eDiscovery and Meetings
M365 eDiscovery does a poor job with meetings.
Recently, I recorded an interview with Anna Bordioug and Justine Wolters from the International Data Security User Group.
The group hasn’t yet posted the full video. Still, they released this clip about the difficulty of searching for dates, because the metadata fields MeetingStateDate and MeetingEndDate are not searchable in eDiscovery queries. The only date you can use to search is the date of the meeting invitation, which may have been weeks or even months prior.
The workaround I suggested is valid. Once the calendar items are in the review set, you can filter on those fields, but before then, the fields don’t seem to be part of the index.
That’s a problem many don't foresee until they run a query and start seeing very odd results.
That conversation also reminded me of another area where meetings are challenging.
Recurring meetings.
You may be thinking to yourself that recurring meetings would present a problem because the invite may be sent in January to cover an entire year, or more. How far back in your date range would you need to go to capture calendar information for a user who regularly attends team meetings?
It turns out that’s not even the worst of it.
No, the worst of it is that those recurring events don’t exist past the first occurrence.
To demonstrate this, I created a New Year’s Day meeting and set it to recur every 2 weeks for 6 months. I deliberately included the term “20260101” in the meeting title.
I ran a tenant-wide search for the term 20260101.
I got four hits. I pulled them into a Review Set.
I have two emails and two calendar items. (One of each from the organizer and the invitee mailboxes. Since I sent the invite to the other user, this makes sense; it would be the same for a one-off meeting.)
That’s all. There are no calendar entries beyond that, even though I can clearly see the events on my calendar. In fact, there’s nothing in the Review Set to indicate that this was a series of meetings rather than a one-time event.
This could be a problem.
Let me share the details:
