Microsoft 365 Modern Attachments Pose Significant eDiscovery Challenges and Risk

By John Patzakis
March 13, 2024

Modern AttachmentsIn their excellent publication, 2023 eDiscovery Case Law in Review, Winston and Strawn, LLP, one of the top law firms in the US, highlights the challenges legal and eDiscovery professionals face with modern attachments. Modern attachments, also known as hyperlinks, are URL pointers that link to files or emails stored in another location. They are commonly found in Microsoft 365 mail and Teams.

Winston and Strawn reports that “[r]equesting parties are increasingly sophisticated about this issue given the proliferation of Microsoft 365…and thus we have noted an uptick in requesting parties demanding that linked attachments be produced along with transmittal emails—in essence demanding that traditional email families be assembled from these pieces.” In re StubHub Refund Litig., 2023 WL 3092972 (N.D. Cal. April 25, 2023) is a case cited by the authors as a recent decision requiring the production of modern attachments in discovery.

The one area I disagree with in the report is its view that without investing in expensive services and Microsoft Premium licensing it may be very challenging and burdensome to identify and collect modern attachments. If you rely on Microsoft Purview for eDiscovery compliance and information governance, you must upgrade to expensive premium licensing that can add up to tens of millions of dollars in additional expense for larger enterprises. And even then, there are significant throughput and defensibility challenges.

eDiscovery service providers have stepped into the mix to provide manual services to address MS 365 challenges. But throwing services at the problem is disruptive, inefficient, and expensive as well.

X1 provides a different approach. X1 Enterprise Collect provides full support for modern attachments in MS Mail and in Teams. X1 is the only solution we and our partners are aware of that supports the search and collection of modern attachments in MS 365 without the need for a Premium (E5) license or additional manual services. This is because X1 Enterprise Collect does not operate by simply making bulk calls to the MS Graph API, like most eDiscovery tools, which also require a premium license to collect the key data such as modern attachments. X1 employs a targeted, custodian-based approach that minimizes 365 API calls, and does not rely on the MS Search Index, which has been demonstrated to be untrustworthy and with limited throughput. X1’s approach enables a very scalable, defensible, and robust data collection at speeds 10x that of other approaches.

The X1 Enterprise Collect Platform is available now from X1 and its global channel network in the cloud and on-premise. For a demonstration of the X1 Enterprise Collect Platform, contact us at For more details on this innovative solution, please visit