M365 Group Membership Lookup in the New eDiscovery Interface

It isn't as obvious, but it can be done.

Photo by Ed Hardie on Unsplash

If you’ve been subscribed to the newsletter for a while, you may remember how happy I was when Microsoft included the ability to look up what Teams a Custodian was a member of, what SharePoint sites they had access to, etc.

The workflow here was obvious. If I am investigating an individual, or we’ve identified an individual as a priority custodian of data related to litigation, knowing what Teams channels they were part of becomes paramount. I was hesitant about whether I would collect that data and identify them as the custodian of shared Teams data, but knowing which teams were in play could be a huge help. (BTW, it turns out that Premium no longer does this. Even when collecting from a Custodial Data Source that includes a Teams mailbox/site, it assigns a GUID as the Custodian of items collected from the Teams locations versus the user mailbox and OneDrive. This is excellent. This may also be old news to many of you. I haven’t looked at it in a long time, to be honest.)

One of the first things I noticed in previewing the new Purview eDiscovery interface was the lack of that information when I added a user as a data source.

Here’s a visual comparison.

Premium eDiscovery when adding my user account as a data source:

Choosing the Edit button next to Teams, Yammer, Exchange, or SharePoint gave me a list of those resources I had access to:

In the new Purview eDiscovery interface, adding my user account as a data source didn’t display that information:

It defaults to my mailbox and OneDrive. That was it.

This was disappointing, but we can look up more information from a different screen. It wasn’t obvious, but there’s a similar feature buried in a menu.