-is or made any improvements. Expect some testing results with that in January! The advanced minimization algorithm sounds interesting, as does the ability to load a sample into a review set - a feature that could save a lot of lost time when the data collected doesn’t match expectations.

Of course, there is still a roadmap item for hold reports, even after they reappeared earlier this year. Could that mean improvements? They could use some. I’m hearing reports that the reporting isn't updating correctly as changes are made, which defeats the purpose.

We’ll see!

Some other items have my attention. They don’t directly impact the eDiscovery tool, but they will affect the eDiscovery workflow, some by simply creating data we’ve not seen before:

Microsoft Purview compliance portal: Data Lifecycle Management - Automatic data preservation for high-risk users

Microsoft Purview compliance portal

IN DEVELOPMENT

PREVIEW AVAILABLE

June 2024

ROLLOUT START

June 2026

Adaptive Protection in Microsoft Purview helps you protect your organization’s data by integrating dynamic insider risk levels, determined by data related activities, with various policy engines to automatically moving users in and out of policies as their risk levels change over time. The integration with Data Lifecycle Management will automatically apply retention labels to preserve deleted emails and files based on a user’s insider risk level.

Microsoft Purview compliance portal: Cloud Attachments preservation for users on hold

Microsoft Purview compliance portal

IN DEVELOPMENT

PREVIEW AVAILABLE

May 2026

ROLLOUT START

June 2026

Enables cloud attachment preservation for users put on infinite hold so that file versions shared are preserved across any OneDrive or SharePoint site. This is a new capability which is different from the existing capability of applying label to cloud attachments and links present in OneDrive and SharePoint and shared in Exchange, Teams, Viva Engage and Copilot

Planner: Project Manager agent in basic plans

Planner

Microsoft Copilot (Microsoft 365)

IN DEVELOPMENT

PREVIEW AVAILABLE

January 2025

ROLLOUT START

April 2026

Project Manager agent will now be available for M365 Copilot licensed users in all Planner plans, including basic plans.

Microsoft Purview compliance portal: Communication Compliance - Ability to set a retention period for a policy

Microsoft Purview compliance portal

IN DEVELOPMENT

ROLLOUT START

February 2026

Introducing the ability to define how long content captured by a Communication Compliance policy is retained. Microsoft Purview Communication Compliance provides the tools to help organizations detect regulatory compliance violations (e.g. SEC or FINRA), such as sensitive or confidential information, harassing or threatening language, and sharing of adult content. Built with privacy by design, usernames are pseudonymized by default, role-based access controls are built in, investigators are opted in by an admin, and audit logs are in place to help ensure user-level privacy.

More info

Microsoft Teams: Ability for all participants to start collaborative annotations

Microsoft Teams

IN DEVELOPMENT

ROLLOUT START

February 2026

All participants in meetings are now able to start collaborative annotations. This will only be available in the new Microsoft Teams experience.

Microsoft Copilot (Microsoft 365): Intelligent meeting recap can summarize content shared on screen

Microsoft Copilot (Microsoft 365)

IN DEVELOPMENT

ROLLOUT START

February 2026

Intelligent meeting recap can incorporate content shared on screen in the AI-based summary provided after the meeting, providing a richer and more comprehensive recap of the meeting. It captures details that are shown when a participant shares their screen, ensuring those unspoken insights become part of the meeting recap.

Microsoft Teams: Share meeting recap to SharePoint

Microsoft Teams

IN DEVELOPMENT

ROLLOUT START

February 2026

Meeting organizers and presenters can share meeting recap notes and follow-up tasks directly from Teams to SharePoint as a news post, facilitating the seamless sharing of post meeting follow-up details.

Microsoft Purview compliance portal: Data Lifecycle Management - Retention based on Last Accessed for files in OneDrive and SharePoint

Microsoft Copilot (Microsoft 365)

Microsoft Purview compliance portal

IN DEVELOPMENT

PREVIEW AVAILABLE

December 2025

ROLLOUT START

January 2026

This creates the ability to apply Retention to each SharePoint or OneDrive item based on when it was last accessed by a user. #copilotcontrolsystem

Microsoft Purview compliance portal: Data Lifecycle Management - Apply a retention policy to Microsoft Planner content

Microsoft Purview compliance portal

IN DEVELOPMENT

PREVIEW AVAILABLE

November 2025

ROLLOUT START

January 2026

Introducing Data lifecycle management capabilities for Microsoft Planner. Compliance admins can now create a retention policy to manage content located in Microsoft Planner such as tasks for plans associated with an Microsoft 365 Group.

Microsoft Copilot (Microsoft 365): Use Copilot to Share with Summary for OneDrive files in Windows

OneNote

Microsoft Copilot (Microsoft 365)

IN DEVELOPMENT

ROLLOUT START

January 2026

We’re bringing the power of Microsoft 365 Copilot directly into your daily file experience in Windows. With this feature, users can summarize files and send the summary within the share dialog. This feature will be available in File Explorer and OneDrive Activity Center.

Microsoft Copilot (Microsoft 365): Video recap in Copilot Chat

Microsoft Copilot (Microsoft 365)

ROLLING OUT

ROLLOUT START

December 2025

Video recaps in Copilot Chat makes it easy to catch up on recorded meetings directly in Copilot Chat. It identifies and extracts key topics from transcripts, provides AI generated narration to summarize discussions, and pairs these with 20–40 second video snippets highlighting impactful moments of your meeting.

Microsoft Copilot (Microsoft 365): Customize AI-generated notes in meeting recap

Microsoft Teams

Microsoft Copilot (Microsoft 365)

ROLLING OUT

ROLLOUT START

December 2025

Users can now customize the AI-generated notes in meeting recap, instantly transforming meeting notes into the format that works best for each person. Choose from built-in options like Speaker Summary or Executive Summary to quickly surface the details that matter most. Users can even create and save their own custom templates with a simple prompt, so meeting notes always match the way each user prefers to work.

Microsoft Purview: Data Lifecycle Management-Introduction of secure workflow to bypass retention holds and delete Teams transcripts and/or Teams recordings

Microsoft Purview compliance portal

ROLLING OUT

ROLLOUT START

December 2025

Introducing a capability to Purview compliance admins via a Data Lifecycle Management to bypass retention hold or legal holds to delete content on OneDrive or SharePoint Online such as Teams meeting transcripts and/or recordings earlier than the hold durations to comply with emerging compliance requirements. Leveraging Simulation, authoring approvals, Audit and disposition reviews to set-up and enforce defensible policies.

I’m sure this doesn’t even begin to cover everything that may impact what you’re doing with eDiscovery. There are also a ton of items on the roadmap that I’m tracking as part of my new role at work, covering information governance and compliance, as well as new Copilot and Teams features to educate users about.

Things are not slowing down in 2026, that’s clear. That’s why I’m looking at better ways to get all of our heads together to help keep up!

See you in 2026!

In September, I shared information about the warnings Microsoft had issued regarding the use of Anthropic’s Claude LLM in Copilot.

Essentially, Microsoft sent your prompt to Claude, then left your Data Protection Agreement and moved it into whatever data protection Anthropic offered.

For many of us, that proved to be a show-stopper, at least temporarily, because we hadn’t vetted that agreement.

Now, things have changed:

Anthropic is now a Microsoft Subprocessor

As a subprocessor, Anthropic will operate with Microsoft oversight through contractual safeguards and appropriate technical and organizational measures. The Microsoft Product Terms and Microsoft Data Protection Addendum (DPA) apply to use of Anthropic models through Microsoft’s enterprise Online Services. Such use is also covered under our Enterprise Data Protection.

This may change things for many of us, allowing us to take advantage of Claude without the concern of having our attorney vet data protection agreements.

Have you used Claude from within Copilot? How is that going?

Leave a comment

Copilot News:

So many new features and changes coming:

• Copilot’s Temporary Chat

• Microsoft Agent 365: The control plane for AI agents

• This is one of those features enabled by allowing access to Claude - Microsoft’s new AI agents create your Word, Excel, and PowerPoint projects now.

• The next chapter for AI-powered work management in Microsoft Planner

• Copilot Notebooks Is Getting Better, Here’s What’s Coming Next in 2026.

• Voice turns Microsoft 365 Copilot into your thought partner.

• You can now choose between quick responses, deeper thinking, or letting GPT-5 decide for you. More in the video below:

If you’re not familiar with Security Copilot and wondering what it offers now that Microsoft will be including it with your Copilot license, these links might help:

• Agents built into your workflow: Get Security Copilot with Microsoft 365 E5

• With Security Copilot now part of Microsoft 365 E5, what do you actually get?

Finally, we can’t forget about Copilot governance:

• Preparing Your Microsoft 365 Environment for Copilot: A Security & Governance

• Governing Microsoft 365 Copilot: How to Mitigate Oversharing Risks?

• This should be a good session - Protect Your Microsoft365 Data in the Age of AI.

• Purview Launches New DLP Policy to Control Copilot Prompts

Non-Copilot News:

There’s a price increase coming, along with new features:

https://www.microsoft.com/en-us/microsoft-365/blog/2025/12/04/advancing-microsoft-365-new-capabilities-and-pricing-update/

Other posts catching my eye lately:

• Insider Risk Management Demystified — How Microsoft Purview Helps You Spot Risks Before They Become Incidents

• Getting Sensitivity Labeling Right in Microsoft Purview: A Practical Guide for Modern Organisations

• Conditional Access in Microsoft 365 – Real-World Scenarios

• This series should be educational - Compliance Meets AI 2026: Microsoft Purview in the Age of AI.

• Microsoft Teams is finally getting two long-requested productivity features. - Autocorrect and cross-tenant notifications. Nice.

Of course, if you look at the M365 Roadmap, there’s a ton of change headed our way in 2026. Next week, I’m going to dig into some of the things from the roadmap coming in 2026 that will impact the eDiscovery process. If you’ve seen anything pop up there or in the message center lately, leave a comment or send me an email so I can make sure to pay attention to it. I fear that I cannot keep up with it all, and I am likely missing something.

Hoping the community can back me up. ;-)

Happy December, folks.

As I mentioned last week, I didn’t see significant impacts on eDiscovery from the many, many Ignite announcements. Still, as new tools started hitting tenants, I planned to test many of them to determine any minor adjustments we may need to make.

This week, the features I saw rolling out were the addition of Copilot and agents to Teams chats and channels.

Before we get into the eDiscovery details, I want to warn you that this testing may need an update, as these tools seem less than stable for me right now.

Specifically, I noticed that adding a channel agent or adding Copilot to a group chat let me interact with Copilot. If I asked a question, I would need to review the response before making it available.

This process did not go well.

My first attempt never displayed the response.

Another attempt using a channel agent instead of adding Copilot as an app to the channel did display a response, without asking me to review it first.

Adding Copilot to a group chat eventually showed me the response so that I could allow it, but the process timed out repeatedly, never posting it to the chat.

Thus, my eDiscovery collections show some incomplete responses because I was unable to publish them.

We assume these hiccups will be resolved and the features will work again, so let’s focus on the eDiscovery issues at play.

The first thing that caught me by surprise was that these interactions are not, in fact, Copilot interactions.

At least not in the metadata sense.

Searching for Copilot interactions will not bring these chat and channel messages back as hits because they are Teams messages.

Teams treats Copilot as a Teams user that you are chatting with. Thus, when dealing with this in eDiscovery, we want to think of it as Teams data rather than Copilot data.

As in:

• Chats that include Copilot will store prompts and responses in the mailboxes of individual members as Teams messages.

• Chats and agents added to a channel will store prompts and responses in the Team's group mailbox.

• Channel agents will generate Status reports based on the channel activity, which are stored as Loop files in the Team’s SharePoint. However, they are not stored in a subfolder of the channel, but in a new folder named Shared Documents. See the path below:

https://mikemcbride365.sharepoint.com/sites/M365/Shared Documents/Shared Documents/Roadmap/Status Reports/Dec 02, 2025 - Weekly status report - Roadmap Agent.loop

A couple of other interesting items I found along the way:

Read more

I spent much of last week overwhelmed by the flood of Microsoft announcements. New Copilot features, AI agents, AI licensing, new models, new AI admin tools, AI built into seemingly everything, and on and on.

The question that I spent some of the weekend looking at in preparation for writing this issue was, “How much of this has an eDiscovery impact?”

The reality is that while there is a lot to evaluate with Copilot, all the new agents and new capabilities to build agents, and connect to new data sources, don’t seem to change anything in terms of how we would handle prompts and other Copilot-related data in eDiscovery.

That’s not to say there aren’t a few things that I want to cover quickly. What I don’t see are any significant changes that will force us to rethink workflows completely.

Let’s start with one seemingly insignificant change that I confirmed has rolled out when using Copilot Pages.

They are no longer created with a .loop file extension. They are now designed with a .page file extension.

I wrote about this change when it was first posted to the Message Center in July. There’s no surprise here.

A new Copilot feature that I’ve also seen is the option to create a “Temporary Chat.”

This one might seem like a change that would impact eDiscovery, but it doesn’t. Let’s take a look at what it does.

When I first saw it, I was concerned that this might be creating ephemeral chat that wasn’t being saved to the user's mailbox, or some other temporary interaction that wouldn’t be discoverable.

Then I read the full description:

To the front end of Copilot, this chat will be treated very differently. Copilot won’t learn from it, and you won’t be able to see it listed in your history.

On the back end, though, it’s mostly just another Copilot chat.

In fact, the only difference I noticed is the filename of the attached HTML file containing the Copilot response; instead of Microsoft Copilot.html, it’s Temporary Chat.html. (Which is an obvious way to tell that the user used that feature.)

One of the new agents I have started testing was the Frontier program agents for Word, Excel, and PowerPoint. I was very curious about the idea of having the agent go from Copilot on the web, or in the Copilot app, to creating a new document. Again, the Copilot interaction wasn’t very different, but the document that was created as a result of those interactions was automatically stored in a new OneDrive folder - Copilot_Generated_Documents.

You might want to familiarize yourself with that folder location.

There are a few more items from last week that I suspect may have some minor impacts on eDiscovery. I will be sure to provide another update on those items in a few weeks. If you follow me online, you know things have been a little busy, so my available time for testing is limited. Still, as I notice changes, I will share them.

In the meantime, I’m going to try and get a little offline time over the Thanksgiving holiday, and I hope those of you in the US can do the same.

I’m thankful for you being here on this journey into the Microsoft eDiscovery world with me.

Leave a comment

A few weeks ago, I shared my testing results with new-to-me artifacts from a Teams meeting.

I want to follow up on something that I have since discovered in my tenant. I recently gave a demo of the Facilitator agent in a Teams meeting at work. When I got to the end and had pulled up a recent AI Summary from a meeting I had earlier in the week, I spotted the “Audio Recap” button.

Clicking it presented me with options for generating the recap in three styles: executive, newscast, and casual - with two voices in a podcast-like format.

The audio recap is fine. It didn’t blow my mind, but it was a decent recap of what was discussed, what decisions were made, etc. It occurs to me that there are worse ways to get up to speed on a meeting you missed or had to dip out of early. Plus, the audio makes it easy to listen to while doing something else.

Unlike the text version of the AI Summary, however, the eDiscovery was different.

Let me recap what happens when you use Copilot and the Facilitator Agent in a Teams meeting:

1. The facilitator takes notes in the Meeting notes tab, a Loop file available to ediscovery.

2. If Copilot was granted access during and after the meeting, the meeting will be transcribed. The transcription is available in the eDiscovery tools, but it’s a bit complicated, as we saw in the link above. A clean copy of the transcript isn’t available unless a user exports it, but you do get JSON files containing the transcript's content.

3. The AI Summary is available in the Meeting recap tab in Teams, but it is not accessible to the eDiscovery tool.

4. If you generate an audio recap, however, the MP4 file is copied to your OneDrive and thus is available to the eDiscovery tools. (Albeit, the file isn’t text searchable. My attempt at collecting using a keyword that was in the podcast-like audio had no hits.)

Audio recaps get created inside the Recordings folder in your OneDrive.

This makes them easy to listen to on the go. It’s great for collecting them, if it ever becomes an issue in litigation.

The file naming isn't very good at identifying which meeting they came from when you collect them from OneDrive.

The sub-folder that gets created is named with the time-stamp of when it was generated, and the filename is generic.

teams_audio_recap_full_audio.mp4 won't help anyone understand the meeting's context. I can’t even tell you what meeting this is from if you remove it from the Teams calendar context.

Then again, how often do we think you’ll need to review an AI-generated recap of a meeting?

However, this was just the start of my journey.

After running my keyword search to confirm that I couldn’t collect the audio recap based on a keyword in the audio, I went ahead and collected it using a date range and pulled it into a Review Set.

This was where things got really crazy.

My review set did not have a file named teams_audio_recap_full_audio.mp4.

It did have one named teams_audio_recap_full_audio.zip. There were 84 items inside the zip.

Read more

There is an infamous story I tell about the time I was training a client on the M365 eDiscovery tool. While looking at data in a review set, I navigated out to discuss the advanced settings, only to return to the review set with a completely different interface.

It changed in the 3 minutes I spent outside of the review set.

It’s good for a laugh, albeit a nervous one.

Last week, something similar happened as I was showing a group of users how to use the Facilitator agent. I went into the recap from the previous demo, and as I was showing them the AI Summary, a new button appeared to generate an audio summary.

That’s always interesting. It is also exciting. I’m going to spend some time evaluating how useful those summaries are. I expect they won't be perfect, but they could help quickly remind us of what was discussed and decided a month later, when we’ve all forgotten.

So, my advice, as always - stay vigilant, my friends. Changes are coming at us every day.

Leave a comment

Copilot News:

Speaking of new Copilot features:

• Microsoft 365 Copilot now enables you to build apps and workflows

  • Related - How to Make Your Own App in Minutes!

  • Also related, is this an improvement? - Can Flow Builder replace Power Automate?

• Introducing Researcher with Computer Use in Microsoft 365 Copilot

• Introducing Teams Mode for Microsoft 365 Copilot—I’m not sold on the idea that there is a massive demand for this. I may be wrong.

• A new way to collaborate with Copilot in Teams chats

I’m also not sold on this, despite Microsoft's assurances that work data remains work data even when personal Copilot is used to interact with it. - What is ‘Bring Your Own Copilot’ to Work (BYO-Copilot)?

Perhaps the most significant struggle we all have with Copilot is showing the ROI - 5 Steps to ROI with Microsoft 365 Copilot

Non-Copilot News:

Some good documentation to share with you that I’ve discovered recently:

• Using the SharePoint Online Site Attestation Policy

• A struggle for many - Set Up Secure Guest Access in Teams Without Compliance Risks

• An essential tool that can also be a struggle to implement - Conditional Access Essentials: From Report-Only to Enforced Mode

• Another look at DSPM for AI - Monitor AI Interactions with DSPM for AI in Microsoft Purview

• There are so many. - Understanding Microsoft 365 Admin Roles: A Beginner’s Guide

• Obviously, I agree - Microsoft Loop is underrated, and these features prove it

  • But don’t lose sight of this - Microsoft Loop: Recycle Bin Guide

• David made the slides from this panel presentation at Experts Live NYC available— I Have Microsoft Purview... Now What!?

This is important to do -

Intranet from the Trenches

Create Secure Microsoft 365 Admin and Break Glass Accounts

Imagine a phishing attack compromising your admin account, putting your entire Microsoft 365 environment at risk—or a misconfigured policy locking out your team during a critical operation. This second article in our four-part series builds on the foundation of administrator roles and the principle of least privilege (PoLP) to equip you with practical s…

Read more

6 months ago · 1 like · 2 comments · Jaime López

New posts from the blog

• Worth Reading - Enabling Knowledge Agents in SharePoint: Pain control - Have you tried this yet?

• When a new feature sounds scary, but isn’t anything worth worrying about

  • If you don’t realize that your employer’s IT folks already have a dozen different ways to tell whether you’re logged in to the office wifi or not, you’re kidding yourselves. We didn’t need Teams to start ratting out employees.

• Worth Reading - New Audio-Only Recording Option for Teams Meetings - why are we only getting this now?

Until next time, let me know what new features you’re excited about, or which ones have fallen flat in your opinion. I’m always curious to know what y’all are thinking!

Before we get started, a shout-out to the forensic experts I had the opportunity to speak with in Orlando last week. I wrote about the experience in the Thought-Provoking Things newsletter on Friday, so that I won’t repeat it here. Suffice it to say, the challenge of collecting data from M365 was on full display, and the audience engagement and feedback were fantastic.

I briefly mentioned last week, during my discussion of using the Facilitator agent in meetings, that I found something interesting in my mailbox about transcripts. This week, I want to share more details of what I saw.

As described, my testing involved using the agent in a meeting and then collecting everything from that specific day, allowing for the possibility that Copilot could create artifacts anywhere. This is a one-account tenant, so I can still search across the entire thing without making a huge collection, so I’m taking advantage of that while I can.

My query identified 129 items, 88 of which came from my mailbox. That last number seemed high for a mailbox that hosted one meeting with an agent and had received just 3-5 emails.

Once collected into the review set, it became apparent that many of those items were HTML files stored in Exchange Online. What were they, though?

It turns out they were transcript snippets. Here is an example of the content of one such HTML file:

It’s a list of properties with values for the meeting and conversation IDs, speaker, body (snippet text), start and end times, etc. In effect, the Exchange Online mailbox now stores multiple HTML files that comprise the entire transcript of the meeting I hosted.

This seems simple enough, but it does pose some eDiscovery challenges because the HTML file lacks context. If an attorney comes across this during document review, what are they to make of it? How would they know where it came from?

There are a couple of other questions it raises for me:

Read more

If you haven’t tried adding the Facilitator to a Teams meeting, I recommend giving it a test run.

I first experimented with it in a test meeting, where I had the ebook I had been reading playing through one of the accounts, and watched as the agent took notes, answered questions for me about what had been said in the meeting, and created follow-up tasks based on my comments and chat messages.

It was reasonably accurate, too.

My only complaint was that the meeting notes were about five minutes behind the meeting, but when you consider that the agent needs to sort through the transcript and then make notes based on the content, it makes sense that there would be a delay.

Otherwise, I found it to be handy.

See how it took notes, including a follow-up task, and answered my question:

My second test run was doing a live demo for our team and talking about how to set it up, how it worked, and demonstrating it during a live meeting. It took solid notes, created some follow-up tasks per request, and answered questions.

A couple of notes about how this works:

• Questions you ask the Facilitator in chat are viewable to everyone else in the meeting chat. If you want to ask a question about the meeting privately, you can use the Copilot button in the meeting as opposed to chatting with the agent.

• Only meeting attendees with a paid Copilot for M365 license can interact with it, and no external users can interact with it. They can, however, see the meeting notes and chat.

• The transcription occurs during the meeting automatically when you add the Facilitator; however, the transcript is not kept after the meeting if you only allow Copilot during the meeting in the meeting options. Of course, when Copilot is only available during the meeting, you also do not get the post-meeting AI Notes either, which seem slightly more organized and detailed than the meeting notes taken during the meeting by the Facilitator. This seems normal and very human-like.

• The AI Notes are also not available to anyone external or internal who does not have a paid Copilot license. You can use a one-button click to copy them to an Outlook email message addressed to the attendees, if you so choose.

• While it was creating tasks, it could not assign them. That is a Teams Premium feature, so I was not surprised that it was not able to do that without that license.

Naturally, I began to wonder about all of these artifacts and the eDiscovery implications.

Read more