Microsoft Purview eDiscovery and OneNote

Reading time: Approx. 5 minutes

Last week, I really enjoyed doing a session on Microsoft Teams and eDiscovery with Microsoft Purview. The session was for the Microsoft 365 Security and Compliance User Group. One thing I really like about these kinds of sessions is the ability to learn yourself.

This is because of the questions and insights being shared during the session. And one of these questions was about using OneNote.

Can OneNote content be discovered as-well?

---

This is a very simple question, but let’s take a look at the complexity of the answer. First of all, a OneNote notebook is comprised of sections and pages. The information stored on a page can be simple text, images, links to documents, and even dynamic links to Outlook agenda items. So this can, in itself, be very complex.

But when we go to Microsoft Learn for more information, we can see that eDiscovery is supported for OneNote information. Though you might notice already that you will not be able to view or annotate the content.

---

So, let’s take a look. To test this out, I’ve used the notebook that’s part of my Microsoft Teams environment. I’ve added two pages. One page only contains some text. While the other (see below) contains an embedded document, text, an image, and some scribbles.

Using both eDiscovery (Standard) and eDiscovery (Premium), I’ve created search conditions/collections based on the content in the notebook (specific text) and on the .One filetype.

---

eDiscovery (Standard)

The standard version for eDiscovery can retrieve information that’s stored inside the notebook. And, as is stated in the documentation, you will not be able to preview the content. When you download a copy, the specific .One file is downloaded and can be opened by the OneNote client.

---

eDiscovery (Premium)

Using eDiscovery (premium) we should be able to see more information. For one, the GUI of this premium version allows for more detail. But first, let’s look at the search preview provided when creating a new collection.

As you can see, this is nearly identical to the eDiscovery (standard) edition. Although you do see that it is (indeed) a OneNote notebook 😉

So let’s go to the review set. As this notebook contained more than one page, I was expecting (against all odds) that this would also be displayed. But it is not. The OneNote notebook itself is displayed, but cannot be previewed.

The Word document is there as well, but cannot be opened. Nor can any information be retrieved from this embedded document.

---

All other (embedded) components of the OneNote like images are displayed as some form of document. These cannot be opened.

---

---

But what about the text in the OneNote notebook? Well, there is some silver lining here. Although the notebook itself cannot be previewed, the text(s) in the notebook can be retrieved. When opening the Notebook in preview mode and using the Plain text option, we will see all text. Including some (date/time) metadata.

The example below shows both pages which are part of my notebook.

---

Exporting

What about exporting the information? This works okay, for both eDiscovery options. You can either go for the option Selected documents or All documents.

Both alternatives only exported the .One file. All other embedded information was stored as loose files. Either named “embedded-1_1”, etcetera. Or by using some form of GUID.

Fun fact: when using the eDiscovery metadata, you can relate these embedded files back to the content in OneNote. For example the Word document:

---

One last thing

Be sure that you know how sections in OneNote translate to content in Office 365. In short: every section will turn into a separate .One file. And weirdly enough – one of these files could not be processed by eDiscovery. I’m still looking at this.

All in all

So, what are we left with?
Can OneNote content be discovered: yes – but only the text in the sections and pages (also when this is as a To-Do list). As described in the documentation by Microsoft: there is no preview of the content. Also, there is no indication of where the information is to be found in the OneNote itself.

Information added as documents, images or other information is not discovered. Unless it is converted to text within OneNote. For example: meeting information coming from Outlook. But the functionality is relatively basic, to be honest.