prerequisites - microsoftmoddemodocs.blob.core.windows.net/resources-prod/… · web viewopen...

Office 365 Advanced eDiscoveryDemo Guide

This document is provided “as-is”. Information and views expressed in this document, including URL and other Internet Web site references, may change without notice. You bear the risk of using it. This document does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this document for your internal, reference purposes.

© 2017 Microsoft. All rights reserved.

2

Demo Guide Office 365 Advanced eDiscovery

ContentsPrerequisites.................................................................................................................................................................. 4

Demo home page and login........................................................................................................................................ 4User Accounts............................................................................................................................................................. 4First-time Post-Install Steps........................................................................................................................................ 4

Office 365 Advanced eDiscovery Pre-demo Setup Steps...............................................................................................5Office 365 Advanced eDiscovery Demo Steps...............................................................................................................7

Security & Compliance Center.................................................................................................................................... 7Advanced eDiscovery............................................................................................................................................... 10Relevance Training................................................................................................................................................... 12

Office 365 Advanced eDiscovery Reset Steps..............................................................................................................17Office 365 Advanced eDiscovery Post-Install Steps.....................................................................................................17

3


PrerequisitesDemo home page and loginYou will need a Microsoft Office Demo (MOD) Office 365 tenant to complete this demo. You can obtain a demo environment at http://demos.microsoft.com.

User AccountsMegan Bowen (alias MeganB) is the typical account used in MOD Hero demo modules. If this MOD Hero module requires a different account for log in or if additional log in accounts are needed, the information is provided in the Pre-demo Setup Steps.

o Office 365 tenant: https://<Tenant>.sharepoint.com/sites/contosoo User name: MeganB@<Tenant>.onmicrosoft.como Password: Your password can be located within the details section of your tenant on

demos.microsoft.com

First-time Post-Install StepsNot all features used in this presentation are provisioned in your demo tenant!The Office 365 Advanced eDiscovery Post-Install Steps at the end of the document walk you through creating the Enron Case and the California Search that you will use in the presentation.NOTE: Data analysis, content indexing, and preparing the results for analysis take time to complete. You should complete the steps a day or two before the first presentation, but you only need to complete the steps once.After you complete the Post-Install Steps, you will only need to complete the following Pre-demo Setup Steps before each presentation.

4

https://demos.microsoft.com/

http://demos.microsoft.com/


Office 365 Advanced eDiscovery Pre-demo Setup StepsThe following steps are required prior to each presentation of the demo:

1. Open Export_list_001.xlsx in Excela. Navigate to the Export_list_001.xlsx file you downloaded to the desktop and open it locally in the

Excel client.b. Minimize Excel.

2. Open eDiscoverya. On the demo computer, open a browser session and log into the demo tenant as MeganB (see above

for credentials). b. Click App Launcher, right-click Security & Compliance, and then click Open in new tab.

NOTE: If at any time, you see a don’t lose your account warning, click cancel.c. In the left navigation, click Search & investigation and select eDiscovery.d. In the left navigation, close the Search & investigation menu.

The eDiscovery page with the Enron case listed is the demo starting location.3. Open the Advanced eDiscovery Relevance training demo environment

a. In the same browser session, open a new tab and navigate to https://<Tenant>.sharepoint.com/sites/AdvancedeDiscovery

5


4. Set demo starting locationa. On the browser, click the eDiscovery – Security & Compliance browser tab.

The eDiscovery – Security & Compliance page with the Enron case listed, should look like this screenshot and is the demo starting location.

6


Office 365 Advanced eDiscovery Demo StepsCompanies and public sector organizations today generate massive amounts of data, documents, and emails. This volume can pose a huge problem when an organization becomes the target of litigation. To meet business, legal, and regulatory requirements, you must be able to keep and protect important information and quickly find what’s relevant. Hiring attorneys to spend days, if not weeks, manually sifting through millions of files to find the small number that are relevant to a legal action isn’t just expensive, it isn’t an option. eDiscovery capabilities in Microsoft Office 365 satisfy compliance requests in a timely and cost-effective manner.

Security & Compliance Center

Speaker Script Click StepsWhen an organization needs to respond to a legal or regulatory information request, the search and analytics tools in Office 365 eDiscovery can cut costs and streamline responses. In this demo, we’ll show how an attorney or legal department can run eDiscovery searches to find and filter relevant content associated with a case. The process starts in the Office 365 Security & Compliance Center, where we have already set up a new case named “Enron”.We’re going to use a scenario based on a publicly available data set for this demo—email archives from the Enron case. Let’s start with a simple question that might come up in a court case: Was Enron involved in lobbying activity in California?Create a new searchWe’ll start by opening the case and creating a new search of the archive. Office 365 indexes most Exchange Online, SharePoint Online, and OneDrive for Business content. This

1. Show the eDiscovery – Security & Compliance page.

2. On the eDiscovery page, click Enron and in the top navigation, click the Pencil icon to edit the case.

3. In the left navigation, click Searches.4. Click the plus sign (+) to create a new search.5. In the New Search window, in the Name textbox,

type California Lobbying.

7


Speaker Script Click Stepsincludes Office files, searchable PDF files, lists, communications, social discussions, and many other file types. Thus, eDiscovery search finds text and metadata in content across all our Office 365 assets.We’re going to add a specific user’s mailbox—Irvin Sayers—to this search.

We could sift through his entire mailbox, but we’re going to use a keyword search and metadata filters to reduce search scope in the Enron case.Office 365 eDiscovery search supports typical legal queries. We can construct queries using Boolean and proximity operators to filter content by any combination of keywords, date ranges, authors, recipients, domains, file types, etc. We can apply a query to all the content in a case, or narrow the scope of the query to a subset of source locations.Our search has identified more than 4,000 items containing any results that match the California Lobbying search.

6. Click the plus sign (+) to add a mailbox.7. When the search window opens, in the top text field,

type Irvin, and then press Enter.8. When Irvin Sayers displays in the search results,

click add, and then click OK.9. Click Next.10. In the What do you want us to look for field,

type California OR lobby*.11. Click Add condition.12. Under Conditions, click the drop down to show

filter options.13. To the right of the drop down, click Delete to

remove the condition.14. Click Search.

NOTE: Search will begin and eventually the New dialog will close. The Searches dialog should still be open.

15. If not already selected, click the California Lobbying search.

16. On the right, point to search results.

Preview search resultsBecause preparing the search results for preview will take a few minutes, I’ve already created a search associated to the Enron case that we can view now.After we run the search, the number of content source locations and an estimated number of search results appear in the details pane. To determine whether the search is appropriate or requires refinement, we can preview up to 200 of the

17. If not already selected, click the California search.

18. On the right, point to items, mailboxes, sites, and public folders.

8


Speaker Script Click Stepsmost recent results per source location, and up to 1,000 items per query.Even though results contain our keyword, some of the underlying content may not apply to our specific needs. We’ll be sifting this data later.After completing our search, we can export a summary report—or the complete results—to a local computer.

**Transition to Advanced eDiscovery**Because our organization has an Office 365 E5 subscription, we can apply Advanced eDiscovery analytics that further refine and organize the content before we export it. Depending on the data set, preparing this data for eDiscovery can take anywhere from a few minutes to hours, so for this demo, we’ve prepared a data set ahead of time.Let’s look at that now.

19. Click Preview search results.20. When search results display, click on a few

emails to show the content.

21. Close the Preview Search Results window. 22. In the Search dialog window, top navigation,

click Export ( ) and point to Export the results and Export report.

23. Click outside the Export drop down to close.24. Point to, but do not click, the Prepare results

for Analysis or if you’ve prepared results before, point to Prepare results again.

25. Close the Search dialog.

26. On the eDiscovery page, in the introductory text, click Go to Advanced eDiscovery.

Advanced eDiscovery

Speaker Script Click StepsMinimize and organize data quicklyAdvanced eDiscovery goes beyond search, using machine learning to intelligently analyze the content, organize it, and reduce it before it goes to review. It intelligently simplifies sorting through large quantities of content to quickly find what’s relevant. It saves review time and costs—and gets us better results

9


Speaker Script Click Stepsfaster. With a click of a button we can run Advanced eDiscovery analytics, specifically identifying near-duplicates, email threads, and themes, and then export the results. Express Analysis accelerates the analytics workflow allowing us to quickly minimize and organize our dataset and export to our desired location. We have no other additional configuration or multiple steps to complete—significantly simplifying the process.Express analysis begins the process by adding files to the case. Structure content for more efficient reviewAdvanced eDiscovery organizes content items into groups of unique files, duplicates, and near-duplicates. This lets us structure our review more efficiently, so one person reviews a group of similar documents. It also enhances consistency by having the same reviewer work on different versions of the same content.In an email thread, later messages typically contain all the previous messages in the conversation. Advanced eDiscovery organizes email into hierarchically structured groups of email threads. This helps us identify the messages containing unique content and lets us focus on only the new information in each message. Email threading removes the need to review every message in its entirety in an email thread, eliminating review redundancy, and focusing our attention on the unique data in the thread.Advanced eDiscovery analyzes content to identify and map salient themes. It creates a meaningful label to characterize each theme. Then it charts relationships between themes and documents. Viewing content that

1. In Advanced eDiscovery, click Enron Lobbying and in the lower right, click Go to case.

2. On the Express Analysis Setup page, under Process container, click California.

3. In the lower right, click Express analysis.

4. On the Task status page, click Process.

5. Click Analyze. 6. Point to near-duplicates (ND) entries.

7. Point to email thread (ET) entries.

8. Point to Themes: themes calculation.

9. Click Export and pause on Preparing export package and Creating Excel file.

10


Speaker Script Click Stepsshares a theme can provide valuable insights beyond keyword search statistics.Advanced eDiscovery exports a spreadsheet, Export_List.xlsx, that includes all the content metadata and Advanced eDiscovery analytics information from our results. We will review this in greater detail later in the process.Finally, Advanced eDiscovery creates an Express analysis summary. Because we’ve already run this analysis to completion once before, we can review the summary from the last analysis.

The Express analysis summary page displays graphs showing a summary of the content we’ve processed—for example, documents, emails, and attachments—as well as duplicates and near duplicates.

NOTE: You can allow Express Analysis to continue processing unless you are doing consecutive demos; then you should click Cancel now. Express Analysis processes large amounts of data and it may take time to halt the process after cancelling.

10. In the left navigation, under Results, click Express analysis summary.

11. Under Process, point to the Accumulated chart and the Last session chart.

12. Scroll down and point to the Target population pie chart and the Emails pie chart.

**Transition to Advanced eDiscovery Relevance UI**13. Click the Advanced eDiscovery Relevance

training tab. https://<Tenant>.sharepoint.com/sites/AdvancedeDiscovery/AE/index.aspx#/

Relevance Training

Speaker Script Click StepsAdvanced eDiscovery includes the Relevance application. An attorney who is familiar with the litigation at hand can train Relevance to automatically identify content relevant to the case. These structures optimize the review process, replacing traditional linear review by allowing attorneys to review documents in closely related and tightly structured groups.Using predictive coding to apply relevance

1. In the list of cases, click Enron Lobbying and in the lower right, click Go to case.

2. At the top of the page, click Relevance, and then click Track.

11


Speaker Script Click StepsThe Relevance application uses predictive coding and machine learning to decide what’s relevant to the case and what isn’t. It consistently finds more relevant content, and returns less irrelevant content, than conventional methods such as keyword search. Predictive coding activates when an attorney trains Advanced eDiscovery to find the relevant content. The Training progress bar tracks the amount of training we’ve completed. We’re just starting out, so it’s at zero for now.The first tagging cycle builds a statistical model, which monitors training progress and quantifies results. The system automatically selected these samples using an Active Learning algorithm designed to achieve the best performance with minimal effort.This email deals with energy policy legislation and the Enron Governmental Affairs Committee. This clearly relates to lobbying, so we tag it as relevant—thereby teaching the system to distinguish which emails are of interest to us.This poem is clearly not relevant, so we tag it as such.Training the system includes several rounds (typically between 25 and 40, with each round comprising 40 documents) until the system has a good understanding of what we consider to be relevant or not.We’re going to skip ahead to see what our progress looks like after tagging 5 samples. You can see that we’ve made progress in tagging, but we’re not done yet.This email talks about energy legislation. It looks relevant.

3. In the table, point to light grey Training progress bar.

4. In the lower right, click Training.

5. Point to the displayed email.6. On the left, click the Relevant (R) button.

7. Click the Not Relevant (NR) button.

8. In the lower left, click Calculate.

9. In the Training column, pause on the progress bar.10. In the lower right, click Training.

11. Point to the active email.12. Click the R button.

12


Speaker Script Click Steps

This list of addresses isn’t relevant.Now we’ll jump again to see what happens when we’re done tagging. This whole process requires reviewing on average 2,500-3000 documents. That’s a lot of effort, but much less than going through all the documents in the search results.At this point, our sample is stable. That means the system has learned as much as it can about this collection and is telling the user that additional training would be a waste of expensive resources.

13. Point to the new active email.14. Click the NR button.15. In the lower left, click Calculate.16. In the Training column, pause on the progress

bar.

Choose review-recall ratioOnce training is complete, Advanced eDiscovery takes the accumulated and learned Relevance criteria and applies it to the entire file collection. All files in the pertinent file group are assessed for relevance and assigned a score to help us decide which to submit for review.This is Decision Support, the heart of Advanced eDiscovery. This is where we’re going to decide which documents to select for review and which ones to cull. The graph on the right shows the distribution of documents scored by their relevance to lobbying. The higher the score a document has, the more likely it is to be relevant to the case.The courts and government agencies expect companies to discover and produce documents in a “proportional and reasonable manner” – perfection is not the standard. With this guidance, we can use the machine learning results to help determine the appropriate level of review of these documents.

17. In the lower right, click Batch calculation.NOTE: This will take a few seconds.

18. At the top of the page, click Decide.19. Point to the graph on the right.

13


Speaker Script Click StepsThe graph at left shows how many relevant documents we’re likely to find based on how many of the search results we review. We can see that a review of 20% of the data will result in a recall level of nearly 85% of the relevant documents. This may be a great result for this case, but let’s examine a few other options. Here we see that if we review the most relevant 28% of documents, we’ll get 90% of the relevant information at a cost of about $190,000, or in other words, an increase of about $55,000 to find an additional 5% of the relevant documents.We can review even more documents to get a higher recall rate. At 49% reviewed, we get another 7% of relevant results, but our costs jump by almost $200,000 to a total of $385,000. Based on what is at stake in this case, the attorneys can now make the appropriate business decision as to whether the additional expense is justified. At the bottom end, our costs are much lower. Reviewing 11% of the data at a cost of $75,000, we’ll discover only 53% of the relevant documents, much less information. Again, depending on the situation, this may very well be enough to satisfy the discovery requirements.

20. Point to the graph on the left.

21. Under the Review-recall ratio chart, drag the slider from 0 to 20.




Analyzing results quickly Whether it’s for early case assessment, responding to a subpoena, or conducting a quick review of several custodians’ relevant files for an internal investigation, we may want to forego the effort and expense of loading search results into a full-fledged review tool. Instead, the Export_List.xlsx spreadsheet that’s exported from Advanced eDiscovery allows us to parse through exported Office 365 content on the local

25. Maximize the Excel client with the Export_list_001.xlsx file displayed.

14


Speaker Script Click Stepscomputer. By using email threading and eliminating duplicates, we’re able to export just the unique, inclusive items to give the reviewer the ability to see the full picture in the fewest files possible.The spreadsheet lists each item in a table that’s convenient to sort and filter.

The exported file includes all the metadata associated with the documents—such as the date sent, email participants, and other email/file-related information—as well as all the Advanced eDiscovery analytics information, including email threading, near-duplicates and the key themes in the document.Each item has an embedded hyperlink so the reviewer can open and review the downloaded copies with a single click to quickly determine relevance. They can make annotations and comments on the items directly in the spreadsheet without compromising native file metadata because the original values were already logged. Reviewers can also add columns to track responsiveness, privilege, sensitivity, and so forth, so that when they’re finished, they can easily filter the list to show the subset of items that they may ultimately wish to share or produce.

26. On the Excel spreadsheet, on the For Review filter table, click 1.

27. On the Email sender domain table, click enron.com.

28. Point to columns: Email date sent (column U), Email participants (column V), and Email Sender (column X).

29. Point to columns: Email Thread (Column S), Duplicate subset (column M), Dominant theme (Column O) and Themes list (Column P).

30. In the File ID column, click a hyperlink to open a message.

31. Close the message.

ConclusionAdvanced eDiscovery in Office 365 enables organizations to make intelligent decisions, enabling them to provide an appropriate response to investigations or litigation quickly, accurately, and cost-effectively.

15


Office 365 Advanced eDiscovery Reset StepsComplete the following reset steps after presentation.

1. Close the Export_list_001.xlsx file without saving changes.2. Delete the California Lobbying search.

Office 365 Advanced eDiscovery Post-Install StepsComplete the following post-install steps once for your demo environment:NOTE: Data analysis, content indexing, and preparing the results for analysis take time to complete. You should complete the steps a day or two before the first presentation, but you only need to complete the steps once.

1. Place demo assets on the demo machineThe Export_batch_04_20170120_060343.zip file contains the Export_list_001.xlsx file and all supporting content needed to present the Analyzing results quickly portion of the demo.

a. Start a new browser session and log into https://demos.microsoft.com with your Microsoft Account.b. Navigate to your Advanced eDiscovery demo card. c. Click the icon for the asset file Export_batch_04_20170120_060343.zip.d. Download the file to your local computer and extract the files to a folder on the demo computer.

NOTE: The zip file is large and will take time to download and extract. 2. Activate permissions for Advanced eDiscovery

a. Open a new Microsoft Edge browser session and log into the demo tenant (http://<Tenant>.sharepoint.com/) as MeganB.

b. Click App Launcher and select Security & Compliance.c. In the left navigation, click Permissions.d. Add MeganB as eDiscovery admin:

Double-click eDiscovery Manager. In the eDiscovery Manager dialog, scroll down to eDiscovery Administrator.

16


Click the plus sign (+). In the member list, scroll down until you find Megan Bowen and click to highlight her name. Click Add->. Click OK and then click Save.

3. Set up Enron Casea. Open a new Microsoft Edge browser session and log into the demo tenant

(http://<Tenant>.sharepoint.com/) as MeganB.b. Click App Launcher and select Security & Compliance.c. In the left navigation, click Search & investigation, and then click eDiscovery.d. In eDiscovery, click the + icon to create a new case.e. In the Case Name text box, type Enron.f. Below Who should have access, click the + sign, select Megan Bowen, click add, and then click

OK.g. Click Finish.

4. Set up California Search a. In eDiscovery, click the Enron case, and then click the Pencil icon to edit the case.b. In the left navigation, click Searches.c. Click the plus sign (+) to create a new search. d. In the New Search window, in the Name textbox, type California. e. Below Choose specific mailboxes to search, click the plus sign (+) to add a mailbox. f. When the search window opens, in the top text field, type Irvin, and then press Enter. g. When Irvin Sayers appears in the search results, click add, and then click OK.h. Click Next. i. Click Search.

NOTE: Wait for search to complete before clicking Prepare results for analysis. Completing the search can take up to 5 minutes.If you click the Prepare results for analysis link, or the Prepare button within the Preview search results screen, and the resulting dialog box displays Showing 0 out of 0 results, you receive an error, or a dialog box opens displaying the Advanced eDiscovery user interface, the results are not ready.

17


j. On the Searches dialog, on the right, click Prepare results for analysis.NOTE: Preparing the results for analysis can also take up to 5 minutes.

k. Leave all default values and click Prepare.5. Set up Enron Lobbying case in Advanced eDiscovery

NOTE: These steps require running an Express Analysis, which can take up to 1 hour to complete.a. Close the Search dialog. b. On the eDiscovery page, in the introductory text, click Go to Advanced eDiscovery. c. In upper right of the Advanced eDiscovery Cases page, click + to add a case.d. In the Name text box, type Enron Lobbying, replacing any existing text, and then click OK.e. In the lower right, click Go to case. f. In the top navigation, click Express analysis.g. In the lower right, click Advanced settings.h. Under Themes, change Max number of themes to 5, and then click OK.

NOTE: Confirm the pre-processing bar is at 100% before continuing with the next step.i. In the Process container table, click California and in the lower right, click Express analysis.

NOTE: You may encounter UI distortions in Express Analysis results in some browsers at lower resolutions.

18

prerequisites - microsoftmoddemodocs.blob.core.windows.net/resources-prod/… · web viewopen...

Documents