Preserve Microsoft 365 activity before it expires

Microsoft 365 records how people interacted with files, repositories, and collaboration platforms. Standard audit records are generally retained for 180 days, and matters routinely concern conduct from well before that window.

Explore CaseFusion Talk to an eDiscovery expert

Audit activity expires before most matters arise

Identification begins with what the legal team already knows. Available Microsoft 365 audit activity can show which repositories people used, accessed, or shared from, but that context is often disconnected from the identification process.

Custodian memory

A custodian cannot recall every SharePoint site used several years earlier.

Static data maps

A static data map identifies who owns a repository without showing who worked in it.

Permissions

Permissions establish that hundreds of employees could reach a site without distinguishing the handful who did.

Org charts

A current org chart does not reflect the team structure in place during the relevant period.

Retain the history, index what informs decisions

Preservation is time-sensitive in a way later stages are not. Analysis and review can wait, but information that expires before a complaint arrives may be unavailable when the matter begins.

Explore CaseFusion

Retain the history

CaseFusion retrieves available Microsoft 365 audit records on an ongoing basis and retains them for the period the organization sets. Because those records are available only for a limited time, preservation cannot wait.

ONGOING Available audit records retrieved continuously

RETENTION A period the organization sets

DEADLINE Expired records cannot be recovered

Index what informs decisions

Not every audit record helps a legal team scope a matter. CaseFusion indexes the event types that inform discovery decisions and leaves aside duplicative records, indistinct interactions, and unattributable events.

DUPLICATES Duplicative records left aside

INDISTINCT EVENTS Records that cannot tell one interaction from another

UNATTRIBUTED ACTIVITY Shared and service account events

Connect activity to the matter

Identification runs on attribution: which person interacted with which repository, during which period, holding which role. What remains is searchable under live matter pressure and joined to the rest of the matter.

PEOPLE Custodians and potential custodians

ROLES The roles people held when events occurred

SCOPE Repositories, documents, and communications already in scope

From enterprise data maps…

Enterprise data maps are usually built for governance, identifying applications, owners, data types, retention policies, locations, and platforms. That is useful information, and it answers almost none of the questions a specific matter raises.

Sites | Which SharePoint sites did this custodian use during the relevant period?
Repositories | Which repositories were active for the project at issue?
Sharing | Who shared files with the custodian population?
Attachments | Which OneDrive accounts supplied the cloud attachments?
Collaborators | Which people worked in the same repository?
Investigation | Which sources should be investigated before preservation scope is finalized?

…to a matter data map

CaseFusion combines indexed Microsoft 365 activity with other available information to build a dynamic data map for the matter. It shows the people, repositories, relationships, data sources, and activity that may be relevant.

People | Custodians and potential custodians, with the roles and relationships they held at the time
Locations | OneDrive accounts, SharePoint sites, Teams locations, and Microsoft 365 groups
Files | Files and file owners
Activity | Sharing and access activity across relevant periods
Attachments | Cloud attachments and the communications that referenced them
Decisions | The decisions the legal team made along the way

What activity can and cannot establish

Audit activity can provide valuable evidence to inform discovery scope, but it must be interpreted within its limitations. Understanding what the records capture, what they may omit, and how long they remain available helps support informed scoping decisions and creates a clearer basis for explaining those decisions later.

What happened and when

Activity can establish that a recorded interaction with a file or repository occurred, and when.

It cannot establish that the interaction has anything to do with the matter, because relevance is a legal judgment.

Who shared and who received access

Activity can establish that a person shared content and who received access.

It cannot establish what a person read, how much of it, how long they spent, what they understood, or whether they relied on it.

Other people and other sources

Activity can show that others used the same files or repositories, or that a source sits outside the initial scope.

It cannot establish that they belong in the matter, or that no recorded activity means nothing happened.

Investigate scope, don't expand it

Activity-driven identification should inform scope, not expand it automatically. Treating every recorded event as a reason to add a person or source simply replaces one form of over-collection with another.

Interviews Test what custodians remember

Use available activity to focus the interview, compare responses with the record, and investigate gaps.

People Investigate people outside the list

Surface people who interacted with the same repositories or files as those already in scope, then validate whether they should be added.

Preservation Preserve while you
assess

Apply in-place preservation when a surfaced source must be protected while the legal team determines whether it belongs in scope.

Versions Preserve linked files and versions

Resolve links in messages and preserve the available file versions associated with recorded sharing or recipient-access events.

Collection Decide what enters
collection

Use activity from the relevant period to determine whether a source should be added to collection scope.

Exclusion Document what stays out of collection

Leave a preserved source out of collection when the available information supports that decision, and record the rationale in the matter.

Maintain the information supporting the decision

An activity-informed scope decision is only as explainable as the record behind it. A decision recorded at the time, with the activity that informed it, is a position the legal team can explain.

Activity | The activity that was reviewed
Surfaced | The sources and people it surfaced
Decisions | What the legal team decided about each, when, and on what basis
Set aside | The sources considered and set aside, which a requesting party is most likely to ask about

maintain-the-information-supporting-the-decision

Works alongside Microsoft Purview Audit

Microsoft 365 generates the underlying activity record, while Microsoft Purview Audit and Microsoft Purview eDiscovery provide native audit and discovery capabilities. CaseFusion builds on that foundation, connecting identity, activity, repositories, content, and matter decisions across the workflow.

What Microsoft Purview handles

Captures user and administrative activity across Microsoft 365
Supports searching and exporting recorded activity
Manages case sources around users, groups, mailboxes, OneDrive, and SharePoint
Explores relationships across managers, direct reports, collaborators, and groups

What CaseFusion adds

Retains activity past standard audit retention
Indexes and normalizes records for use under live matter pressure
Joins activity to the roles people held when events occurred
Connects activity to repositories, documents, and recorded decisions

Explore CaseFusion

Audit log preservation & data mapping FAQs

How long does Microsoft retain Microsoft 365 audit logs?

Microsoft generally retains standard audit records for 180 days. Longer periods depend on licensing, record type, and configured retention policies. Because matters frequently concern conduct from well before that window, activity that would have informed identification is often no longer available by the time it is needed.

Why preserve audit logs if Microsoft already provides Purview Audit?

Purview Audit captures and makes the activity searchable within Microsoft's retention terms. Preserving it extends how long the history remains available, and indexing it makes the records usable inside a matter workflow rather than as an export to be parsed.

Why are audit logs useful for eDiscovery identification?

They answer a question ownership and permissions cannot: which repositories a person actually worked in, when, and alongside whom. That establishes which sources deserve investigation before preservation scope is set.

Does activity establish that a source is relevant?

No. An audit event reports an interaction. Whether the interaction bears on the matter is a legal judgment made against the facts, issues, and proportionality. Activity improves the question rather than answering it.

Does a file-access event establish that a user read the file?

No. A recorded access event does not establish what portion of a file a person viewed, how long they spent, what they understood, or whether they relied on it.

Is the CaseFusion data map a complete map of the enterprise?

No, and it is not intended to be. It is a matter-relevant map built from available identity, repository, interview, document, and Microsoft 365 activity information, covering the people, sources, and content that may bear on the matter at hand.

Does an absence of recorded activity mean nothing happened?

No. Whether an event would have been recorded depends on the workload, the event type, how auditing was configured, and the retention period in effect at the time. Before drawing a conclusion from silence, the legal team needs to know what the record covered.

Does CaseFusion replace Microsoft Purview Audit?

No. Microsoft produces the underlying activity record. CaseFusion retains it past standard retention, indexes and normalizes it, and connects it to the matter alongside historical identity, repositories, and documents.

Give every matter a better starting point

See how CaseFusion preserves, indexes, and connects that history so legal teams can scope matters with better information rather than more data.

Explore CaseFusion Request a technical discussion