A threatened restraining order, employee departure, transaction dispute, or suspected data transfer can create an immediate preservation problem. Collaboration content is not one dataset. The message body, attachment, version history, channel membership, deletion event, audit record, and identity context may live in separate systems and may not remain available for the same period.
Map each collaboration source before collection, then record the retention action, acquisition method, validation, exceptions, and handoff to review.
Freeze routine change without disabling the business
Counsel should direct legal scope. IT can then identify the tenant, accounts, channels, shared mailboxes, cloud drives, endpoints, mobile devices, retention rules, licenses, backup sources, and departed-user workflows involved. Before changing an account, record what suspension, deletion, reassignment, license removal, or mailbox conversion will do to preserved material.
Immediate collection may be necessary for audit or identity records with short availability. Other sources can be held in place. The source map should state which decision applies to each record and who owns the next action.
Collect context, not only message text
For Microsoft 365, relevant sources may include mailbox content, Teams messages, SharePoint or OneDrive files, Purview holds or exports, unified audit data, Entra sign-ins, application consent, inbox rules, and endpoints. Slack may require workspace exports, channel and membership context, attached files, audit logs, retention settings, and connected services. Native files and provider-generated identifiers are retained where available.
- Record tenant, license, retention, time zone, administrator, and collection time.
- Preserve edits, deletions, reactions, threads, attachments, and membership context where supported.
- Collect identity and administrative events before their retention expires.
- Reconcile expected custodians and channels against completed exports.
- Document unavailable data and provider limitations.
Do not let remediation erase attribution evidence
Credential resets, token revocation, rule removal, account suspension, and device reimaging may be required. Sequence those changes with evidence preservation when possible, and record the exact time and reason. A later reviewer should be able to distinguish user activity from the response team's work.