Quentin Christensen is a Microsoft Program Manager for Archiving, eDiscovery, and Devices. In SharePoint 2010 and 2013 he worked on key records management features such as In-Place Records, retention policies, site policies, content organizer, CMIS, and the Records Center.
Included among Quentin’s very long list of responsibilities is overseeing eDiscovery and compliance in Office 365 and on premises Office server products including Exchange, Lync, and SharePoint.
Quentin was kind enough to chat with us recently and provide us with some of his thoughts and observations on information lifecycle management in Office 365 and SharePoint 2010 and 2013.
SPRM: Thanks for agreeing to talk with us today, Quentin.
Quentin: It’s my pleasure Don. What could be more fun than travelling to the Bahamas to answer some questions about records management? Although I was expecting the trees, sand, and water to be a little more… you know real.
SPRM: [Laughs] Sorry to disappoint, but sadly, we only work on a virtual beach here at SPRM.
So tell us a little about your role at Microsoft.
Quentin: I like to call myself the Emperor of eDiscovery and Ruler of Records Management. But the truth is even more grandiose than that. I work with a team of program managers and developers to build eDiscovery and compliance capabilities in Office 365, Exchange, SharePoint, Lync, and Yammer. I am still fighting with HR to change my job title to Emperor, but until then I am a Program Manager Lead.
I love talking to people about the challenges they face, imagining solutions that will solve their problems, and then working with a team to build it. I spend my time talking to customers, running research studies, designing user experiences and architecture, working with developers, attending lots of meetings, and sending lots of email. How much better does it get than that?
SPRM: That must be pretty satisfying work, Quentin.
We believe this is a critical time for Records and Information Management. Constant change is occurring across the industry. And given the widespread growth in cloud environments, this will likely continue for some time. How do you suggest records managers leverage SharePoint 2010 and/or 2013 to best navigate their organizations through all this change?
Quentin: Imagine how records management can be rather than how it used to be or how physical records are managed. If you are changing your records management solution, now is the time to revolutionize the way you do things. I hear about three common problems from people. 1. What about all the content users are creating in OneDrive and team sites? 2. Can I manage electronic records in SharePoint and if so how? 3. How do I bring my electronic and physical records together?
I suggest focusing on solving one problem at a time and I think #2 is the easiest. You can manage records in SharePoint. Microsoft has terabytes of electronic records in SharePoint and this is out of box. Forget about trying to train every user in your organization to manage records and retention schedules. You just can’t scale that way. Focus on structured content that a set of well-known people work with such as employment records and contracts. Provide a solution where the data is created in the Records Center or a way for it to go there for long term storage and disposition. Once you have that figured out, move on to #1 or #3.
At SharePoint Conference in March we announced 1TB site collections and unlimited size tenants in Office 365. Now you can use the full set of records management capabilities in Office 365 including search, content organizer, send to, and Records Centers. This enables you to create a records management solution that you can send content to, automate where it gets stored, apply a retention policy, and use search so people can quickly find records in the system.
With Office 365 we manage the servers and scale so you can add content on your own terms. I have seen some painfully slow and cumbersome records management systems. With Office 365 and using search to access records, you can find content in less than a second, and Microsoft has had 99.98+ uptime for the past few quarters so your records are always available.
The most successful records management solutions I have seen all focus on simplification and automation. KISS really applies here: Keep It Simple, Stupid. This will make it faster to get up and running so you are providing value, plus it will be easier to manage over the long term. Use simplified retention schedules and a small amount of content types with as little required metadata as possible. Reduce friction getting content into the system and rely on search to find it again. Make it as easy as possible for people to get content in and you will have a far more successful solution.
SPRM: Can you give us an example?
Quentin: I think Microsoft is a great example, back in 2009 our Records Management team looked at using various systems for their next gen Records Management system and they chose SharePoint. We had 3,000 plus retention categories, which would have meant 3,000 content types. What a pain to manage. We simplified and arrived at 65 content types. This drastically reduced management overhead and the decisions people had to make when adding content. We entirely use SharePoint out of box and rather than relying on complex disposition approval for hundreds of millions of items (can you imagine our team of 3 records managers doing that?) we just use automatic retention. On a quarterly basis we do a review and ensure the right things are happening with the broad policies. Search ties it all together so anyone can search for and find important records when they need them.
SPRM: So does this solution provide the accountability your Records Managers are looking for?
Quentin: Am I sipping a pina colada and taking a long walk on the beach right now? Of course it does. It’s their job is to ensure content is available when needed to meet compliance requirements and company needs. It’s their butt on the line! That is why my team and I take our jobs so seriously. I love it when people thank me and say I have helped them sleep easier at night. By simplifying to a small number of content types and policies, it will be easier to manage and tell people what the policy is. Then you can ensure items have the right policy and are kept and destroyed on schedule. With the built in SharePoint end user and eDiscovery search capabilities it is easy to find what you are looking for and the legal team can get data out that they need for investigations and litigation.
SPRM: Makes sense. So what records management strategies seem to be the most successful and how are they typically implemented?
Quentin: The most common strategy is multiple Records Centers where people send content there. SharePoint splits content across site collections and you want to keep your site collections between 100GB-1TB to have high availability. Surpassing 100GB is quite easy for a records management solution, so everyone I talk to is managing content with multiple Records Centers and using search to easily find what they are looking for. Fortunately, SharePoint has out of box functionality including search, taxonomy, content organizer, and content type syndication that makes it easy to distribute and manage this data across multiple site collections.
SPRM: How are they applying Information Management Policies?
Quentin: Most of the customers I talk to are the biggest and most complex, we are talking about hundreds of terabytes or even more than a petabyte of records so this may not be representative of what everyone is doing, but I have seen three common methods. The easiest is to use content type based policies. You define your content types separately, and the content type drives auditing and when the item should be deleted. The second method is folders, this makes more sense when you have complex retention requirements. When items are submitted or uploaded, metadata determines what folder the item should go into. Then folders will determine the policy and when the item should be deleted. This is used when you have a large number of retention policies and want to manage content with structured folders. The third and most complex is to use custom metadata on every single item along with retention formulas or custom code. For example all items have a required managed metadata field. The custom code checks what that metadata is, calculates the retention schedule, and then sets a date for when the item should be expired. I have only seen two customers follow this path and I would recommend the first two options.
SPRM: What are the most effective declaration strategies you are seeing?
Quentin: The Declaration of Independence was pretty effective in its day. You can use the declaration of independence strategy with your own records. Let people do what they want, yeah it sounds crazy but you just can’t make everyone do it the records managers way. Maybe I am going insane from spending too much time as a UX designer. I believe making things super simple, fast, and easy for the average guy is paramount to user adoption. To make the declaration of independence succeed, you need two options: automatic and manual declaration. Then people can be independent. The people who know what they are doing can choose to use the structured process of declaring a record or setting metadata that sends an item that is ready to be a record off to the records center. For all that other content created by people who don’t know or need to know about records, make it automatic with broad deletion policies.
SPRM: ‘The Records Declaration of Independence’, I like that… Does it require custom code?
Quentin: I have seen several records management deployments including Microsoft that are all out of box and doing this, so no it does not require custom code. If you absolutely need complex lifecycles such as events that occur at some period of time later or you are integrating physical records or scanning paper content into SharePoint you will need some custom code. There are also some great partners out there that you should first take a look at before building the missing piece of the puzzle yourself.
A great reason to avoid custom code is that you want to keep it simple for your users, don’t place the burden on them with 30 metadata fields and a complex lifecycle management process that bugs them with workflows to review everything stuff. Look for opportunities where you can make everything automatic or remove steps.
SPRM: As everyone knows, eDiscovery costs are continuing to skyrocket, so having an efficient eDiscovery process is more important than ever. Tell us a little about how Microsoft is using the newest eDiscovery features in SharePoint 2013 and Office 365 to manage discovery orders.
Quentin: If I can do a shameless plug here, I have posted some articles that give an overview of eDiscovery that you should check out. Microsoft is using the new 2013 eDiscovery features in SharePoint, Exchange, and Lync for all cases and internal investigations. There are two common situations we have. First is the civil litigation case. We use the SharePoint eDiscovery Center to preserve content with In-Place Hold for between 10-40 people, this makes the data immutable but allows users to edit and delete their content without ever knowing it is on hold. Then we use search to reduce the data set by 80% or even up to 95%. Once that is complete we export the data. For many cases we use an additional 3rd party search tool to do additional search and analysis, then we hand it off to our litigation support vendor that hosts our review tool and manages the process of legal review. Before we started using the eDiscovery Center in 2013, we had already done a great job streamlining our eDiscovery process. Now that we use the eDiscovery Center, it saves our eDiscovery team a lot of time – it went from 4 weeks to 2 weeks to do initial preservation, so we are better protected and saving a lot of time for the people that manage the eDiscovery process. The second situation is internal investigations. Once again we use the eDiscovery Center to do search and preview to hone the keywords and then use export to get the data out of the system and store it in PSTs and loose files so we can analyze it further and keep it as evidence.
SPRM: But eDiscovery costs are only part of the litigation problems organizations face. You can’t pick up a newspaper – assuming anyone actually reads newspapers anymore – without seeing charges of spoliation and the penalties and fines that go with it. How are your customers managing their information in ways that prevent claims of spoliation?
Quentin: Well I am no lawyer, I just play one on TV. But this is what really keeps the lawyers up at night. There are three things you want to keep in mind here. With SharePoint and Exchange 2013 you can do In-Place hold, with search queries you can render content immutable even if new content appears. If it matches the query, it will be preserved. This is all done behind the scenes, users can create, edit, and delete content and never even know it’s preserved. The second thing is keeping your house in order with great records management practices. If you have an organized and documented SharePoint deployment with structured records and metadata, it will be easier for the legal team to find what they are looking for when they need it and ensure it is preserved to prevent spoliation. The third is defensible disposition. If you follow a proper policy, then you can clean up that old data so you have less data around that can be discovered. Then you can add the hold features in SharePoint to stop the deletion process when a legal event occurs.
But let me warn you, if you tell your eDiscovery team about these new capabilities, they will keep bugging everyone until you get upgraded to SharePoint 2013 so they can use the new eDiscovery Center. I have seen it before.
SPRM: So are they doing this in SharePoint? And your customers are doing this now?
Quentin: Did you even need to ask? I talk to customers every single day that are using In-Place Hold as well as retention. We have thousands of customers in Office 365 initiating preservation and performing eDiscovery searches every month.
And we are making things even better. At SharePoint Conference we announced Document Deletion policies that let you apply broad document deletion policies to site collections and site templates. For example, you could set a policy to delete all documents 4 years after they are created in OneDrive for Business sites. This will be coming to Office 365 soon. The great thing is you can do both hold and deletion on SharePoint, Exchange, and Lync content on premises as well as in Office 365. Note that with Exchange 2013, you can archive Lync IM and a meeting data into the user’s Exchange mailbox where you can then perform eDiscovery.
SPRM: Wow, that’s a cool feature. Are these solutions the same in the cloud using Office 365 as they are in on premises using SharePoint 2010 or 2013?
Quentin: The eDiscovery improvement between 2010 and 2013 is a big leap forward, I actually did a comparison of Records Management features between versions that you may find interesting. With Office 365 we deliver new features to customers earlier so soon you will be able to perform eDiscovery search across all SharePoint sites and do broad document deletion policies. In general we will have consistency between on premises and Office 365 so the new Office 365 capabilities will ship in the next major on premises release in 2015.
SPRM: Terrific. Many organizations have laws and regulations that they must apply to the records they manage based on the country, state or region in which the record is stored. Given that it is often impossible to tell where your information is physically stored in a cloud-based solution, how are your customers resolving that problem?
Quentin: Office 365 stores your data within certain regions, for example if you are in Europe you will use our European datacenter. The trans-border flow of data outside of Europe is a big issue, so this actually meets the needs of many customers. To learn more see Privacy authorities across Europe approve Office 365 privacy commitments.
We are also seeing hybrid deployments where customers have records centers both on premises and in Office 365. You can use hybrid search to search both at the same time to have the best of both worlds.
SPRM: Well, we still have a lot we’d like to ask you, Quentin, but I think we’ve used up enough of your time. Will you come back sometime for a follow-up?
Quentin: Only if we can have the interview somewhere more tropical like Hawaii.
SPRM: Ha! I’ll see if that’s in the budget. In the meantime, how can our readers keep up with the latest developments in SharePoint and Office 365 records and information management?
Quentin: For new product announcements you can see the Office product blog. I have also been sharing my own thoughts on eDiscovery and Compliance on my own blog so you can check that out as well.
Also I am doing an AIIM Q&A webinar July 23rd called Take the FUD out of Implementing SharePoint – Just Ask the Folks at Microsoft. It isn’t every day you get to do a Q&A with an emperor so I suggest you attend.
SPRM: We’ll do that. Thanks, again, Quentin.
Quentin: You’re welcome.