Now Reading: Why Your M365 Policies Are Lying
-
01
Why Your M365 Policies Are Lying
1
00:00:00,000 –> 00:00:04,520
Nothing failed, the same tenant, the same policy set, the same confirmations we’ve relied
2
00:00:04,520 –> 00:00:06,180
on for months.
3
00:00:06,180 –> 00:00:12,560
Retention labels applied, library version enabled, eDiscovery cases open, the unified audit
4
00:00:12,560 –> 00:00:13,960
log recording.
5
00:00:13,960 –> 00:00:16,760
Every dashboard green, every report reconciled.
6
00:00:16,760 –> 00:00:20,840
Here’s what actually happens, we ask one question, the system answers correctly and we assume
7
00:00:20,840 –> 00:00:22,440
the meaning didn’t move.
8
00:00:22,440 –> 00:00:27,040
Most people think stable outputs prove control, but stability can also hide drift.
9
00:00:27,040 –> 00:00:32,120
We’re going to replay the exact scenario, same facts, same steps, and watch the behavior,
10
00:00:32,120 –> 00:00:33,120
not the color.
11
00:00:33,120 –> 00:00:34,120
We’ll run this again.
12
00:00:34,120 –> 00:00:38,880
Let’s define green, establish the baseline and pin what success looks like.
13
00:00:38,880 –> 00:00:44,460
Environment baseline, what green looks like, one tenant, one scenario, no noise, sharepoint
14
00:00:44,460 –> 00:00:49,400
online active, with standard site collections for teams connected workspaces and a few communication
15
00:00:49,400 –> 00:00:54,720
sites, one drive provisioned tenant-wide default quotas intact, teams in regular use for
16
00:00:54,720 –> 00:00:57,080
channel files and meeting artifacts.
17
00:00:57,080 –> 00:01:02,240
Microsoft purview configured with data lifecycle management policies and auto-applied retention
18
00:01:02,240 –> 00:01:03,240
labels.
19
00:01:03,240 –> 00:01:07,080
Information protection present, even if we’re not stress testing encryption today.
20
00:01:07,080 –> 00:01:09,640
The audit signals first, unified audit log is on.
21
00:01:09,640 –> 00:01:15,480
We validated the role and license preconditions, searched the recent 24 hour window and seen
22
00:01:15,480 –> 00:01:22,440
expected verbs, file uploaded, file downloaded, file accessed, file modified, mail items accessed,
23
00:01:22,440 –> 00:01:23,440
were appropriate.
24
00:01:23,440 –> 00:01:27,520
We got apps, no throttling errors, the outcome was correct, so we ran it again.
25
00:01:27,520 –> 00:01:31,960
Clean compliance manager shows our assessed controls mapped and scored, the score is steady
26
00:01:31,960 –> 00:01:33,760
week over week.
27
00:01:33,760 –> 00:01:38,360
No red items in our scoped baseline, a few improvements available, but none affecting
28
00:01:38,360 –> 00:01:40,920
retention or discovery for this tenant.
29
00:01:40,920 –> 00:01:46,240
The posture graph is flat, that’s when we realized flatness might not equal certainty,
30
00:01:46,240 –> 00:01:48,120
only repetition.
31
00:01:48,120 –> 00:01:54,280
The score unchanged across the last three reviews, MFA enforced for admins, conditional access,
32
00:01:54,280 –> 00:01:58,600
policies, active, privileged identity management, wrapping elevation.
33
00:01:58,600 –> 00:02:02,720
No alerts in defender for cloud apps tied to SharePoint or OneDrive anomalous downloads,
34
00:02:02,720 –> 00:02:06,960
the perimeter looks contained, the logs were clean, the pattern wasn’t.
35
00:02:06,960 –> 00:02:08,720
Retention configurations next.
36
00:02:08,720 –> 00:02:13,960
We have organization-wide retention policies scoped to SharePoint sites, OneDrive accounts,
37
00:02:13,960 –> 00:02:15,800
and exchange mailboxes.
38
00:02:15,800 –> 00:02:20,380
The policies stayed retained and delete with defined durations, we also have auto-apply
39
00:02:20,380 –> 00:02:24,440
retention labels on libraries that match content queries.
40
00:02:24,440 –> 00:02:29,000
Preservation lock is not engaged for our test policies, this matters for reversibility,
41
00:02:29,000 –> 00:02:30,360
but not for observation.
42
00:02:30,360 –> 00:02:35,040
It discovery standard case exists with custodians added and legal holds available, but not yet
43
00:02:35,040 –> 00:02:36,040
applied.
44
00:02:36,040 –> 00:02:40,320
We keep holds optional to observe default life cycle first.
45
00:02:40,320 –> 00:02:46,080
The distribution completed more than seven days ago status shows on success.
46
00:02:46,080 –> 00:02:49,560
No pending propagation to explain variance later.
47
00:02:49,560 –> 00:02:55,240
Library level versioning settings are visible, major versions enabled, for sites where intelligent
48
00:02:55,240 –> 00:03:00,120
versioning is in play, the UI reports the automatic 500 version logic.
49
00:03:00,120 –> 00:03:01,800
We note the rule.
50
00:03:01,800 –> 00:03:08,440
First 30 days preserve versions aggressively, thinning increases after day 30, and retention,
51
00:03:08,440 –> 00:03:11,040
if applied, overrides trimming.
52
00:03:11,040 –> 00:03:16,160
We document the cap and the thinning cadence because version history will become our
53
00:03:16,160 –> 00:03:17,680
first instrument.
54
00:03:17,680 –> 00:03:20,920
The numbers look normal, the implications don’t.
55
00:03:20,920 –> 00:03:25,760
Ground truth sources are pinned library settings pages for versioning and content approval
56
00:03:25,760 –> 00:03:26,760
states.
57
00:03:26,760 –> 00:03:33,120
Preservation, hold library, phl, urls, recorded for each target site.
58
00:03:33,120 –> 00:03:38,120
We confirm they exist only on first edit/delete under retention.
59
00:03:38,120 –> 00:03:43,960
Storage metrics for the libraries in question to reconcile size deltas with version churn.
60
00:03:43,960 –> 00:03:49,760
Unified audit log queries save to capture edit velocity versus committed version creation.
61
00:03:49,760 –> 00:03:52,280
Success artifacts are collected.
62
00:03:52,280 –> 00:03:56,680
Compliance manager, export showing control, implementations.
63
00:03:56,680 –> 00:03:59,200
Secure score, history report.
64
00:03:59,200 –> 00:04:03,400
Per view policy list with scopes, actions and status.
65
00:04:03,400 –> 00:04:08,240
Discovery case metadata custodian squeries no holds yet, UL export with a 48 hour slice
66
00:04:08,240 –> 00:04:10,160
to catch burst behavior.
67
00:04:10,160 –> 00:04:12,520
All reports show green, no variance.
68
00:04:12,520 –> 00:04:13,720
Dashboard stable.
69
00:04:13,720 –> 00:04:18,640
We acknowledge the constraint window, up to 7 days for policy propagation, background
70
00:04:18,640 –> 00:04:25,240
jobs for exploration run on cadence, recycle bin holds for 93 days, and version caps at 500
71
00:04:25,240 –> 00:04:26,800
by automatic logic.
72
00:04:26,800 –> 00:04:29,480
We accept those timers as the environments clock.
73
00:04:29,480 –> 00:04:31,240
We will not force clocks.
74
00:04:31,240 –> 00:04:32,480
We will observe them.
75
00:04:32,480 –> 00:04:34,960
Now what does green mean operationally?
76
00:04:34,960 –> 00:04:39,760
A labeled document should persist until the retention period expires regardless of user
77
00:04:39,760 –> 00:04:40,760
deletes.
78
00:04:40,760 –> 00:04:47,440
A library with major version enabled should grow version counts in proportion to meaningful
79
00:04:47,440 –> 00:04:50,640
edit events subject to caps and intelligent thinning.
80
00:04:50,640 –> 00:04:56,760
A site under retention should populate its phl upon first relevant edit or deletion, preserving
81
00:04:56,760 –> 00:04:58,200
originals invisibly.
82
00:04:58,200 –> 00:05:03,520
A discovery queries with stable KQL across the same custodians should reflect corpus growth
83
00:05:03,520 –> 00:05:06,680
or shrinkage, not stay flat without cause.
84
00:05:06,680 –> 00:05:12,120
The audit log should reconcile action velocity to some footprint in versions, holds or search
85
00:05:12,120 –> 00:05:13,960
counts even if delayed.
86
00:05:13,960 –> 00:05:16,760
We set acceptance criteria.
87
00:05:16,760 –> 00:05:22,360
Version velocity matches within a reasonable band, the observed file modified cadence for
88
00:05:22,360 –> 00:05:25,760
office documents in high activity libraries.
89
00:05:25,760 –> 00:05:32,280
Phl footprint grows when user visible history shrinks due to user deletions during retention.
90
00:05:32,280 –> 00:05:37,360
A discovery result counts scale over time with new content, or we can explain scope filters
91
00:05:37,360 –> 00:05:38,680
that counter growth.
92
00:05:38,680 –> 00:05:44,640
Secure score and compliance manage stability is documented, but not used as sole evidence
93
00:05:44,640 –> 00:05:46,160
of control.
94
00:05:46,160 –> 00:05:51,880
We limit noise, no priority cleanup policies active, we don’t want pre-governance deletion
95
00:05:51,880 –> 00:05:53,640
to mask behavior yet.
96
00:05:53,640 –> 00:05:58,920
No holds applied initially, holds change precedence will add them deliberately in later loops.
97
00:05:58,920 –> 00:06:06,400
No label changes mid observation, propagation delays confuse causality, no external tool intervention,
98
00:06:06,400 –> 00:06:08,600
native behavior only.
99
00:06:08,600 –> 00:06:12,000
Everything is green, the outcome is correct, so we ran it again.
100
00:06:12,000 –> 00:06:14,720
In retrospect, green is a color, not a behavior.
101
00:06:14,720 –> 00:06:16,720
The tenant meets policy definitions.
102
00:06:16,720 –> 00:06:20,680
The signals are consistent, that consistency is our baseline and our trap.
103
00:06:20,680 –> 00:06:26,000
If the system keeps answering correctly, the only variable left is the question we think
104
00:06:26,000 –> 00:06:27,000
we asked.
105
00:06:27,000 –> 00:06:28,760
We’re ready to press the loop.
106
00:06:28,760 –> 00:06:30,760
Loop zero, the perfect run.
107
00:06:30,760 –> 00:06:35,920
The same policy executed again, the outcome was correct, labels applied successfully, the
108
00:06:35,920 –> 00:06:38,480
library reported major versions enabled.
109
00:06:38,480 –> 00:06:42,520
The phl stayed dormant as expected because nothing had been deleted yet.
110
00:06:42,520 –> 00:06:47,400
Our e-discovery case returned results that matched our test KQL exactly.
111
00:06:47,400 –> 00:06:52,800
The unified audit log stitched a clean sequence, upload, open modify, auto save, close, nothing
112
00:06:52,800 –> 00:06:53,800
failed.
113
00:06:53,800 –> 00:06:54,800
So we ran it again.
114
00:06:54,800 –> 00:06:59,280
We chose one high activity library in a team’s connected site, office files with auto save
115
00:06:59,280 –> 00:07:00,280
on.
116
00:07:00,280 –> 00:07:05,920
Co-authoring allowed, we opened six documents, staggered edits, saved on each meaningful
117
00:07:05,920 –> 00:07:06,920
change.
118
00:07:06,920 –> 00:07:11,600
The version history window populated with neat increments, version three, version four,
119
00:07:11,600 –> 00:07:17,360
version five, names and timestamps lined up against our audit events, the counts aligned.
120
00:07:17,360 –> 00:07:22,040
Back to purview, the retention label we auto applied was visible in the file banner.
121
00:07:22,040 –> 00:07:26,440
The item level details confirmed, retained for the configured duration then delete.
122
00:07:26,440 –> 00:07:29,120
The policy state remained on success.
123
00:07:29,120 –> 00:07:32,520
That’s when we realized our confirmation cadence was rehearsed.
124
00:07:32,520 –> 00:07:36,840
The system answered correctly but we were still asking a beginner’s question, we widened
125
00:07:36,840 –> 00:07:38,160
the run.
126
00:07:38,160 –> 00:07:42,800
Added two one drive accounts to observe personal site behavior under the same retention
127
00:07:42,800 –> 00:07:48,520
policy, uploaded new content, edited and then deleted one file in each account.
128
00:07:48,520 –> 00:07:52,520
The first deletion in each site created the preservation hold library behind the scenes
129
00:07:52,520 –> 00:07:54,760
to be verified with the URL.
130
00:07:54,760 –> 00:07:56,400
Copies existed there.
131
00:07:56,400 –> 00:08:02,520
The user recycle bins showed the deletions, aging toward the 93 day threshold.
132
00:08:02,520 –> 00:08:04,000
Everything reconciled.
133
00:08:04,000 –> 00:08:08,440
Reports were satisfied, compliance manager still green, secure score unchanged.
134
00:08:08,440 –> 00:08:09,840
The dashboards didn’t blink.
135
00:08:09,840 –> 00:08:15,280
We checked the e-discovery case, we had a simple KQL, file name fragments, a sensitivity
136
00:08:15,280 –> 00:08:18,760
to author fields and a date range for this week.
137
00:08:18,760 –> 00:08:22,720
The results returned the new files from the site and the one drive accounts.
138
00:08:22,720 –> 00:08:27,760
Counts aligned with uploads, exports succeeded, processing windows matched expectations.
139
00:08:27,760 –> 00:08:28,800
So we ran it again.
140
00:08:28,800 –> 00:08:34,280
We triggered concurrency, three editors opened the same document, edits overlapped comments,
141
00:08:34,280 –> 00:08:38,120
flew, tracked changes collided and auto-saved churned.
142
00:08:38,120 –> 00:08:43,960
The version history showed a compressed sequence, fewer than the total edit touches might imply.
143
00:08:43,960 –> 00:08:48,160
But still in acceptable step with the events we’d consider meaningful.
144
00:08:48,160 –> 00:08:52,000
We accepted the compression as expected consolidation from co-authoring.
145
00:08:52,000 –> 00:08:56,320
The UAL showed velocity spikes in file modified activity.
146
00:08:56,320 –> 00:08:59,080
Version numbers climbed though not one to one.
147
00:08:59,080 –> 00:09:01,760
We logged the ratio as close enough under load.
148
00:09:01,760 –> 00:09:08,480
We planted microchecks, picked a random file, rolled back to version 2, saved and then
149
00:09:08,480 –> 00:09:10,160
restored the latest.
150
00:09:10,160 –> 00:09:13,400
The system preserved the intermediate state then returned us to present.
151
00:09:13,400 –> 00:09:17,640
The labels persisted, the retention settings didn’t flicker, the PHL didn’t engage
152
00:09:17,640 –> 00:09:19,400
because we hadn’t deleted anything.
153
00:09:19,400 –> 00:09:20,920
The behavior was consistent.
154
00:09:20,920 –> 00:09:25,920
We added a gentle stressor, moved a labeled file between libraries within the same site,
155
00:09:25,920 –> 00:09:28,760
the label traveled with it, the audit log captured the move.
156
00:09:28,760 –> 00:09:30,600
We discovered it in the new location.
157
00:09:30,600 –> 00:09:33,360
The policy scope permitted it, the outcome was correct.
158
00:09:33,360 –> 00:09:37,240
We replayed Discovery, same KQL, same custodian, same scope.
159
00:09:37,240 –> 00:09:42,280
The counts were stable with small increases precisely where we added content.
160
00:09:42,280 –> 00:09:46,240
Export smatched counts, no partial indexing flags remain.
161
00:09:46,240 –> 00:09:48,480
Advanced indexing had nothing to add.
162
00:09:48,480 –> 00:09:50,600
Processing completed within the typical window.
163
00:09:50,600 –> 00:09:54,680
No alerts triggered, so we ran it again when we flipped the deletion switch, removed a
164
00:09:54,680 –> 00:09:57,400
labeled file from a library under retention.
165
00:09:57,400 –> 00:09:59,880
The user-facing library showed it gone.
166
00:09:59,880 –> 00:10:04,880
The first stage recycle bin held it, clock started, the PHL got a preserved copy.
167
00:10:04,880 –> 00:10:09,240
Version history for the preserved item showed the consolidated prior versions captured as
168
00:10:09,240 –> 00:10:12,800
one preserved artifact as designed in recent changes.
169
00:10:12,800 –> 00:10:14,560
We reconciled the sizes.
170
00:10:14,560 –> 00:10:16,880
Storage metrics increased predictably.
171
00:10:16,880 –> 00:10:17,880
Nothing unusual.
172
00:10:17,880 –> 00:10:20,960
We checked preconditions that usually break clean runs.
173
00:10:20,960 –> 00:10:24,040
Policy distribution age, over seven days.
174
00:10:24,040 –> 00:10:25,040
Status?
175
00:10:25,040 –> 00:10:26,040
Success?
176
00:10:26,040 –> 00:10:27,600
License coverage for audit?
177
00:10:27,600 –> 00:10:32,200
Valid, role assignments for eDiscovery, confirmed conditional access not interfering with our browser
178
00:10:32,200 –> 00:10:33,200
sessions?
179
00:10:33,200 –> 00:10:36,680
Verified, we removed edge excuses before they could explain drift.
180
00:10:36,680 –> 00:10:37,920
There was none to explain.
181
00:10:37,920 –> 00:10:41,920
We compared version velocity to file modified volume in the UL.
182
00:10:41,920 –> 00:10:47,320
The slope lines weren’t identical, but they were parallel enough for day zero confidence.
183
00:10:47,320 –> 00:10:52,360
Co-authoring, flattened version creation, and that was acceptable under an intelligent
184
00:10:52,360 –> 00:10:53,360
scheme.
185
00:10:53,360 –> 00:10:54,360
We noted it and moved on.
186
00:10:54,360 –> 00:10:55,600
We flipped to the human view.
187
00:10:55,600 –> 00:11:02,080
A project owner opened SharePoint saw the label on their files, saw version history increments,
188
00:11:02,080 –> 00:11:03,840
and trusted the little shield.
189
00:11:03,840 –> 00:11:06,080
They could delete a file and see it go away.
190
00:11:06,080 –> 00:11:08,520
They could see it in PHL and discovery.
191
00:11:08,520 –> 00:11:10,840
Legal could find it with the same KQL.
192
00:11:10,840 –> 00:11:13,080
Security could point at green scores.
193
00:11:13,080 –> 00:11:14,920
Everyone’s expectations were met.
194
00:11:14,920 –> 00:11:17,640
That’s when we realized the perfect run was a mirror.
195
00:11:17,640 –> 00:11:19,880
It reflected our question back at us.
196
00:11:19,880 –> 00:11:21,280
We asked, does it work?
197
00:11:21,280 –> 00:11:23,400
The system showed us working parts.
198
00:11:23,400 –> 00:11:24,400
We nodded.
199
00:11:24,400 –> 00:11:27,200
We needed to ask what changed while it was working.
200
00:11:27,200 –> 00:11:28,720
We seeded the next observation.
201
00:11:28,720 –> 00:11:32,400
We bookmarked version counts for five frequently edited files.
202
00:11:32,400 –> 00:11:35,960
We saved the file modified velocity baseline for the same window.
203
00:11:35,960 –> 00:11:38,840
We captured the PHL size zeroing it before deletes.
204
00:11:38,840 –> 00:11:43,880
We saved the e-discovery execution timeline and result counts for the weekly query.
205
00:11:43,880 –> 00:11:46,760
We wanted to replay with sharper dials.
206
00:11:46,760 –> 00:11:47,760
One last pass.
207
00:11:47,760 –> 00:11:52,760
We created, edited, deleted, restored, and discovered a control set.
208
00:11:52,760 –> 00:11:55,720
Every subsystem responded as documented.
209
00:11:55,720 –> 00:11:57,200
Label stuck.
210
00:11:57,200 –> 00:11:59,480
Versions grew, holds captured.
211
00:11:59,480 –> 00:12:00,480
Discovery found.
212
00:12:00,480 –> 00:12:01,960
Logs reconciled.
213
00:12:01,960 –> 00:12:03,120
Nothing failed.
214
00:12:03,120 –> 00:12:04,240
So we ran it again.
215
00:12:04,240 –> 00:12:08,160
With the same facts, the same steps, and a new intention.
216
00:12:08,160 –> 00:12:12,240
Stop checking for correctness and start measuring behavior under repetition.
217
00:12:12,240 –> 00:12:14,440
That’s when we realized the outcome was correct.
218
00:12:14,440 –> 00:12:16,120
The behavior had not been tested.
219
00:12:16,120 –> 00:12:19,040
The next loop would ask about creation itself.
220
00:12:19,040 –> 00:12:20,320
Loop one.
221
00:12:20,320 –> 00:12:21,720
Statement of question.
222
00:12:21,720 –> 00:12:22,720
Creation.
223
00:12:22,720 –> 00:12:24,000
We’re testing creation.
224
00:12:24,000 –> 00:12:25,200
The same tenant.
225
00:12:25,200 –> 00:12:26,360
The same policies.
226
00:12:26,360 –> 00:12:27,920
The same libraries.
227
00:12:27,920 –> 00:12:28,920
New question.
228
00:12:28,920 –> 00:12:33,400
When we create an edit at speed, does version history reflect the work?
229
00:12:33,400 –> 00:12:37,960
Or does the system reinterpret the activity and store less than we expect?
230
00:12:37,960 –> 00:12:39,640
We scoped a busy library.
231
00:12:39,640 –> 00:12:40,640
Office files.
232
00:12:40,640 –> 00:12:41,640
Autosave on.
233
00:12:41,640 –> 00:12:43,160
Co-authoring allowed.
234
00:12:43,160 –> 00:12:45,480
Editors distributed across time zones.
235
00:12:45,480 –> 00:12:49,040
We didn’t change labels, retention, or site settings.
236
00:12:49,040 –> 00:12:50,840
We only changed the question.
237
00:12:50,840 –> 00:12:52,640
Creation underload.
238
00:12:52,640 –> 00:12:54,720
Expectations stated plainly.
239
00:12:54,720 –> 00:12:57,600
Edit volume should correlate with version growth.
240
00:12:57,600 –> 00:13:00,200
Not one to one, but proportional.
241
00:13:00,200 –> 00:13:06,080
Meaningful edits should persist as distinct versions for a reasonable window than thin predictably.
242
00:13:06,080 –> 00:13:08,120
We accept intelligent versioning exists.
243
00:13:08,120 –> 00:13:09,920
We’re not arguing with efficiency.
244
00:13:09,920 –> 00:13:14,320
We’re verifying that history remains history while the work is still fresh.
245
00:13:14,320 –> 00:13:15,600
So we ran it again.
246
00:13:15,600 –> 00:13:19,200
We scheduled a burst, 12 files, 6 editors, 20 minute window.
247
00:13:19,200 –> 00:13:23,000
Each editor made five meaningful changes per document.
248
00:13:23,000 –> 00:13:28,800
Sections added, tables updated, formulas rewritten, tracked changes toggled to force material
249
00:13:28,800 –> 00:13:29,880
deltas.
250
00:13:29,880 –> 00:13:33,640
We logged file-modified velocity in the unified audit log for the window.
251
00:13:33,640 –> 00:13:37,080
We pinned the starting version number for each file.
252
00:13:37,080 –> 00:13:40,600
We captured n-state version numbers in the timestamps.
253
00:13:40,600 –> 00:13:42,840
The outcome surprised quietly.
254
00:13:42,840 –> 00:13:46,040
Version counts looked flat against the spike.
255
00:13:46,040 –> 00:13:51,280
This happened, content moved forward, but version numbers advanced far fewer steps than the
256
00:13:51,280 –> 00:13:52,600
audit suggested.
257
00:13:52,600 –> 00:13:56,120
Not zero, not broken, just flatter than the activity implied.
258
00:13:56,120 –> 00:13:57,560
We controlled for noise.
259
00:13:57,560 –> 00:14:02,880
We repeated with autosave and manual saves on every meaningful change.
260
00:14:02,880 –> 00:14:05,840
Version counts rows, then plateaued mid-burst.
261
00:14:05,840 –> 00:14:07,880
We repeated with comments only.
262
00:14:07,880 –> 00:14:11,280
Comments produced fewer version increments as expected.
263
00:14:11,280 –> 00:14:14,080
We repeated with tracked changes forced.
264
00:14:14,080 –> 00:14:17,600
And improvement in version increments still below edit volume.
265
00:14:17,600 –> 00:14:21,000
We alternated single author and co-authoring sessions.
266
00:14:21,000 –> 00:14:27,120
Single author produced more versions than multi-author, but neither matched edit velocity.
267
00:14:27,120 –> 00:14:30,360
Now this is important because versioning defines history.
268
00:14:30,360 –> 00:14:35,880
If the platform compresses creation aggressively, then the artifact pool we assume exists for
269
00:14:35,880 –> 00:14:39,960
retention, restoration and discovery is smaller than our mental model.
270
00:14:39,960 –> 00:14:41,200
The policy didn’t fail.
271
00:14:41,200 –> 00:14:42,360
The object changed.
272
00:14:42,360 –> 00:14:44,240
We paused and refraised the question.
273
00:14:44,240 –> 00:14:49,040
Are we witnessing suppression or are we witnessing intelligent consolidation that honors recent
274
00:14:49,040 –> 00:14:51,240
time windows differently than we remember?
275
00:14:51,240 –> 00:14:53,240
We collected one more dial.
276
00:14:53,240 –> 00:14:56,960
Version expiration indicators where automatic trimming applies.
277
00:14:56,960 –> 00:15:01,760
We saw the never expires tag on the current version and schedule hints on older versions
278
00:15:01,760 –> 00:15:03,200
well past 30 days.
279
00:15:03,200 –> 00:15:04,520
Our burst was brand new.
280
00:15:04,520 –> 00:15:05,840
No trimming yet.
281
00:15:05,840 –> 00:15:08,320
Compression occurred at creation, not later thinning.
282
00:15:08,320 –> 00:15:09,960
So we ran it again slower.
283
00:15:09,960 –> 00:15:11,000
Same editors.
284
00:15:11,000 –> 00:15:12,200
Same documents.
285
00:15:12,200 –> 00:15:16,280
We’ve only after a paragraph level change, wait 30 seconds between saves.
286
00:15:16,280 –> 00:15:19,160
Version counts rose more predictably, but still fewer than edits.
287
00:15:19,160 –> 00:15:20,160
The slope improved.
288
00:15:20,160 –> 00:15:24,320
The ratio remained below intuitive expectation.
289
00:15:24,320 –> 00:15:25,920
Expectation meets observation.
290
00:15:25,920 –> 00:15:28,680
We accept that intelligent versioning exists.
291
00:15:28,680 –> 00:15:32,920
We also accept that our policy promises depend on the number of preserved states, not the
292
00:15:32,920 –> 00:15:34,840
number of keystrokes.
293
00:15:34,840 –> 00:15:39,840
Creation became our first drift indicator, even while every control remained green.
294
00:15:39,840 –> 00:15:40,840
Type 1.
295
00:15:40,840 –> 00:15:42,640
Evidence proving version suppression.
296
00:15:42,640 –> 00:15:44,400
We needed proof, not intuition.
297
00:15:44,400 –> 00:15:47,080
So we ran it again this time with instruments up.
298
00:15:47,080 –> 00:15:48,840
First library settings.
299
00:15:48,840 –> 00:15:51,880
Versioning settings snapshot taken before the burst.
300
00:15:51,880 –> 00:15:53,320
Major versions enabled.
301
00:15:53,320 –> 00:15:54,800
No minor versions.
302
00:15:54,800 –> 00:16:00,080
The tenant wide intelligent versioning banner present up to 500 versions per file thinning
303
00:16:00,080 –> 00:16:02,320
increases after 30 days.
304
00:16:02,320 –> 00:16:04,640
Current version never expires.
305
00:16:04,640 –> 00:16:06,280
Retention overrides trimming.
306
00:16:06,280 –> 00:16:11,640
We exported the setting state for the library and the site to file timestamped, then the unified
307
00:16:11,640 –> 00:16:13,400
audit log deltas.
308
00:16:13,400 –> 00:16:18,240
We executed saved queries for file modified and file accessed across the specific library
309
00:16:18,240 –> 00:16:22,200
URLs and document IDs bounded to the burst window.
310
00:16:22,200 –> 00:16:27,840
We extracted counts per document and computed velocity, modification events per minute.
311
00:16:27,840 –> 00:16:31,360
No throttling errors, no delayed ingestion flags.
312
00:16:31,360 –> 00:16:34,320
The numbers were spiky as designed, the outcome was correct.
313
00:16:34,320 –> 00:16:35,560
Now we compared.
314
00:16:35,560 –> 00:16:41,240
For each file we plotted, UAL file modified counts versus version history increments.
315
00:16:41,240 –> 00:16:47,520
In single author sessions, the ratio settled around 2 to 1 or 3 to 1, 2 or 3 file modified
316
00:16:47,520 –> 00:16:49,480
events per version increment.
317
00:16:49,480 –> 00:16:53,200
In co-authoring sessions, the ratio widened 5 sometimes 6 to 1.
318
00:16:53,200 –> 00:16:55,560
We confirmed autosave consolidation behavior.
319
00:16:55,560 –> 00:16:56,560
We didn’t argue with it.
320
00:16:56,560 –> 00:16:57,640
We documented it.
321
00:16:57,640 –> 00:16:59,440
But here’s where it gets interesting.
322
00:16:59,440 –> 00:17:04,640
We toggled autosave off, mandated manual saves after meaningful edits and repeated.
323
00:17:04,640 –> 00:17:07,840
The ratio tightened but did not normalize to 1 to 1.
324
00:17:07,840 –> 00:17:08,840
Why?
325
00:17:08,840 –> 00:17:12,840
Because the platform still coalesces rapid sequential saves by the same author within
326
00:17:12,840 –> 00:17:13,960
a narrow window.
327
00:17:13,960 –> 00:17:15,240
The saving cadence matters.
328
00:17:15,240 –> 00:17:19,960
We measured windows, saves within roughly a handful of seconds compressed into one version.
329
00:17:19,960 –> 00:17:20,960
Wait 30 seconds.
330
00:17:20,960 –> 00:17:23,200
You’re more likely to get distinct versions.
331
00:17:23,200 –> 00:17:24,200
We logged it.
332
00:17:24,200 –> 00:17:25,480
Edge case is next.
333
00:17:25,480 –> 00:17:26,840
Non-office files.
334
00:17:26,840 –> 00:17:31,560
We uploaded PDFs and images, modified metadata, replaced files with same name.
335
00:17:31,560 –> 00:17:33,720
Version behavior changed.
336
00:17:33,720 –> 00:17:37,040
Replacing files generated new versions reliably.
337
00:17:37,040 –> 00:17:41,360
Metadata edits sometimes did, sometimes didn’t, depending on column type and library
338
00:17:41,360 –> 00:17:42,360
settings.
339
00:17:42,360 –> 00:17:43,600
Autosave didn’t apply.
340
00:17:43,600 –> 00:17:46,720
The ratios collapsed toward 1 to 1 for replacements.
341
00:17:46,720 –> 00:17:48,960
We noted the distinction.
342
00:17:48,960 –> 00:17:53,400
Office co-authoring plus autosave is the compressive engine.
343
00:17:53,400 –> 00:17:56,680
Non-office replacements are blunt increments.
344
00:17:56,680 –> 00:17:58,840
We moved to intelligent versioning nuance.
345
00:17:58,840 –> 00:18:00,320
The cap is 500.
346
00:18:00,320 –> 00:18:04,800
Trimming favors recent versions aggressively for the first 30 days, meaning it doesn’t trim
347
00:18:04,800 –> 00:18:05,800
recent versions.
348
00:18:05,800 –> 00:18:08,440
Our burst was under 30 minutes old.
349
00:18:08,440 –> 00:18:09,440
No trimming.
350
00:18:09,440 –> 00:18:13,120
Yet our counts were already compressed relative to activity.
351
00:18:13,120 –> 00:18:17,160
Therefore compression occurs at creation not only by later thinning.
352
00:18:17,160 –> 00:18:19,040
That’s the first proof point.
353
00:18:19,040 –> 00:18:21,080
Retention overwrite nuance.
354
00:18:21,080 –> 00:18:26,400
Retention labels and policies that apply to items prevent deletion of retained versions
355
00:18:26,400 –> 00:18:28,200
until the period ends.
356
00:18:28,200 –> 00:18:32,680
We applied a retained and delet label to the burst files and repeated the test.
357
00:18:32,680 –> 00:18:34,160
Same compression at creation.
358
00:18:34,160 –> 00:18:36,200
The label did not change consolidation.
359
00:18:36,200 –> 00:18:38,040
It only prevents trimming later.
360
00:18:38,040 –> 00:18:41,720
The number of preserved states still reflected the consolidation logic.
361
00:18:41,720 –> 00:18:43,440
That’s the second proof point.
362
00:18:43,440 –> 00:18:44,440
Co-authoring merges.
363
00:18:44,440 –> 00:18:46,440
We constructed a conflict scenario.
364
00:18:46,440 –> 00:18:49,680
Simultaneous edits to the same paragraph by two authors.
365
00:18:49,680 –> 00:18:51,080
Then resolution.
366
00:18:51,080 –> 00:18:55,960
The platform produced a single version with merged content and embedded track changes.
367
00:18:55,960 –> 00:18:56,960
Data.
368
00:18:56,960 –> 00:19:00,520
Not two separate versions capturing each author’s intermediate state.
369
00:19:00,520 –> 00:19:04,560
The UAL recorded multiple file modified events close together.
370
00:19:04,560 –> 00:19:06,360
Version history showed one increment.
371
00:19:06,360 –> 00:19:08,400
That gap is the third proof point.
372
00:19:08,400 –> 00:19:09,400
Autosave churn.
373
00:19:09,400 –> 00:19:13,440
We forced keystroke level edits for two minutes with autosave on, then paused.
374
00:19:13,440 –> 00:19:14,920
UAL spiked.
375
00:19:14,920 –> 00:19:18,640
Version history produced one or two increments, not dozens.
376
00:19:18,640 –> 00:19:19,640
Acceptable by design.
377
00:19:19,640 –> 00:19:21,760
Significant for expectations.
378
00:19:21,760 –> 00:19:25,480
We captured the time between the last keystroke and the version appearance.
379
00:19:25,480 –> 00:19:27,000
The batching window mattered.
380
00:19:27,000 –> 00:19:28,200
That’s the fourth proof point.
381
00:19:28,200 –> 00:19:33,440
We checked preservation hold library behavior to ensure we weren’t losing versions silently.
382
00:19:33,440 –> 00:19:38,280
We deleted one of the burst files under retention immediately after the session.
383
00:19:38,280 –> 00:19:43,100
The phl stored a preserved copy with all prior versions consolidated as the preserved
384
00:19:43,100 –> 00:19:47,000
artifact consistent with the post 2022 behavior change.
385
00:19:47,000 –> 00:19:50,880
It did not create additional versions for each rapid edit.
386
00:19:50,880 –> 00:19:55,960
It preserved the latest known structure and the version history that already existed.
387
00:19:55,960 –> 00:19:58,360
No hidden reservoir of micro versions appeared.
388
00:19:58,360 –> 00:19:59,680
That’s the fifth proof point.
389
00:19:59,680 –> 00:20:03,040
We examined storage metrics for the library.
390
00:20:03,040 –> 00:20:09,400
If version suppression were silently discarding significant states, storage growth might betray
391
00:20:09,400 –> 00:20:10,400
it.
392
00:20:10,400 –> 00:20:13,400
Instead we saw expected growth for office files under heavy edit.
393
00:20:13,400 –> 00:20:18,400
The growth mapped closer to content delta sized and to file modified counts.
394
00:20:18,400 –> 00:20:21,680
storage told us nothing new about version count.
395
00:20:21,680 –> 00:20:27,360
It confirmed that consolidation didn’t imply data loss beyond intentional coalescence.
396
00:20:27,360 –> 00:20:30,600
Sixth proof point storage growth without proportional version growth.
397
00:20:30,600 –> 00:20:35,680
We ran a control with auto save off, single author, five minute gaps between meaningful
398
00:20:35,680 –> 00:20:38,160
edits, save after each.
399
00:20:38,160 –> 00:20:40,480
Version increments matched edits within one.
400
00:20:40,480 –> 00:20:42,440
The ratio improved dramatically.
401
00:20:42,440 –> 00:20:48,200
Creation compression faded when we removed co-authoring and reduced temporal proximity.
402
00:20:48,200 –> 00:20:50,920
The system behaved like traditional versioning.
403
00:20:50,920 –> 00:20:52,080
Seventh proof point.
404
00:20:52,080 –> 00:20:54,680
The compression is contextual, not universal.
405
00:20:54,680 –> 00:20:57,200
We verified UI signals.
406
00:20:57,200 –> 00:21:02,000
The version history pane occasionally displayed saved by auto save entries that bundled
407
00:21:02,000 –> 00:21:03,600
multiple content changes.
408
00:21:03,600 –> 00:21:04,960
We clicked through details.
409
00:21:04,960 –> 00:21:08,640
The delta preview showed multiple paragraph updates within one version.
410
00:21:08,640 –> 00:21:11,600
We confirmed authorship attribution remained accurate.
411
00:21:11,600 –> 00:21:14,920
We confirmed timestamps were precise to the minute.
412
00:21:14,920 –> 00:21:17,480
Sometimes the second but not per keystroke.
413
00:21:17,480 –> 00:21:18,720
Eighth proof point.
414
00:21:18,720 –> 00:21:20,880
The UI itself admits consolidation.
415
00:21:20,880 –> 00:21:22,800
We validated discovery impact.
416
00:21:22,800 –> 00:21:27,680
We ran e-discovery queries filtering by version metadata and date ranges.
417
00:21:27,680 –> 00:21:32,760
Premium review sets preserve item states at the time of collection, but they don’t explode
418
00:21:32,760 –> 00:21:36,840
auto save micro states into discrete discoverable versions.
419
00:21:36,840 –> 00:21:40,120
The collected item corresponds to available version entries.
420
00:21:40,120 –> 00:21:44,960
If those entries are compressed, discovery inherits the consolidation.
421
00:21:44,960 –> 00:21:46,320
Seventh proof point.
422
00:21:46,320 –> 00:21:51,800
Search consistency doesn’t equal scope consistency when creation compresses variance upstream.
423
00:21:51,800 –> 00:21:53,560
Here’s what this proves.
424
00:21:53,560 –> 00:21:56,640
Activity does not equal version persistence.
425
00:21:56,640 –> 00:22:01,760
Intelligent versioning and co-authoring produce fewer preserved versions than naive expectations
426
00:22:01,760 –> 00:22:04,560
under load even when everything is green.
427
00:22:04,560 –> 00:22:05,800
The policy didn’t fail.
428
00:22:05,800 –> 00:22:07,760
The object changed at creation.
429
00:22:07,760 –> 00:22:13,680
So we ran it again, not to chase more edge cases, but to accept the behavior and reframe
430
00:22:13,680 –> 00:22:15,280
the implication.
431
00:22:15,280 –> 00:22:20,680
If your governance assumes every meaningful edit becomes a distinct recoverable state for
432
00:22:20,680 –> 00:22:26,160
a near term window, your assumption is wrong under auto save and co-authoring.
433
00:22:26,160 –> 00:22:30,920
Your retention promises hold the versions that exist, not the edits that occurred.
434
00:22:30,920 –> 00:22:35,240
We closed the loop with one actionable measurement.
435
00:22:35,240 –> 00:22:40,600
Instrument version velocity against file modified velocity as a routine signal.
436
00:22:40,600 –> 00:22:43,280
Track the ratio per hotspot library.
437
00:22:43,280 –> 00:22:47,800
When the ratio drifts flatter over time without a change in collaboration pattern, you’re
438
00:22:47,800 –> 00:22:50,080
seeing creation behavior change.
439
00:22:50,080 –> 00:22:51,400
Not a failure.
440
00:22:51,400 –> 00:22:52,800
A meaning shift.
441
00:22:52,800 –> 00:22:53,800
Loop one.
442
00:22:53,800 –> 00:22:54,960
Realization.
443
00:22:54,960 –> 00:22:56,480
The object changed.
444
00:22:56,480 –> 00:22:58,200
The policy didn’t fail.
445
00:22:58,200 –> 00:23:00,080
The object changed.
446
00:23:00,080 –> 00:23:05,440
Creation under auto save and co-authoring produced fewer preserved states than our mental model.
447
00:23:05,440 –> 00:23:09,280
The tenant state green, the behavior moved, we reconciled what that means.
448
00:23:09,280 –> 00:23:11,040
The library is still compliant.
449
00:23:11,040 –> 00:23:12,280
The label still applies.
450
00:23:12,280 –> 00:23:16,520
The retention policy still retains, but the artifact pool is smaller than assumed at the
451
00:23:16,520 –> 00:23:18,480
moment history matters most.
452
00:23:18,480 –> 00:23:23,760
Immediately after work happens, we measured it, single author spaced saves near one to one.
453
00:23:23,760 –> 00:23:28,200
Co-authoring auto save on 5 or 6 modifications per version.
454
00:23:28,200 –> 00:23:29,200
That’s not an error.
455
00:23:29,200 –> 00:23:30,200
That’s consolidation.
456
00:23:30,200 –> 00:23:32,920
So we ran it again when we asked an error question.
457
00:23:32,920 –> 00:23:37,040
What does a project owner actually have when they say roll back to the copy from 10 minutes
458
00:23:37,040 –> 00:23:38,040
ago?
459
00:23:38,040 –> 00:23:41,720
When pressed run, the closest recoverable state might be a merged version that includes
460
00:23:41,720 –> 00:23:43,600
multiple edits across authors.
461
00:23:43,600 –> 00:23:44,800
The request is reasonable.
462
00:23:44,800 –> 00:23:49,800
The system returns a different answer, a safe, consolidated state, not every branch.
463
00:23:49,800 –> 00:23:51,240
The difference matters.
464
00:23:51,240 –> 00:23:55,680
That’s when we realized stability without variance is telling us filtration, not control.
465
00:23:55,680 –> 00:23:56,800
The dashboards were flat.
466
00:23:56,800 –> 00:23:57,800
The logs were clean.
467
00:23:57,800 –> 00:24:00,240
The version pain said saved by auto save.
468
00:24:00,240 –> 00:24:01,640
The behavior had changed.
469
00:24:01,640 –> 00:24:04,720
Only later did we realize how this propagates downstream.
470
00:24:04,720 –> 00:24:06,320
Discovery inherits what exists.
471
00:24:06,320 –> 00:24:12,080
If creation collapses adjacent edits, your review set contains fewer granular states.
472
00:24:12,080 –> 00:24:15,920
If your reconstruction relies on micro steps, they might not be there.
473
00:24:15,920 –> 00:24:19,040
The policy kept what the platform considered meaningful.
474
00:24:19,040 –> 00:24:21,120
Our question assumed a finer mesh.
475
00:24:21,120 –> 00:24:23,920
So we reframed action in operational terms.
476
00:24:23,920 –> 00:24:27,800
First, monitor version velocity versus edit volume in hotspots.
477
00:24:27,800 –> 00:24:29,240
The ratio is a signal.
478
00:24:29,240 –> 00:24:34,800
If your collaboration pattern is stable and the ratio flattens further, creation behavior
479
00:24:34,800 –> 00:24:35,800
moved again.
480
00:24:35,800 –> 00:24:38,200
Treat it as drift, not failure.
481
00:24:38,200 –> 00:24:41,560
Second, surface expectations.
482
00:24:41,560 –> 00:24:48,040
Document that co-authoring plus auto save compresses near term history.
483
00:24:48,040 –> 00:24:51,520
Publish recovery guidance that uses realistic version spacing.
484
00:24:51,520 –> 00:24:56,400
Avoid promising one-to-one rollbacks unless your process enforces spaced saves.
485
00:24:56,400 –> 00:24:59,800
Third, test recovery under load quarterly.
486
00:24:59,800 –> 00:25:05,480
Pick a representative library, replay a timed edit burst, and validate that your restoration
487
00:25:05,480 –> 00:25:08,640
run book finds what stakeholders expect.
488
00:25:08,640 –> 00:25:11,560
If the gap widens, record it as a baseline shift.
489
00:25:11,560 –> 00:25:14,360
Fourth, align retention intent with reality.
490
00:25:14,360 –> 00:25:17,840
A retained and delete label preserves versions, not edits.
491
00:25:17,840 –> 00:25:21,680
If specific workflows demand granular checkpoints build process controls.
492
00:25:21,680 –> 00:25:26,640
Manual save cadence, single author windows or approvals into the work, not the policy.
493
00:25:26,640 –> 00:25:29,360
We closed the loop with one sentence for ourselves.
494
00:25:29,360 –> 00:25:34,320
The object we retain is the versioned artifact, not the lived sequence of edits.
495
00:25:34,320 –> 00:25:38,520
In this tenant today that artifact exists at a co-author resolution under load, so we
496
00:25:38,520 –> 00:25:39,520
ran it again.
497
00:25:39,520 –> 00:25:44,080
Different question, same tenant, not about creation anymore, about survival.
498
00:25:44,080 –> 00:25:47,040
Loop two, statement of question, survival.
499
00:25:47,040 –> 00:25:50,920
This loop isn’t about policy, it’s about survival.
500
00:25:50,920 –> 00:25:55,080
We kept the same retention policies, the same labels, the same sites.
501
00:25:55,080 –> 00:25:59,120
We changed the stressor, storage pressure, and cleanup cadence, we asked.
502
00:25:59,120 –> 00:26:04,040
What remains long enough to meet governance when low priority artifacts are removed
503
00:26:04,040 –> 00:26:07,880
earlier by operational forces?
504
00:26:07,880 –> 00:26:11,680
Expectation stated plainly, retention prevents loss until expiry.
505
00:26:11,680 –> 00:26:17,120
If retention is in scope, content should be preserved, even if users delete it.
506
00:26:17,120 –> 00:26:20,280
But SharePoint and OneDrive operate in a living system.
507
00:26:20,280 –> 00:26:27,320
Storage quotas, meeting recordings, large binary formats, and site hygiene jobs, exert gravity.
508
00:26:27,320 –> 00:26:30,000
We want to see what disappears before governance intersects.
509
00:26:30,000 –> 00:26:36,320
So we ran it again, we picked a team site that ingests frequent large files, design assets,
510
00:26:36,320 –> 00:26:41,280
test exports, meeting recordings, synced from channel meetings, so we tracked storage
511
00:26:41,280 –> 00:26:42,400
metrics daily.
512
00:26:42,400 –> 00:26:45,640
We confirmed no priority cleanup policies were active.
513
00:26:45,640 –> 00:26:51,320
We verified that standard recycle behavior and the 93 day window were intact.
514
00:26:51,320 –> 00:26:56,120
We logged URL events for deletions and sized deltas, we left retention holds off to observe
515
00:26:56,120 –> 00:26:57,640
the baseline current.
516
00:26:57,640 –> 00:27:03,760
When we started a simple routine, create, upload, minor change, and delete low value variants
517
00:27:03,760 –> 00:27:07,160
while preserving high value primaries.
518
00:27:07,160 –> 00:27:09,000
Observation arrived quietly.
519
00:27:09,000 –> 00:27:13,040
Some low priority items vanished from user view on schedule.
520
00:27:13,040 –> 00:27:17,160
That was expected, the recycle been collected them, but the timing of operational cleanups
521
00:27:17,160 –> 00:27:22,640
in adjacent areas, the meeting recording folders, the personal OneDrive spillover for temporary
522
00:27:22,640 –> 00:27:28,720
work meant certain items never aged long enough to be meaningful in corpus growth.
523
00:27:28,720 –> 00:27:34,160
They were created and removed well before any review or governance policy made them matter
524
00:27:34,160 –> 00:27:36,200
to discovery or to business memory.
525
00:27:36,200 –> 00:27:38,480
They survived less than the attention window.
526
00:27:38,480 –> 00:27:39,760
We controlled for error.
527
00:27:39,760 –> 00:27:45,600
We checked the phl for the site after the first delet under retention for a labeled library.
528
00:27:45,600 –> 00:27:51,200
Preserved copies existed where retention applied, but outside labeled scopes or where labels
529
00:27:51,200 –> 00:27:56,600
were auto applied with delays, pre-governance deletions reduced the visible set.
530
00:27:56,600 –> 00:28:00,680
The policy did not fail, the item never lived where the policy could observe it long enough
531
00:28:00,680 –> 00:28:01,880
to matter.
532
00:28:01,880 –> 00:28:03,520
We slowed the cadence.
533
00:28:03,520 –> 00:28:07,160
We extended the lifespan of temporary files to a week.
534
00:28:07,160 –> 00:28:11,480
We repeated, survival improved, more items intersected retention.
535
00:28:11,480 –> 00:28:16,520
The phl footprint grew, but the pattern held anything routinely created and removed inside
536
00:28:16,520 –> 00:28:22,280
smaller operational windows, contributed noise to activity and zero to governance outcomes.
537
00:28:22,280 –> 00:28:27,000
Our dashboard stayed green, our corpus stayed deceptively lean, so we widened the lens to
538
00:28:27,000 –> 00:28:28,320
storage pressure.
539
00:28:28,320 –> 00:28:32,920
We watched OneDrive sites nearing quota where users were prompted to clean up.
540
00:28:32,920 –> 00:28:39,200
We saw manual purges and sync client behaviors removed temporary data fast.
541
00:28:39,200 –> 00:28:46,080
Insights with active housekeeping habits, low priority artifacts were gone in hours or days.
542
00:28:46,080 –> 00:28:50,120
Retention labels applied to designated libraries worked.
543
00:28:50,120 –> 00:28:52,160
Unlabeled areas were transient.
544
00:28:52,160 –> 00:28:55,800
Now this is important because survival happens before governance.
545
00:28:55,800 –> 00:29:01,080
If cleanup, manual or automated, user or operational occurs before retention applies, governance
546
00:29:01,080 –> 00:29:04,120
measures success on a reduced set.
547
00:29:04,120 –> 00:29:07,880
You can’t retain what no longer exists long enough to be retained.
548
00:29:07,880 –> 00:29:09,200
We marked action.
549
00:29:09,200 –> 00:29:14,760
Map pre-governance deletions zones, recordings temp exports cash-like libraries.
550
00:29:14,760 –> 00:29:16,800
User hitrates for retention in those zones.
551
00:29:16,800 –> 00:29:22,200
If the hit rate is low, either extend lifespan until retention intersects or move the content
552
00:29:22,200 –> 00:29:25,080
into governed locations by default.
553
00:29:25,080 –> 00:29:26,520
Then monitor the variance.
554
00:29:26,520 –> 00:29:30,840
If survival declines, expect discovery flatlines even as activity climbs.
555
00:29:30,840 –> 00:29:32,000
So we ran it again.
556
00:29:32,000 –> 00:29:34,240
Same tenant, same policies.
557
00:29:34,240 –> 00:29:38,760
Next loop, evidence, loop two, evidence pre-governance cleanup.
558
00:29:38,760 –> 00:29:41,840
We needed proof that survival happens before governance.
559
00:29:41,840 –> 00:29:43,400
So we ran it again.
560
00:29:43,400 –> 00:29:46,880
Next we reconciled purview definitions against what we were watching.
561
00:29:46,880 –> 00:29:48,800
The policy text was clear.
562
00:29:48,800 –> 00:29:51,360
Retain then delete on scoped libraries.
563
00:29:51,360 –> 00:29:53,800
Labels auto applied where queries matched.
564
00:29:53,800 –> 00:29:55,360
No preservation lock.
565
00:29:55,360 –> 00:29:57,160
Priority cleanup was not enabled.
566
00:29:57,160 –> 00:29:59,840
That’s when we realized definitions alone.
567
00:29:59,840 –> 00:30:02,440
Don’t describe execution order.
568
00:30:02,440 –> 00:30:08,400
Cleanup jobs, user purges and app-specific life cycles can act earlier.
569
00:30:08,400 –> 00:30:11,760
We had to correlate events, not rely on policy text.
570
00:30:11,760 –> 00:30:16,120
So we instrumented approval and simulation paths without turning them on.
571
00:30:16,120 –> 00:30:22,280
We drafted a priority cleanup scope for recordings and temp export libraries, then stopped at simulation.
572
00:30:22,280 –> 00:30:24,040
The simulation previewed matches.
573
00:30:24,040 –> 00:30:29,040
It showed exactly the classes of files we already saw disappearing under user cleanup pressure.
574
00:30:29,040 –> 00:30:30,360
No action executed.
575
00:30:30,360 –> 00:30:32,600
The preview gave us a target set to watch.
576
00:30:32,600 –> 00:30:33,600
The outcome was correct.
577
00:30:33,600 –> 00:30:34,600
So we ran it again.
578
00:30:34,600 –> 00:30:36,640
We pinned audit event sequences.
579
00:30:36,640 –> 00:30:44,320
We added audit log queries filtered for file uploaded, file modified, file deleted, plus sharepoint
580
00:30:44,320 –> 00:30:47,560
file operation for recycle transitions.
581
00:30:47,560 –> 00:30:50,040
We added team’s meeting artifacts.
582
00:30:50,040 –> 00:30:54,040
Stream video creates for channel meetings that now land in sharepoint.
583
00:30:54,040 –> 00:30:56,680
We synchronized these with storage metrics deltas.
584
00:30:56,680 –> 00:30:58,240
The pattern emerged.
585
00:30:58,240 –> 00:31:01,760
Upload events for large files clustered around meetings.
586
00:31:01,760 –> 00:31:03,360
Deletes followed hours later.
587
00:31:03,360 –> 00:31:07,240
All bin events logged.
588
00:31:07,240 –> 00:31:10,320
The life cycle completed inside a one-to-three-day window.
589
00:31:10,320 –> 00:31:15,840
Now this is important because the retention label auto-apply policy had its own cadence.
590
00:31:15,840 –> 00:31:18,680
Up to seven days for policy distribution.
591
00:31:18,680 –> 00:31:21,720
Background scanner cycles to stamp items.
592
00:31:21,720 –> 00:31:24,640
Even auto-apply can arrive too late for quick-lived artifacts.
593
00:31:24,640 –> 00:31:29,800
We verified by listing item properties for a recording kept intentionally for five days.
594
00:31:29,800 –> 00:31:31,600
The label appeared on day three.
595
00:31:31,600 –> 00:31:35,240
For recordings perched by day two, no label ever applied.
596
00:31:35,240 –> 00:31:37,520
Governance measured green on the items it saw.
597
00:31:37,520 –> 00:31:39,320
The set excluded most recordings.
598
00:31:39,320 –> 00:31:40,800
So we moved to storage metrics.
599
00:31:40,800 –> 00:31:46,240
For the site’s recordings and temp exports folders, we plotted size over two weeks.
600
00:31:46,240 –> 00:31:51,000
The curves spiked after meeting heavy days, then flattened within 48 hours as users cleaned
601
00:31:51,000 –> 00:31:52,000
up.
602
00:31:52,000 –> 00:31:57,280
Libraries under labeled scope had slower stair-step declines, reflecting phl copies and
603
00:31:57,280 –> 00:31:58,920
recycle retention.
604
00:31:58,920 –> 00:32:01,640
We enabled areas returned to baseline quickly.
605
00:32:01,640 –> 00:32:02,960
We reconciled counts.
606
00:32:02,960 –> 00:32:05,280
The dip preceded any retention action.
607
00:32:05,280 –> 00:32:08,080
Survival ended before governance started.
608
00:32:08,080 –> 00:32:12,400
That’s when we realized our green reports were sampling the quiet horizon after the tide
609
00:32:12,400 –> 00:32:13,480
receded.
610
00:32:13,480 –> 00:32:16,160
We needed to isolate e-discovery’s perspective.
611
00:32:16,160 –> 00:32:20,760
So we ran weekly identical KQL across identical custodians.
612
00:32:20,760 –> 00:32:23,520
Names, paths and a date window covering the meetings.
613
00:32:23,520 –> 00:32:25,360
Execution times stayed flat.
614
00:32:25,360 –> 00:32:29,520
Count stabilized ignoring the weekly search of temp content.
615
00:32:29,520 –> 00:32:30,520
Not a bug.
616
00:32:30,520 –> 00:32:31,520
A scope artifact.
617
00:32:31,520 –> 00:32:35,760
Custodian scoping didn’t include the channel’s share point location for recordings.
618
00:32:35,760 –> 00:32:40,080
Even after we added it, the files that vanished in two days rarely intersected the query
619
00:32:40,080 –> 00:32:43,160
because they were gone by collection day.
620
00:32:43,160 –> 00:32:46,440
Search consistency wasn’t proof of scope consistency.
621
00:32:46,440 –> 00:32:48,280
We documented it.
622
00:32:48,280 –> 00:32:54,000
Next we verified preservation hold library behavior in mixed zones.
623
00:32:54,000 –> 00:32:58,760
We performed a control delete in a labeled library adjacent to the unlabeled recordings
624
00:32:58,760 –> 00:32:59,760
folder.
625
00:32:59,760 –> 00:33:02,600
The phl received the preserved copy.
626
00:33:02,600 –> 00:33:08,280
In the recordings folder, a user initiated delete sent the file to first stage recycle
627
00:33:08,280 –> 00:33:16,000
then on towards second stage without phl because no label or site policy covered that folder.
628
00:33:16,000 –> 00:33:20,640
Two neighboring zones, different survival paths, same tenant.
629
00:33:20,640 –> 00:33:22,080
The outcome was correct.
630
00:33:22,080 –> 00:33:28,400
We examined approval workflows and audit events to see if no violation logged meant no problem.
631
00:33:28,400 –> 00:33:29,640
It did.
632
00:33:29,640 –> 00:33:33,760
Governance saw less because the environment produced less that intersected governance.
633
00:33:33,760 –> 00:33:35,680
There was nothing to alert on.
634
00:33:35,680 –> 00:33:39,760
Compliance manager state green, the dashboards were flat, the logs were clean, the behavior
635
00:33:39,760 –> 00:33:40,760
had changed.
636
00:33:40,760 –> 00:33:44,280
The system’s silence was a byproduct of filtration by timing.
637
00:33:44,280 –> 00:33:47,560
Edge cases confirmed it, one drives spillover.
638
00:33:47,560 –> 00:33:52,120
Users exported test data to personal work areas, ran minor manipulations and cleared them
639
00:33:52,120 –> 00:33:53,640
before weeks end.
640
00:33:53,640 –> 00:33:58,400
The retention policies covering one drive apply to all accounts, but auto apply labels
641
00:33:58,400 –> 00:33:59,400
lagged.
642
00:33:59,400 –> 00:34:04,520
phl appeared only after the first delete under retention and for fast rotations that first
643
00:34:04,520 –> 00:34:07,280
delete happened before policies even evaluated.
644
00:34:07,280 –> 00:34:11,080
We reconciled mailbox notifications to users about nearing quotas.
645
00:34:11,080 –> 00:34:14,120
Clean up behavior increased immediately after prompts.
646
00:34:14,120 –> 00:34:16,960
The corpus thinned where governance hadn’t yet looked.
647
00:34:16,960 –> 00:34:22,080
We validated that holds versus clean up precedence wasn’t the issue here because we deliberately
648
00:34:22,080 –> 00:34:25,760
avoided holds in this loop holds would have changed outcomes.
649
00:34:25,760 –> 00:34:30,760
Our point was simpler, when survival windows are shorter than governance clocks, retention
650
00:34:30,760 –> 00:34:33,040
success does not equal data survival.
651
00:34:33,040 –> 00:34:37,160
We repeated the test with a simple admin approval gate for simulated cleanup.
652
00:34:37,160 –> 00:34:38,160
Nothing executed.
653
00:34:38,160 –> 00:34:43,800
Still, users removed items faster than governance observed them.
654
00:34:43,800 –> 00:34:49,480
One told us what would be targeted, user behavior showed what was already gone.
655
00:34:49,480 –> 00:34:55,760
We plotted a simple matrix, location type, label presence, average lifespan, policy propagation
656
00:34:55,760 –> 00:35:02,560
age and discovery inclusion, labeled library with stable content, lifespan exceeded propagation,
657
00:35:02,560 –> 00:35:09,720
retained and discoverable, unlabeled recordings, short lifespan under propagation window often
658
00:35:09,720 –> 00:35:12,240
absent from discovery.
659
00:35:12,240 –> 00:35:18,840
Type exports lifespan variable frequently under three days low discovery hit rate.
660
00:35:18,840 –> 00:35:24,800
One drive transient work under a week label arrival inconsistent, survivability low.
661
00:35:24,800 –> 00:35:28,720
Proof checkpoint this proves retention success does not equal data survival.
662
00:35:28,720 –> 00:35:29,920
The policy didn’t fail.
663
00:35:29,920 –> 00:35:34,600
The artifacts didn’t persist long enough to be governed and discovery inherited a leaner
664
00:35:34,600 –> 00:35:35,800
corpus.
665
00:35:35,800 –> 00:35:40,560
When everything is green after cleanup, we measured repetition, not reality.
666
00:35:40,560 –> 00:35:46,120
So we ran it again armed with a constraint, extend the survival window or move the content
667
00:35:46,120 –> 00:35:49,200
into governed scopes at birth.
668
00:35:49,200 –> 00:35:55,480
Then remeasure storage matrix deltas should linger, ph.l. footprints should grow proportionally
669
00:35:55,480 –> 00:35:59,440
and e-discovery counts should reflect the previously missing classes.
670
00:35:59,440 –> 00:36:01,880
If they don’t, stability still filtration.
671
00:36:01,880 –> 00:36:04,720
The outcome was correct, the behavior had changed.
672
00:36:04,720 –> 00:36:07,520
Loop 2 realization you can’t retain what’s gone.
673
00:36:07,520 –> 00:36:09,840
You can’t retain what no longer exists.
674
00:36:09,840 –> 00:36:14,120
The policy didn’t fail, the artifacts evaporated before the policy could see them.
675
00:36:14,120 –> 00:36:17,320
That’s not a permission story, that’s an order of operation story.
676
00:36:17,320 –> 00:36:19,600
The tenant stayed green, the outcome was correct.
677
00:36:19,600 –> 00:36:24,480
So we ran it again, we reread the acceptance criteria we set earlier and marked the hidden
678
00:36:24,480 –> 00:36:26,320
dependencies.
679
00:36:26,320 –> 00:36:32,920
Retention assumes time, discovery assumes presence, cleanup, human or automated erases both.
680
00:36:32,920 –> 00:36:36,440
We realized our success measurements were taken after reduction.
681
00:36:36,440 –> 00:36:39,520
Post reduction success looks like control, but it’s filtration.
682
00:36:39,520 –> 00:36:44,680
When we realized stability was a symptom, quiet dashboards didn’t mean a quiet system,
683
00:36:44,680 –> 00:36:46,040
they meant a smaller corpus.
684
00:36:46,040 –> 00:36:49,560
We weren’t enforcing, we were measuring what survived the churn.
685
00:36:49,560 –> 00:36:52,040
So we turned realization into procedure.
686
00:36:52,040 –> 00:36:55,120
First we separated governance clocks from survival clocks.
687
00:36:55,120 –> 00:37:01,200
We listed each mechanism with its cadence, retention policy propagation up to seven days,
688
00:37:01,200 –> 00:37:07,160
auto-apply label evaluation on background cycles, ph.l. creation on first relevant delete
689
00:37:07,160 –> 00:37:10,440
or edit recycle bins at 93 days.
690
00:37:10,440 –> 00:37:15,640
Then we listed operational clocks, use a cleanup within hours, meeting recording purges
691
00:37:15,640 –> 00:37:20,040
within days, one drive quota prompts causing same-day deletions.
692
00:37:20,040 –> 00:37:25,200
The overlap was thin, that gap is where preservation loses.
693
00:37:25,200 –> 00:37:26,880
Second we reframed green.
694
00:37:26,880 –> 00:37:32,000
On success means the engine is available, not that it intersected the data we care about.
695
00:37:32,000 –> 00:37:35,520
We annotated each success with a coverage note.
696
00:37:35,520 –> 00:37:40,200
We listed locations versus ungoverned long-lived artifacts versus short-lived.
697
00:37:40,200 –> 00:37:43,080
We stopped accepting generic compliance percentages.
698
00:37:43,080 –> 00:37:46,240
We asked which classes of content drove this score.
699
00:37:46,240 –> 00:37:49,200
Third we traced pre-governance deletion like an incident.
700
00:37:49,200 –> 00:37:52,400
We treated every quick-lived class as if it were a near miss.
701
00:37:52,400 –> 00:37:58,040
We wrote a brief for recordings, temp exports and one drive tinkering, location, average
702
00:37:58,040 –> 00:38:03,200
lifespan, label arrival timing, evidence of discovery inclusion.
703
00:38:03,200 –> 00:38:06,520
We published it to the stakeholders who thought retention was universal.
704
00:38:06,520 –> 00:38:09,080
Fourth we defined a triage decision.
705
00:38:09,080 –> 00:38:13,720
If the business needs these artifacts discoverable or restorable, change the birth location
706
00:38:13,720 –> 00:38:19,520
or lengthen the survival window, if not accept that they will never enter governance
707
00:38:19,520 –> 00:38:21,880
and document that reality.
708
00:38:21,880 –> 00:38:24,760
No more implied promises about everything is retained.
709
00:38:24,760 –> 00:38:29,280
We then set actionable we could test without building new tools.
710
00:38:29,280 –> 00:38:35,440
And a simple survival hit rate, percent of items in a target location that receive a retention
711
00:38:35,440 –> 00:38:37,160
label before deletion.
712
00:38:37,160 –> 00:38:38,160
Track weekly.
713
00:38:38,160 –> 00:38:42,000
If it trends down, governance is drifting away from activity.
714
00:38:42,000 –> 00:38:47,920
Audit the classes that never reach retention, execute UAL based counts versus label presence
715
00:38:47,920 –> 00:38:50,280
for recordings and temp exports.
716
00:38:50,280 –> 00:38:57,000
If label presence remains low, either move creation into labeled scopes or enforce minimum
717
00:38:57,000 –> 00:38:58,560
lifespan.
718
00:38:58,560 –> 00:39:03,280
Activate and increase internal standards for content types with compliance expectations
719
00:39:03,280 –> 00:39:10,040
either ensure governed locations at creation or require a minimum holding period that exceeds
720
00:39:10,040 –> 00:39:12,320
label evaluation cycles.
721
00:39:12,320 –> 00:39:14,840
Add a reconciliation step to discovery.
722
00:39:14,840 –> 00:39:19,040
When counts are flat, compare against UAL activity for the same custodial scope.
723
00:39:19,040 –> 00:39:25,080
If activity rises while discovery stays flat, assume survival loss and investigate order
724
00:39:25,080 –> 00:39:26,280
of operations.
725
00:39:26,280 –> 00:39:29,320
We wrote one quiet directive for ourselves.
726
00:39:29,320 –> 00:39:31,240
Clean up is continuous.
727
00:39:31,240 –> 00:39:32,760
Retention is periodic.
728
00:39:32,760 –> 00:39:39,240
If survival ends before governance starts, compliance success is sampling the quiet.
729
00:39:39,240 –> 00:39:42,000
So we ran it again with a single variable changed.
730
00:39:42,000 –> 00:39:46,480
We forced recordings to land in a labeled library, the label applied at birth.
731
00:39:46,480 –> 00:39:48,960
The phl appeared on first delet.
732
00:39:48,960 –> 00:39:53,680
Weekly discoveries saw them before users removed them, counts rows, then declined along
733
00:39:53,680 –> 00:39:54,880
a governed path.
734
00:39:54,880 –> 00:39:56,920
The dashboard was still green.
735
00:39:56,920 –> 00:40:00,280
This time the green described behavior, not aftermath.
736
00:40:00,280 –> 00:40:03,440
We closed the loop with a constraint we can verify.
737
00:40:03,440 –> 00:40:08,160
If pre-governance deletion is a class behavior, then reducing it should raise discovery counts,
738
00:40:08,160 –> 00:40:11,640
phl footprints and storage metrics dwell time in that class.
739
00:40:11,640 –> 00:40:16,280
If those don’t move, after we change the birth location or lifespan, the filtration moved
740
00:40:16,280 –> 00:40:17,280
somewhere else.
741
00:40:17,280 –> 00:40:19,160
That’s the drift to chase next.
742
00:40:19,160 –> 00:40:20,360
So we ran it again.
743
00:40:20,360 –> 00:40:22,640
Same tenant, same policies, different question.
744
00:40:22,640 –> 00:40:24,800
What does discovery think it’s seeing?
745
00:40:24,800 –> 00:40:28,280
Type 3, statement of question, discovery.
746
00:40:28,280 –> 00:40:30,920
This time the question is discovery itself.
747
00:40:30,920 –> 00:40:32,600
We kept identical KQL.
748
00:40:32,600 –> 00:40:34,640
We kept the same custodians.
749
00:40:34,640 –> 00:40:39,800
The tenant’s data grew, our expectation, execution time and result counts should scale
750
00:40:39,800 –> 00:40:45,960
with growth, or we should be able to explain any countervailing scope filters.
751
00:40:45,960 –> 00:40:51,520
If the numbers stay flat without cause, discovery is inheriting a reduced corpus from creation
752
00:40:51,520 –> 00:40:52,600
and survival.
753
00:40:52,600 –> 00:40:53,520
So we ran it again.
754
00:40:53,520 –> 00:40:54,800
We opened the same case.
755
00:40:54,800 –> 00:40:59,760
We duplicated last week’s search and left every field unchanged keywords, paths, date range,
756
00:40:59,760 –> 00:41:00,760
custodians.
757
00:41:00,760 –> 00:41:02,360
We triggered statistics first.
758
00:41:02,360 –> 00:41:06,040
The processing graph drew a familiar shape, time to first estimate steady.
759
00:41:06,040 –> 00:41:07,920
Total hits close to last week.
760
00:41:07,920 –> 00:41:11,360
The tenant added content, but our counts didn’t reflect it.
761
00:41:11,360 –> 00:41:12,680
Not zero change.
762
00:41:12,680 –> 00:41:17,480
Just stabilized sets that ignored the visible activity we saw in the logs.
763
00:41:17,480 –> 00:41:18,680
We controlled for the obvious.
764
00:41:18,680 –> 00:41:23,280
We verified advanced indexing wasn’t still chewing on partially indexed items.
765
00:41:23,280 –> 00:41:25,280
The case showed no pending flags.
766
00:41:25,280 –> 00:41:28,100
We spot checked new content created during the week.
767
00:41:28,100 –> 00:41:29,100
Items were fully indexed.
768
00:41:29,100 –> 00:41:31,280
We didn’t see partially indexed warnings.
769
00:41:31,280 –> 00:41:32,600
The outcome was correct.
770
00:41:32,600 –> 00:41:35,000
So we ran it again with a wide scope.
771
00:41:35,000 –> 00:41:36,720
We added the share point locations.
772
00:41:36,720 –> 00:41:39,360
We knew how’s the transient classes.
773
00:41:39,360 –> 00:41:41,440
Recording exports.
774
00:41:41,440 –> 00:41:43,000
Execution time stayed flat.
775
00:41:43,000 –> 00:41:44,480
Counts barely moved.
776
00:41:44,480 –> 00:41:48,760
When we sampled the hits, we saw older items that had survived previous windows.
777
00:41:48,760 –> 00:41:50,160
The fresh search was absent.
778
00:41:50,160 –> 00:41:54,640
That’s when we realized discovery was faithfully searching what existed now, not what existed
779
00:41:54,640 –> 00:41:55,640
then.
780
00:41:55,640 –> 00:41:57,560
Stability reflected survival’s filtration.
781
00:41:57,560 –> 00:41:59,080
We narrowed the lens next.
782
00:41:59,080 –> 00:42:02,440
We built a search scope only to the burst library from loop one.
783
00:42:02,440 –> 00:42:06,640
We expected a gentle increase because we created and kept specific files.
784
00:42:06,640 –> 00:42:09,800
Counts rose by exactly the number of items we retained.
785
00:42:09,800 –> 00:42:13,080
None of the quick-lived variants that never received labels appeared.
786
00:42:13,080 –> 00:42:14,840
Search consistency was intact.
787
00:42:14,840 –> 00:42:17,640
Scope consistency depended on upstream behavior.
788
00:42:17,640 –> 00:42:19,880
We planted a small micro story.
789
00:42:19,880 –> 00:42:24,760
Last week, someone asked why their weekly legal search never picked up meeting recordings
790
00:42:24,760 –> 00:42:26,000
that clearly happened.
791
00:42:26,000 –> 00:42:30,160
We showed them the survival matrix and the order of operations clocks.
792
00:42:30,160 –> 00:42:35,440
When we re-homed recordings into governed locations, their next run included them.
793
00:42:35,440 –> 00:42:39,320
That’s the power of aligning discovery with creation and survival.
794
00:42:39,320 –> 00:42:41,200
We added a procedural dial.
795
00:42:41,200 –> 00:42:46,720
We exported items reports for the search, sorted by location and created date, and compared
796
00:42:46,720 –> 00:42:50,640
to UAL counts for uploads in the same custodial window.
797
00:42:50,640 –> 00:42:56,720
The ratio, discoverable items to created items, held steady for governed libraries and
798
00:42:56,720 –> 00:42:58,520
wandered for transient zones.
799
00:42:58,520 –> 00:43:00,920
We wrote it down as a discovery coverage ratio.
800
00:43:00,920 –> 00:43:01,920
We will track it.
801
00:43:01,920 –> 00:43:04,040
We asked the second discovery question.
802
00:43:04,040 –> 00:43:07,440
Does execution time track scope growth?
803
00:43:07,440 –> 00:43:11,720
We locked execution profiles for the same KQL over four weeks.
804
00:43:11,720 –> 00:43:16,680
The durations varied within a narrow band, even when the tenant added many items.
805
00:43:16,680 –> 00:43:22,400
We cross-checked with statistics on data sizes, review sets and exports finished in the expected
806
00:43:22,400 –> 00:43:23,400
windows.
807
00:43:23,400 –> 00:43:24,400
The system was fast.
808
00:43:24,400 –> 00:43:27,240
It just wasn’t broad when the corpus shrank upstream.
809
00:43:27,240 –> 00:43:31,520
That’s when we realized we were using performance stability as a comfort signal.
810
00:43:31,520 –> 00:43:33,280
It was a scope signal in disguise.
811
00:43:33,280 –> 00:43:35,040
We documented one more constraint.
812
00:43:35,040 –> 00:43:40,080
Premium review sets capture items as they exist at collection time.
813
00:43:40,080 –> 00:43:45,120
They don’t invent compressed micro states that never became versions.
814
00:43:45,120 –> 00:43:51,520
If loop ones consolidation created coarser versions, loop threes review sets inherit those coarser
815
00:43:51,520 –> 00:43:52,520
states.
816
00:43:52,520 –> 00:43:57,280
If loop two survival ended early loop threes collection never sees it, discovery is the
817
00:43:57,280 –> 00:43:58,280
mirror.
818
00:43:58,280 –> 00:44:00,120
It reflects what the platform considers real.
819
00:44:00,120 –> 00:44:03,120
Our job is to align that reality with intent.
820
00:44:03,120 –> 00:44:05,560
We close the statement with our working test.
821
00:44:05,560 –> 00:44:08,400
For any recurring search, track three numbers.
822
00:44:08,400 –> 00:44:14,840
Upload activity for the scope window, the discovery coverage ratio and execution duration.
823
00:44:14,840 –> 00:44:20,440
If activity rises while coverage stays flat and duration holds steady, discovery is stable
824
00:44:20,440 –> 00:44:22,800
because scope is quietly narrower.
825
00:44:22,800 –> 00:44:23,800
That’s not failure.
826
00:44:23,800 –> 00:44:26,600
That’s the inherited meaning from creation and survival.
827
00:44:26,600 –> 00:44:27,600
So we run it again.
828
00:44:27,600 –> 00:44:29,400
Same KQL, same custodians.
829
00:44:29,400 –> 00:44:34,480
This time we expect the next loop to show us the evidence in discovery scope drift.
830
00:44:34,480 –> 00:44:35,480
Loop three.
831
00:44:35,480 –> 00:44:37,120
Evidence scope drift in discovery.
832
00:44:37,120 –> 00:44:38,120
So we ran it again.
833
00:44:38,120 –> 00:44:40,600
We reconstructed the case history.
834
00:44:40,600 –> 00:44:42,120
Identical KQL.
835
00:44:42,120 –> 00:44:43,280
Identical custodians.
836
00:44:43,280 –> 00:44:45,920
So weekly executions captured and archived.
837
00:44:45,920 –> 00:44:48,520
The processing profiles looked the same.
838
00:44:48,520 –> 00:44:50,000
Indexing complete.
839
00:44:50,000 –> 00:44:51,240
Statistics populated.
840
00:44:51,240 –> 00:44:53,040
No partial items flagged.
841
00:44:53,040 –> 00:44:54,320
The outcome was correct.
842
00:44:54,320 –> 00:44:57,200
That’s when we realized the profile sameness wasn’t comfort.
843
00:44:57,200 –> 00:44:58,360
It was a clue.
844
00:44:58,360 –> 00:45:04,600
We replayed the searches side by side and added one instrument, a data source ledger.
845
00:45:04,600 –> 00:45:10,080
For each run we enumerated locations, mailboxes, one drive accounts, sharepoint sites, teams
846
00:45:10,080 –> 00:45:13,960
connected libraries, then mapped which subsets actually returned hits.
847
00:45:13,960 –> 00:45:17,040
Week one, the ledger flagged eight locations with results.
848
00:45:17,040 –> 00:45:20,720
Week four, with the same scope declared the hits concentrated into five.
849
00:45:20,720 –> 00:45:22,880
The locations were still in scope.
850
00:45:22,880 –> 00:45:24,520
They just didn’t contribute.
851
00:45:24,520 –> 00:45:27,000
Survival had thinned them before we arrived.
852
00:45:27,000 –> 00:45:28,800
Discovery didn’t drift on its own.
853
00:45:28,800 –> 00:45:31,760
Its effective scope had narrowed through upstream behavior.
854
00:45:31,760 –> 00:45:35,200
We validated with statistics versus exports.
855
00:45:35,200 –> 00:45:36,960
Statistics told us items matched.
856
00:45:36,960 –> 00:45:39,680
Exports told us what items survived the path to review.
857
00:45:39,680 –> 00:45:41,480
We compared counts.
858
00:45:41,480 –> 00:45:43,520
Statistics 1.2.74.
859
00:45:43,520 –> 00:45:44,920
Export 1.2.71.
860
00:45:44,920 –> 00:45:46,440
That delta was noise.
861
00:45:46,440 –> 00:45:48,680
But the per location breakdown showed the drift.
862
00:45:48,680 –> 00:45:54,760
The three disappearing locations delivered zero items in week four, not because search failed,
863
00:45:54,760 –> 00:45:59,720
but because the corpus in those locations self-minimized through creation compression and
864
00:45:59,720 –> 00:46:01,200
pre-governance cleanup.
865
00:46:01,200 –> 00:46:02,640
We reconciled with audit.
866
00:46:02,640 –> 00:46:06,680
UAL showed weekly file uploaded bursts in those locations.
867
00:46:06,680 –> 00:46:08,920
Discoveries hit maps ignored them a few days later.
868
00:46:08,920 –> 00:46:13,600
The time enclosed the loop, we turned on advanced indexing awareness.
869
00:46:13,600 –> 00:46:19,960
Premium cases handle partially indexed items automatically during search, review set add,
870
00:46:19,960 –> 00:46:21,120
or export.
871
00:46:21,120 –> 00:46:26,400
We forced a run with the include partially indexed toggle to verify there wasn’t hidden
872
00:46:26,400 –> 00:46:27,400
backlog.
873
00:46:27,400 –> 00:46:31,400
Counts moved by low single digits, not enough to change the story.
874
00:46:31,400 –> 00:46:36,480
Advanced indexing didn’t rescue content that never existed by the time we queried.
875
00:46:36,480 –> 00:46:38,400
It confirmed the platform was caught up.
876
00:46:38,400 –> 00:46:41,840
The outcome was correct, we scrutinized review set behavior.
877
00:46:41,840 –> 00:46:47,160
We added the weekly results to a rolling review set, then applied analytics, near duplicates,
878
00:46:47,160 –> 00:46:49,200
email threading and clustering.
879
00:46:49,200 –> 00:46:50,720
The reductions were normal.
880
00:46:50,720 –> 00:46:55,720
But the item universe feeding the review set reflected the same narrowing, fewer sources
881
00:46:55,720 –> 00:46:59,280
contributing even as overall tenant activity climbed.
882
00:46:59,280 –> 00:47:02,920
We tagged items by location and age at collection.
883
00:47:02,920 –> 00:47:10,040
Examples from governed libraries, skewed younger, items from transient zones skewed older,
884
00:47:10,040 –> 00:47:13,720
because only the occasional outlier survived long enough to be collected.
885
00:47:13,720 –> 00:47:16,560
That’s scope drift in practical terms.
886
00:47:16,560 –> 00:47:19,920
Discovery sees what persists, not what occurred.
887
00:47:19,920 –> 00:47:22,880
Custodian scoping next we confirmed the custodians hadn’t changed.
888
00:47:22,880 –> 00:47:28,240
We then expanded to frequent collaborators as a sanity check, a premium feature that maps,
889
00:47:28,240 –> 00:47:30,480
a adjacency around custodians.
890
00:47:30,480 –> 00:47:36,480
The collaborator clouded, grew over four weeks, but the added nodes brought little incremental
891
00:47:36,480 –> 00:47:37,960
content into the set.
892
00:47:37,960 –> 00:47:38,960
Why?
893
00:47:38,960 –> 00:47:41,560
The collaborators worked heavily in transient areas.
894
00:47:41,560 –> 00:47:44,480
Their contributions evaporated before the weekly collection.
895
00:47:44,480 –> 00:47:45,480
We saved that map.
896
00:47:45,480 –> 00:47:47,640
It looked like reach, it behaved like loss.
897
00:47:47,640 –> 00:47:49,960
Teams artifacts needed their own pass.
898
00:47:49,960 –> 00:47:55,320
We added team and channel locations explicitly, including the SharePoint folders that store
899
00:47:55,320 –> 00:48:01,320
channel files and the recordings library where we had adjusted the birth location in a subset.
900
00:48:01,320 –> 00:48:07,400
Where we re-homed recordings into labelled governed locations, discovery picked them up reliably.
901
00:48:07,400 –> 00:48:12,200
Where we left the defaults, two patterns emerged, items older than our weekly cadence sometimes
902
00:48:12,200 –> 00:48:14,880
appeared, but the weekly surge did not.
903
00:48:14,880 –> 00:48:16,280
Scope drift wasn’t uniform.
904
00:48:16,280 –> 00:48:21,760
It traced configuration choices, so we then sliced by deleted and trimmed content behavior.
905
00:48:21,760 –> 00:48:27,440
We tested version handling impacts by querying for items with multiple versions within the
906
00:48:27,440 –> 00:48:30,040
date window using metadata filters.
907
00:48:30,040 –> 00:48:35,720
The subset that rose into the review set represented consolidated versions from the creation
908
00:48:35,720 –> 00:48:37,240
loop.
909
00:48:37,240 –> 00:48:39,120
Discovery did not reflect micro steps.
910
00:48:39,120 –> 00:48:41,560
It reflected the version grain we had.
911
00:48:41,560 –> 00:48:44,240
That confirmed inheritance from loop one.
912
00:48:44,240 –> 00:48:49,960
Search consistency does not equal scope consistency where creation compresses state.
913
00:48:49,960 –> 00:48:56,640
We introduced a control, a static site used for policy documents, with strict single author
914
00:48:56,640 –> 00:48:59,800
edit windows and enforced manual saves.
915
00:48:59,800 –> 00:49:02,800
No auto-save churn, no quick deletes.
916
00:49:02,800 –> 00:49:08,800
Weekly discovery counts from that site increased linearly with content additions.
917
00:49:08,800 –> 00:49:15,800
Execution times for the overall KQL increased marginally when we added that site’s growth.
918
00:49:15,800 –> 00:49:19,520
Everywhere else time was flat because effective scope was thin.
919
00:49:19,520 –> 00:49:24,560
Formant stability mapped to stability in effective scope, not tenant growth.
920
00:49:24,560 –> 00:49:26,520
We went back to the items reports.
921
00:49:26,520 –> 00:49:34,880
We added two computed fields, created to collected latency and location survival class.
922
00:49:34,880 –> 00:49:36,560
Governt transient spillover.
923
00:49:36,560 –> 00:49:40,240
Latency clustered under three days for governed sites.
924
00:49:40,240 –> 00:49:44,080
Clustered at NA for transient because most items never arrived.
925
00:49:44,080 –> 00:49:47,800
We charted the discovery coverage ratio over four weeks.
926
00:49:47,800 –> 00:49:51,840
And 82, 83, 81, 84.
927
00:49:51,840 –> 00:49:55,640
Transient 21, 18, 19, 17.
928
00:49:55,640 –> 00:50:00,360
The ratio trended down in transient zones as user cleanup accelerated with quota prompts
929
00:50:00,360 –> 00:50:02,120
that’s measurable scope drift.
930
00:50:02,120 –> 00:50:05,480
We stress tested by widening date ranges retroactively.
931
00:50:05,480 –> 00:50:08,880
We pulled a month instead of a week than another month of set.
932
00:50:08,880 –> 00:50:14,040
Longer windows increased counts, but they backfilled only what survived longer than survival
933
00:50:14,040 –> 00:50:15,040
clocks.
934
00:50:15,040 –> 00:50:18,760
The weekly search signature still didn’t appear in the recent window.
935
00:50:18,760 –> 00:50:20,360
Discovery wasn’t wrong, it was punctual.
936
00:50:20,360 –> 00:50:21,800
Arcadence was the variable.
937
00:50:21,800 –> 00:50:23,800
We concluded with the proof check point.
938
00:50:23,800 –> 00:50:29,120
This demonstrates that Discovery’s steady counts and flat execution profiles indicate a narrowing,
939
00:50:29,120 –> 00:50:33,680
effective scope inherited from creation consolidation and pre-governance cleanup.
940
00:50:33,680 –> 00:50:35,440
Search consistency scope consistency.
941
00:50:35,440 –> 00:50:37,720
The outcome is correct, the behavior has changed.
942
00:50:37,720 –> 00:50:41,880
So we ran it one more time with one visible intervention.
943
00:50:41,880 –> 00:50:46,880
Locate transient classes into governed locations at birth for half the sample.
944
00:50:46,880 –> 00:50:50,560
The next week statistics rose in those locations.
945
00:50:50,560 –> 00:50:55,920
Exports matched, review set analytics reflected the search and execution time ticked up slightly.
946
00:50:55,920 –> 00:50:57,120
The green state green.
947
00:50:57,120 –> 00:51:00,120
This time stability described coverage we could explain.
948
00:51:00,120 –> 00:51:04,640
The pattern, creation, survival, discovery, nothing failed, the outcome was correct.
949
00:51:04,640 –> 00:51:10,000
So we replayed the whole run as one system, not three loops, creation, then survival, then
950
00:51:10,000 –> 00:51:11,480
discovery.
951
00:51:11,480 –> 00:51:16,840
Content, same policies, the meaning changed in sequence, creation, compressed, we observed
952
00:51:16,840 –> 00:51:17,840
it.
953
00:51:17,840 –> 00:51:22,840
Co-authoring and autosave bundled near term edits into fewer preserved states.
954
00:51:22,840 –> 00:51:26,680
The library was compliant, the artifact pool was smaller than we assumed while the work
955
00:51:26,680 –> 00:51:27,920
was fresh.
956
00:51:27,920 –> 00:51:30,120
That’s creation’s behavior.
957
00:51:30,120 –> 00:51:31,880
Survival shortened, we measured it.
958
00:51:31,880 –> 00:51:37,160
Quick-lived classes, recordings, temp exports, one drive spillover often vanished inside
959
00:51:37,160 –> 00:51:41,040
operational windows that were shorter than governance clocks.
960
00:51:41,040 –> 00:51:44,080
Retention success, registered on what remained.
961
00:51:44,080 –> 00:51:46,360
That’s survival’s behavior.
962
00:51:46,360 –> 00:51:52,380
Discovery stabilized, we documented it, searches ran fast, counts stayed flat and review sets
963
00:51:52,380 –> 00:51:56,840
filled from locations where artifacts persisted long enough to be collected.
964
00:51:56,840 –> 00:51:58,680
That’s discovery’s behavior.
965
00:51:58,680 –> 00:52:01,840
That’s when we realized we were watching a single pattern.
966
00:52:01,840 –> 00:52:05,200
Intelligent versioning creates fewer near term states.
967
00:52:05,200 –> 00:52:09,960
Operational cleanup removes low priority artifacts early and discovery faithfully reflects
968
00:52:09,960 –> 00:52:13,120
the smaller corpus that survives.
969
00:52:13,120 –> 00:52:17,400
Stability indicated systemic filtration, not control, so we ran it again with linkages
970
00:52:17,400 –> 00:52:21,880
explicit, creation to survival first.
971
00:52:21,880 –> 00:52:27,000
Intelligent versioning’s consolidation produces a coarser set of versions at birth.
972
00:52:27,000 –> 00:52:32,100
When those items live in zones with short life spans, there are fewer preserved states to
973
00:52:32,100 –> 00:52:35,960
begin with and less time for retention labels to arrive.
974
00:52:35,960 –> 00:52:42,040
The phl mirrors whatever exists at deletion time, it doesn’t backfill micro states that never
975
00:52:42,040 –> 00:52:43,320
became versions.
976
00:52:43,320 –> 00:52:49,160
The result, a preserved record of consolidated versions for a subset of items that lived
977
00:52:49,160 –> 00:52:52,200
long enough and nothing for the ones that didn’t.
978
00:52:52,200 –> 00:52:59,000
Survival to discovery next, cleanup, user driven or operational happens continuously.
979
00:52:59,000 –> 00:53:01,200
Governance clocks tick periodically.
980
00:53:01,200 –> 00:53:05,720
Anything deleted before label evaluation or outside governs scopes never contributes
981
00:53:05,720 –> 00:53:07,480
to discovery’s counts.
982
00:53:07,480 –> 00:53:13,400
Weekly searches look identical because they are searching what persists, not what occurred.
983
00:53:13,400 –> 00:53:19,680
Execution time stays flat because effective scope thins while tenant activity rises, creation
984
00:53:19,680 –> 00:53:22,080
to discovery as an echo.
985
00:53:22,080 –> 00:53:24,880
Premium review sets collect versions, not keystrokes.
986
00:53:24,880 –> 00:53:28,440
If creation compresses, review sets inherit that grain.
987
00:53:28,440 –> 00:53:33,560
If a stakeholder expects a 10 minutes ago rollback to represent every branch, the answer they
988
00:53:33,560 –> 00:53:38,040
receive is the merged checkpoint the platform regarded as meaningful.
989
00:53:38,040 –> 00:53:42,040
Discovery is not wrong, it is punctual and literal, so we wrote the pattern in operational
990
00:53:42,040 –> 00:53:43,040
language.
991
00:53:43,040 –> 00:53:48,160
Intelligent versioning yields fewer near term versions under co-authoring and auto-save.
992
00:53:48,160 –> 00:53:50,840
This is by design, it is not a failure state.
993
00:53:50,840 –> 00:53:53,960
Priority cleanup isn’t required to reduce the corpus.
994
00:53:53,960 –> 00:53:58,960
Ordinary user behavior and storage prompts remove transient classes before governance clocks
995
00:53:58,960 –> 00:53:59,960
intersect.
996
00:53:59,960 –> 00:54:03,200
Discovery returns consistent results within its scope.
997
00:54:03,200 –> 00:54:09,400
Scope effectiveness is a function of what survived creation and survival, not what was created.
998
00:54:09,400 –> 00:54:13,660
That’s when we realized our green posture was a closed loop, compliance manager state
999
00:54:13,660 –> 00:54:17,120
greens, secure score state steady, UAL was clean.
1000
00:54:17,120 –> 00:54:22,840
None of those signals described the behavioral chain from creation to survival to discovery.
1001
00:54:22,840 –> 00:54:28,240
They confirmed policy availability and correct execution on the reduced set.
1002
00:54:28,240 –> 00:54:32,880
In retrospect, we had treated stability as proof when it was a symptom.
1003
00:54:32,880 –> 00:54:37,200
Flat dashboards in a growing tenant didn’t indicate control, the indicated filtration
1004
00:54:37,200 –> 00:54:38,720
had become predictable.
1005
00:54:38,720 –> 00:54:43,680
We needed a way to hear the pattern early, so we stitched together three low friction signals.
1006
00:54:43,680 –> 00:54:48,240
Creation ratio version increments to file modified velocity per hotspot library, track it
1007
00:54:48,240 –> 00:54:49,400
weekly.
1008
00:54:49,400 –> 00:54:55,680
Under stable collaboration, a flattening ratio signals more aggressive consolidation or changing
1009
00:54:55,680 –> 00:54:56,880
save cadence.
1010
00:54:56,880 –> 00:55:01,200
That’s the creation dial, survival hit rate, percentage of items receiving a retention
1011
00:55:01,200 –> 00:55:03,680
label before deletion in transient zones.
1012
00:55:03,680 –> 00:55:09,280
If it drops governance clocks are losing to operational clocks, that’s the survival dial.
1013
00:55:09,280 –> 00:55:14,360
Discovery coverage ratio, discoverable items to created items for recurring scopes, reconciled
1014
00:55:14,360 –> 00:55:16,280
against UAL uploads.
1015
00:55:16,280 –> 00:55:20,920
If activity rises and coverage stays flat, discovery is faithful to a thinner corpus.
1016
00:55:20,920 –> 00:55:22,080
That’s the discovery dial.
1017
00:55:22,080 –> 00:55:26,040
We replayed the system with one change at a time to validate causality.
1018
00:55:26,040 –> 00:55:30,440
We enforced spaced saves on a critical library for a week.
1019
00:55:30,440 –> 00:55:34,560
Manual saves after paragraph level changes, no co-authoring during approvals.
1020
00:55:34,560 –> 00:55:36,320
The creation ratio tightened.
1021
00:55:36,320 –> 00:55:38,040
More versions appeared.
1022
00:55:38,040 –> 00:55:42,480
Downstream, the discovery coverage ratio for that library improved slightly.
1023
00:55:42,480 –> 00:55:44,400
There were more versions states to collect.
1024
00:55:44,400 –> 00:55:45,560
The outcome was correct.
1025
00:55:45,560 –> 00:55:49,280
We re-homed recordings into governed locations at birth.
1026
00:55:49,280 –> 00:55:50,920
The survival hit rate rose.
1027
00:55:50,920 –> 00:55:56,680
The labels applied immediately, phl footprints grew on deletes one week later, discovery counts
1028
00:55:56,680 –> 00:56:00,760
for the recordings class increased, and execution time ticked up.
1029
00:56:00,760 –> 00:56:02,240
The behavior was measurable.
1030
00:56:02,240 –> 00:56:08,920
We widened custodian scope only after the upstream fixes, without addressing creation and survival,
1031
00:56:08,920 –> 00:56:12,000
expanding discovery locations, added little.
1032
00:56:12,000 –> 00:56:17,160
After we moved birth locations and slowed deletion, the same expansion produced a visible
1033
00:56:17,160 –> 00:56:18,960
count increase.
1034
00:56:18,960 –> 00:56:22,440
It didn’t work, so we wrote a compact replay rule.
1035
00:56:22,440 –> 00:56:27,120
Fix creation granularity where it matters, extent survival windows or govern at birth for
1036
00:56:27,120 –> 00:56:31,400
transient classes, then validate discovery coverage ratios.
1037
00:56:31,400 –> 00:56:37,840
If discovery remains flat after upstream changes, either governance clocks still lag or filtration
1038
00:56:37,840 –> 00:56:39,240
moved elsewhere.
1039
00:56:39,240 –> 00:56:42,480
That’s when we realized the sentence we’d carry forward.
1040
00:56:42,480 –> 00:56:44,240
The outcome was correct.
1041
00:56:44,240 –> 00:56:46,520
The behavior had changed.
1042
00:56:46,520 –> 00:56:48,160
Stability wasn’t proof of control.
1043
00:56:48,160 –> 00:56:53,400
It was the symptom of a system optimizing for fewer, faster, cleaner answers.
1044
00:56:53,400 –> 00:56:56,440
We closed the pattern by restating intent clearly.
1045
00:56:56,440 –> 00:57:00,200
Governance assures what exists and persists.
1046
00:57:00,200 –> 00:57:04,000
Not everything that briefly appears and changes.
1047
00:57:04,000 –> 00:57:06,760
If your results never change, measure the chain.
1048
00:57:06,760 –> 00:57:11,240
Creation compresses, survival reduces, discovery reflects.
1049
00:57:11,240 –> 00:57:16,200
If stability persists after upstream dials are adjusted, you are auditing repetition,
1050
00:57:16,200 –> 00:57:17,200
not reality.
1051
00:57:17,200 –> 00:57:18,520
So we ran it again.
1052
00:57:18,520 –> 00:57:21,280
This time we would confront the lie directly.
1053
00:57:21,280 –> 00:57:23,120
Execution equals intent.
1054
00:57:23,120 –> 00:57:25,440
The lie, execution equals intent.
1055
00:57:25,440 –> 00:57:27,520
The same policy executed again.
1056
00:57:27,520 –> 00:57:28,760
The outcome was correct.
1057
00:57:28,760 –> 00:57:29,920
That’s where the lie hides.
1058
00:57:29,920 –> 00:57:32,160
We equated execution with intent.
1059
00:57:32,160 –> 00:57:35,960
We measured that a rule ran, therefore our purpose was enforced.
1060
00:57:35,960 –> 00:57:37,280
The platform complied.
1061
00:57:37,280 –> 00:57:39,640
Therefore our governance worked.
1062
00:57:39,640 –> 00:57:42,680
That’s when we realized we had been grading process, not meaning.
1063
00:57:42,680 –> 00:57:44,240
State the lie plainly.
1064
00:57:44,240 –> 00:57:46,360
Executed policy equals enforced intent.
1065
00:57:46,360 –> 00:57:47,680
It doesn’t.
1066
00:57:47,680 –> 00:57:49,800
Execution proves availability, not interpretation.
1067
00:57:49,800 –> 00:57:52,000
The system did what it’s designed to do.
1068
00:57:52,000 –> 00:57:54,080
It didn’t necessarily do what we thought we asked.
1069
00:57:54,080 –> 00:57:56,440
Here’s how it manifests.
1070
00:57:56,440 –> 00:57:58,720
Retain all versions we say in short-hand.
1071
00:57:58,720 –> 00:58:04,920
What we actually get under autosave and co-authoring is fewer near-term versions by design, with
1072
00:58:04,920 –> 00:58:09,080
trimming schedules that honor the current version and thin old ones later.
1073
00:58:09,080 –> 00:58:10,360
The policy didn’t fail.
1074
00:58:10,360 –> 00:58:11,920
We misread the object it protects.
1075
00:58:11,920 –> 00:58:13,680
We retained versions, not edits.
1076
00:58:13,680 –> 00:58:15,720
That gap is meaning not malfunction.
1077
00:58:15,720 –> 00:58:21,240
The manifestation discovery completeness we run identical KQL, we see steady counts.
1078
00:58:21,240 –> 00:58:22,920
We conclude scope is stable.
1079
00:58:22,920 –> 00:58:27,840
But the corpus upstream has already filtered, creation collapsed, micro-states, survival
1080
00:58:27,840 –> 00:58:31,560
removed, short-lived artifacts before labels arrived.
1081
00:58:31,560 –> 00:58:35,360
Discover returns consistent answers inside a shrinking set.
1082
00:58:35,360 –> 00:58:37,000
Consistency isn’t completeness.
1083
00:58:37,000 –> 00:58:39,240
We validated that the engine runs.
1084
00:58:39,240 –> 00:58:43,720
We didn’t validate that our intent, find what happened, was satisfied.
1085
00:58:43,720 –> 00:58:46,160
We felt this most in the flat dashboards.
1086
00:58:46,160 –> 00:58:47,800
Compliance manager stayed green.
1087
00:58:47,800 –> 00:58:49,280
Secure score remained steady.
1088
00:58:49,280 –> 00:58:51,560
The unified audit log was clean.
1089
00:58:51,560 –> 00:58:53,640
Remember how convincing that green felt?
1090
00:58:53,640 –> 00:58:58,400
It rewarded us for asking whether the machine was on, not whether it was describing the behavior
1091
00:58:58,400 –> 00:58:59,680
accurately over time.
1092
00:58:59,680 –> 00:59:01,640
So we reframed validation.
1093
00:59:01,640 –> 00:59:04,800
Velocity versus growth versus execution profiling.
1094
00:59:04,800 –> 00:59:07,240
Three lenses, one question.
1095
00:59:07,240 –> 00:59:12,960
Do our measurements reflect the tenant’s behavior or only the system’s repetition?
1096
00:59:12,960 –> 00:59:17,320
First, version velocity to file modified velocity at hotspots.
1097
00:59:17,320 –> 00:59:22,880
If edits accelerate and versions don’t, creation is compressing more aggressively or save
1098
00:59:22,880 –> 00:59:23,880
cadence changed.
1099
00:59:23,880 –> 00:59:26,320
That’s not a failure, it’s a meaning shift.
1100
00:59:26,320 –> 00:59:33,160
If we ignore the ratio, we will claim retained versions as intent fulfilled while the historical
1101
00:59:33,160 –> 00:59:36,600
resolution stakeholders expect has drifted.
1102
00:59:36,600 –> 00:59:38,120
Growth next.
1103
00:59:38,120 –> 00:59:42,640
Storage metrics, PGL footprints and labeled item counts by class.
1104
00:59:42,640 –> 00:59:48,080
If activity rises and these don’t move in tandem for transient zones we care about, survival
1105
00:59:48,080 –> 00:59:51,000
is ending before governance begins.
1106
00:59:51,000 –> 00:59:53,280
Policy on success isn’t intent enforced.
1107
00:59:53,280 –> 00:59:56,760
It’s a pump idling against a closed valve.
1108
00:59:56,760 –> 00:59:58,160
Execution profiling last.
1109
00:59:58,160 –> 01:00:03,320
E-discovery execution time, statistics and location contribution over time.
1110
01:00:03,320 –> 01:00:09,080
If the tenant grows and profiles stay flat while location contribution consolidates, discovery
1111
01:00:09,080 –> 01:00:11,200
is faithfully searching less.
1112
01:00:11,200 –> 01:00:14,200
Storage ran is not scope aligned with business questions.
1113
01:00:14,200 –> 01:00:16,000
We proved this with the coverage ratio.
1114
01:00:16,000 –> 01:00:19,200
It didn’t change when we tuned discovery alone.
1115
01:00:19,200 –> 01:00:25,280
It moved only after we changed creation granularity and survival windows.
1116
01:00:25,280 –> 01:00:30,120
We rode our quiet directive, we measured repetition not reality, we looked for steady lights
1117
01:00:30,120 –> 01:00:31,120
and got them.
1118
01:00:31,120 –> 01:00:36,000
We didn’t instrument variance, we didn’t track drift, so we brought the lie down to procedures
1119
01:00:36,000 –> 01:00:37,600
we can audit.
1120
01:00:37,600 –> 01:00:41,160
Replace policy executed with policy intersected.
1121
01:00:41,160 –> 01:00:45,400
Like the percent of target class items that received a label before deletion, treat
1122
01:00:45,400 –> 01:00:50,280
dips as incidents, the outcome can be correct while intent is unserved.
1123
01:00:50,280 –> 01:00:55,160
Replace retained versions with recoverable checkpoints with unexpected resolution.
1124
01:00:55,160 –> 01:01:01,200
For workflows that require 10 minute rollbacks, test under co-authoring and autosave.
1125
01:01:01,200 –> 01:01:04,400
If the creation ratio flatens, publish the constraint.
1126
01:01:04,400 –> 01:01:07,720
Execution remains correct, your promise must change.
1127
01:01:07,720 –> 01:01:12,880
Replace discovery stable with discovery coverage ratio aligned to activity.
1128
01:01:12,880 –> 01:01:16,640
Reconcile weekly uploads to weekly discoverables for recurring scopes.
1129
01:01:16,640 –> 01:01:20,440
If upload velocity rises while coverage stays flat assume inherited filtration.
1130
01:01:20,440 –> 01:01:21,960
Don’t widen KQL first.
1131
01:01:21,960 –> 01:01:25,840
Fix upstream births and life spans then re-measure.
1132
01:01:25,840 –> 01:01:29,320
Replace green score with green annotated.
1133
01:01:29,320 –> 01:01:34,280
For every on success add the class and location coverage notes.
1134
01:01:34,280 –> 01:01:40,560
If the green excludes recordings, temp exports or one drive spill over that matter, write
1135
01:01:40,560 –> 01:01:41,560
it down.
1136
01:01:41,560 –> 01:01:44,680
Treat ungoverned birds as a decision, not a hidden default.
1137
01:01:44,680 –> 01:01:46,160
We accepted one more constraint.
1138
01:01:46,160 –> 01:01:48,960
The platform will continue to optimize.
1139
01:01:48,960 –> 01:01:51,320
Intelligent versioning improves storage.
1140
01:01:51,320 –> 01:01:53,600
Autosave improves collaboration.
1141
01:01:53,600 –> 01:01:56,560
Clean up improves user experience under quotas.
1142
01:01:56,560 –> 01:01:57,920
It is discovery improves throughput.
1143
01:01:57,920 –> 01:01:59,520
None of these are errors.
1144
01:01:59,520 –> 01:02:05,480
They are optimizations that trade granularity and dwell time for efficiency.
1145
01:02:05,480 –> 01:02:10,480
Intent enforcement requires us to recognize the trades and adjust process, not blame the
1146
01:02:10,480 –> 01:02:11,480
tools.
1147
01:02:11,480 –> 01:02:16,240
So we confronted the lie where it was most comfortable in unchanged charts.
1148
01:02:16,240 –> 01:02:21,080
If the chart doesn’t move when the tenant moves, it’s not describing intent, it’s describing
1149
01:02:21,080 –> 01:02:23,320
repetition.
1150
01:02:23,320 –> 01:02:26,760
We wrote the sentence on the wall where we stage our runs.
1151
01:02:26,760 –> 01:02:30,560
If your results never change, your governing repetition, not reality.
1152
01:02:30,560 –> 01:02:32,680
Then we ran the baseline again with new eyes.
1153
01:02:32,680 –> 01:02:35,240
We stopped asking if the policy executed.
1154
01:02:35,240 –> 01:02:40,400
We started asking whether the behavior we care about is visible at the resolution we promised,
1155
01:02:40,400 –> 01:02:44,080
long enough to be governed and discoverable on the cadence we claimed.
1156
01:02:44,080 –> 01:02:46,080
The outcome remained correct.
1157
01:02:46,080 –> 01:02:48,000
Our understanding changed.
1158
01:02:48,000 –> 01:02:49,720
That was the point.
1159
01:02:49,720 –> 01:02:50,720
Break the loop.
1160
01:02:50,720 –> 01:02:52,520
Variance over success.
1161
01:02:52,520 –> 01:02:53,520
Nothing failed.
1162
01:02:53,520 –> 01:02:58,320
The outcome was correct, so we stopped congratulating repetition and start auditing variants.
1163
01:02:58,320 –> 01:03:00,040
We flipped the objective.
1164
01:03:00,040 –> 01:03:02,120
Success is no longer green.
1165
01:03:02,120 –> 01:03:04,280
Success is measured drift we can explain.
1166
01:03:04,280 –> 01:03:06,760
Flat is an incident until proven otherwise.
1167
01:03:06,760 –> 01:03:08,520
First we audit the repetition itself.
1168
01:03:08,520 –> 01:03:10,280
We treat flatness as an anomaly.
1169
01:03:10,280 –> 01:03:16,280
If a hotspot library shows the same version to modification ratio for six weeks while collaboration
1170
01:03:16,280 –> 01:03:18,960
patterns change, we don’t celebrate predictability.
1171
01:03:18,960 –> 01:03:19,960
We open a ticket.
1172
01:03:19,960 –> 01:03:26,600
The same search executes in the same time with the same results while tenant activity rises.
1173
01:03:26,600 –> 01:03:27,600
That’s not performance.
1174
01:03:27,600 –> 01:03:29,000
That’s scope starvation.
1175
01:03:29,000 –> 01:03:32,280
We log it, so we ran it again with variance instruments.
1176
01:03:32,280 –> 01:03:33,280
Creation variance.
1177
01:03:33,280 –> 01:03:38,480
For each hotspot library, we compute version velocity divided by file modified velocity
1178
01:03:38,480 –> 01:03:40,000
and track it weekly.
1179
01:03:40,000 –> 01:03:44,520
We expect natural oscillation around a baseline tied to workflow reality.
1180
01:03:44,520 –> 01:03:49,760
If the ratio flattens down without a change in authorship pattern, auto-save policy
1181
01:03:49,760 –> 01:03:54,480
or save cadence behavior shifted, we don’t guess we replay a short burst with spaced
1182
01:03:54,480 –> 01:03:56,080
saves to calibrate.
1183
01:03:56,080 –> 01:04:02,120
If the ratio rebounds in calibration but remains flat in production, we know consolidation
1184
01:04:02,120 –> 01:04:04,240
is increasing under load.
1185
01:04:04,240 –> 01:04:06,520
That’s a finding.
1186
01:04:06,520 –> 01:04:08,400
Survival variance.
1187
01:04:08,400 –> 01:04:14,320
We instrument retention hit variance, percent of items receiving a label before deletion,
1188
01:04:14,320 –> 01:04:21,400
computed per class, recordings, temp exports, one drive spillover.
1189
01:04:21,400 –> 01:04:23,760
Expectation this number is noisy but bounded.
1190
01:04:23,760 –> 01:04:27,160
If it drops steadily, survival clocks are beating governance clocks.
1191
01:04:27,160 –> 01:04:28,680
We test a constraint.
1192
01:04:28,680 –> 01:04:31,760
Re-home a subset at birth into governed locations.
1193
01:04:31,760 –> 01:04:33,640
The hit rate should rise.
1194
01:04:33,640 –> 01:04:37,880
If it doesn’t, propagation or labeling logic lags further than expected.
1195
01:04:37,880 –> 01:04:40,160
That’s drift discovery variance.
1196
01:04:40,160 –> 01:04:45,200
We track execution time statistics and the discovery coverage ratio discoverables to
1197
01:04:45,200 –> 01:04:47,320
create per recurring scope.
1198
01:04:47,320 –> 01:04:51,520
We expect duration to rise with scope when upstream behavior preserves more.
1199
01:04:51,520 –> 01:04:58,200
If duration and counts stay flat while upload velocity rises, discovery is searching less
1200
01:04:58,200 –> 01:04:59,520
not faster.
1201
01:04:59,520 –> 01:05:02,800
We widen only after upstream dials change.
1202
01:05:02,800 –> 01:05:08,440
If widening alone moves little, we revert and fix creation and survival first.
1203
01:05:08,440 –> 01:05:11,880
But here’s where it gets interesting, variance demands comparisons, not snapshots.
1204
01:05:11,880 –> 01:05:12,960
So we add deltas.
1205
01:05:12,960 –> 01:05:17,960
We compare week over week version velocity ratios for the same library against co-authoring
1206
01:05:17,960 –> 01:05:20,320
percentage and average save spacing.
1207
01:05:20,320 –> 01:05:26,080
If the ratio of latins while co-authoring rises and saves cluster, causality lines up.
1208
01:05:26,080 –> 01:05:31,200
If the ratio of latins without collaboration change, we look for tenant wide versioning
1209
01:05:31,200 –> 01:05:33,160
toggles or client updates.
1210
01:05:33,160 –> 01:05:34,760
We reconcile change records.
1211
01:05:34,760 –> 01:05:37,400
No change locked plus behavior change equals drift.
1212
01:05:37,400 –> 01:05:41,600
We compare survival hit variance against storage metrics dwell time.
1213
01:05:41,600 –> 01:05:47,040
If labels arrive earlier but dwell time still shortens, cleanup moved to a new vector, quote
1214
01:05:47,040 –> 01:05:49,880
a prompts, new UX nudges or app updates.
1215
01:05:49,880 –> 01:05:51,000
We don’t guess intent.
1216
01:05:51,000 –> 01:05:52,720
We measure before and after prompts.
1217
01:05:52,720 –> 01:05:57,760
If deletion events spike within hours of prompts, we annotate the driver and adjust
1218
01:05:57,760 –> 01:06:01,200
governance clocks or birth locations accordingly.
1219
01:06:01,200 –> 01:06:06,840
We compare discovery coverage ratio against weekly upload velocity for the same custodial
1220
01:06:06,840 –> 01:06:08,200
scope.
1221
01:06:08,200 –> 01:06:13,400
If velocity climbs and coverage stays flat, we validate that advanced indexing shows no
1222
01:06:13,400 –> 01:06:14,760
backlog.
1223
01:06:14,760 –> 01:06:17,480
If indexing is clear, scope is simply thinner.
1224
01:06:17,480 –> 01:06:19,560
We log it as inherited filtration.
1225
01:06:19,560 –> 01:06:23,040
Only after we alter upstream births do we expect the ratio to rise.
1226
01:06:23,040 –> 01:06:24,960
If it stays flat, we miss the birth path.
1227
01:06:24,960 –> 01:06:26,800
Now we need stress tests.
1228
01:06:26,800 –> 01:06:28,920
Variance without pressure tells us little.
1229
01:06:28,920 –> 01:06:30,880
So we stress test discovery.
1230
01:06:30,880 –> 01:06:37,800
We run the same KQL after re-homing half the transient class to governed locations at birth.
1231
01:06:37,800 –> 01:06:40,040
Execution time should tick up.
1232
01:06:40,040 –> 01:06:41,520
Statistics should increase.
1233
01:06:41,520 –> 01:06:43,400
Expots should match within noise.
1234
01:06:43,400 –> 01:06:47,080
Review set analytics should show new clusters by location and age.
1235
01:06:47,080 –> 01:06:52,720
If those dials don’t move, our re-home failed or the class still dies before label arrival.
1236
01:06:52,720 –> 01:06:53,720
We adjust.
1237
01:06:53,720 –> 01:06:54,720
Then we run it again.
1238
01:06:54,720 –> 01:06:56,320
We stress test creation.
1239
01:06:56,320 –> 01:07:01,120
We enforce spaced saves and single author windows during approvals in one critical library
1240
01:07:01,120 –> 01:07:02,280
for seven days.
1241
01:07:02,280 –> 01:07:03,600
Version velocity should rise.
1242
01:07:03,600 –> 01:07:06,400
Restore exercises should produce finer checkpoints.
1243
01:07:06,400 –> 01:07:09,640
Downstream, discovery coverage for that library should nudge up.
1244
01:07:09,640 –> 01:07:14,400
If it doesn’t, our recovery assumptions exceeded what versioning granularity delivers,
1245
01:07:14,400 –> 01:07:16,120
even with spaced saves.
1246
01:07:16,120 –> 01:07:17,360
We publish the constraint.
1247
01:07:17,360 –> 01:07:19,360
We stress test survival.
1248
01:07:19,360 –> 01:07:25,440
We add a minimum holding period for 10 exports, three days before deletion.
1249
01:07:25,440 –> 01:07:26,720
This should apply in time.
1250
01:07:26,720 –> 01:07:28,880
P-H-L footprints should grow on deletes.
1251
01:07:28,880 –> 01:07:30,720
Storage dwell should extend.
1252
01:07:30,720 –> 01:07:33,280
Discovery should reflect the surge while the policy holds.
1253
01:07:33,280 –> 01:07:38,720
If users circumvent to ungoverned spaces, U-A-L will show the detour.
1254
01:07:38,720 –> 01:07:42,640
We annotate the new birth path and decide whether to govern it or block it.
1255
01:07:42,640 –> 01:07:46,680
Metrics alone don’t break loops, procedure does, so we implement the play.
1256
01:07:46,680 –> 01:07:50,680
Treat flat dashboards as incidents until variance is explained.
1257
01:07:50,680 –> 01:07:57,640
Un-success requires coverage notes, which classes, which locations, what lifespan bands.
1258
01:07:57,640 –> 01:08:03,360
Add three alerts, flattening creation ratio in hotspots, declining survival hit rates in
1259
01:08:03,360 –> 01:08:10,040
transient classes and discovery coverage ratio, divergence from upload velocity, run quarterly
1260
01:08:10,040 –> 01:08:16,080
revalidation, recreate the creation burst, re-home a transient class and replay a recurring
1261
01:08:16,080 –> 01:08:17,080
surge.
1262
01:08:17,080 –> 01:08:18,320
Document deltas.
1263
01:08:18,320 –> 01:08:23,600
If deltas don’t appear, assume filtration moved, integrate change management gates, any
1264
01:08:23,600 –> 01:08:28,560
platform toggle that touches versioning, auto-save behavior, recording storage or indexing
1265
01:08:28,560 –> 01:08:31,560
cadence requires it before after variance plan.
1266
01:08:31,560 –> 01:08:34,800
No user impact means no visible failures.
1267
01:08:34,800 –> 01:08:37,560
It says nothing about behavioral grain.
1268
01:08:37,560 –> 01:08:40,480
One actionable first action remains.
1269
01:08:40,480 –> 01:08:46,280
Alert on flat e-discovery execution profiles and counts for recurring searches while upload
1270
01:08:46,280 –> 01:08:47,920
velocity climbs.
1271
01:08:47,920 –> 01:08:53,440
Flat is not a comfort signal, it’s the earliest cheap indicator that discovery is inheriting
1272
01:08:53,440 –> 01:08:54,600
less.
1273
01:08:54,600 –> 01:08:59,520
We wire it to a weekly report that includes coverage notes, then we stop restarting, we
1274
01:08:59,520 –> 01:09:02,640
end this loop with a quiet constraint.
1275
01:09:02,640 –> 01:09:06,200
Variance is the language the system uses to tell us what changed.
1276
01:09:06,200 –> 01:09:09,560
If we don’t instrument it, green will keep lying in fluent repetition.
1277
01:09:09,560 –> 01:09:12,000
The playbook break the loop checklist.
1278
01:09:12,000 –> 01:09:13,600
Track variance not success.
1279
01:09:13,600 –> 01:09:16,760
We stop grading the machine and start grading behavior.
1280
01:09:16,760 –> 01:09:20,080
Here’s the checklist we execute, exactly as designed.
1281
01:09:20,080 –> 01:09:21,680
Define acceptable drift bands.
1282
01:09:21,680 –> 01:09:25,280
For each dial we set a baseline and a tolerance.
1283
01:09:25,280 –> 01:09:26,560
Creation ratio.
1284
01:09:26,560 –> 01:09:29,480
Versions to file modified per hotspot library.
1285
01:09:29,480 –> 01:09:32,000
Baseline taken from spaced save control runs.
1286
01:09:32,000 –> 01:09:36,000
Drift band plus 15% over a rolling four week median.
1287
01:09:36,000 –> 01:09:40,160
Survival hit rate, percent of items labeled before deletion by class.
1288
01:09:40,160 –> 01:09:43,400
Drift band plus ten points depending on class volatility.
1289
01:09:43,400 –> 01:09:47,760
Recovered ratio, discoverables to create for recurring scopes.
1290
01:09:47,760 –> 01:09:51,560
Drift band plus 8% when upstream births are stable.
1291
01:09:51,560 –> 01:09:53,840
Anything outside the band opens an incident.
1292
01:09:53,840 –> 01:09:58,320
Alerts, flat retention hits, stable e-discovery times versus data set growth.
1293
01:09:58,320 –> 01:09:59,920
We wire three alerts.
1294
01:09:59,920 –> 01:10:06,200
One, creation ratio flattening, fires, when the ratio drops below the lower band without
1295
01:10:06,200 –> 01:10:08,560
a documented collaboration change.
1296
01:10:08,560 –> 01:10:13,080
Two, survival hit decline fires when a class is predelete labeling rate trends
1297
01:10:13,080 –> 01:10:15,080
down two periods consecutively.
1298
01:10:15,080 –> 01:10:20,520
Three, discovery flat on growth fires when execution duration and counts stay within 5%
1299
01:10:20,520 –> 01:10:25,160
while upload velocity rises 20% or more for the same custodial scope.
1300
01:10:25,160 –> 01:10:26,960
Alerts attached required coverage notes.
1301
01:10:26,960 –> 01:10:32,520
No green without context, monitor version creation versus edit volume, co-authoring hotspots.
1302
01:10:32,520 –> 01:10:35,920
We maintain a roster of libraries with heavy co-authoring.
1303
01:10:35,920 –> 01:10:37,960
For each, we log weekly.
1304
01:10:37,960 –> 01:10:43,760
Number of authors, percent of sessions with autosave on medium save spacing and the creation
1305
01:10:43,760 –> 01:10:44,760
ratio.
1306
01:10:44,760 –> 01:10:49,840
If co-authoring rises and spacing titans, a flattening ratio is explained.
1307
01:10:49,840 –> 01:10:54,320
If co-authoring is flat and the ratio still flatens, behavior drifted.
1308
01:10:54,320 –> 01:11:00,240
We replay a short calibration burst with manual saves to verify the metric sensitivity.
1309
01:11:00,240 –> 01:11:03,600
Audit artifacts that never reach retention or discovery.
1310
01:11:03,600 –> 01:11:10,440
Quarterly, we select two transient classes, recordings and temp exports and run a UAL
1311
01:11:10,440 –> 01:11:12,520
to governance reconciliation.
1312
01:11:12,520 –> 01:11:16,800
We count uploads label applications, phl entries and discoverables.
1313
01:11:16,800 –> 01:11:20,440
We produce a single line per class.
1314
01:11:20,440 –> 01:11:22,800
Created x labeled y.
1315
01:11:22,800 –> 01:11:24,320
Preserved z.
1316
01:11:24,320 –> 01:11:26,840
Discoverable w.
1317
01:11:26,840 –> 01:11:34,280
If yx, the x or wx fall below prior quarters without a known cause, we escalate.
1318
01:11:34,280 –> 01:11:39,200
We do not widen KQL until births and life spans change.
1319
01:11:39,200 –> 01:11:45,120
Simulate priority cleanup where appropriate, confirm phl realities, reconcile storage
1320
01:11:45,120 –> 01:11:46,120
deltas.
1321
01:11:46,120 –> 01:11:50,960
We draft cleanup scopes in simulation only to preview what would be targeted then compare
1322
01:11:50,960 –> 01:11:54,920
against actual user deletions and storage metrics dwell time.
1323
01:11:54,920 –> 01:12:00,800
We verify phl presence on control deletes in governed zones and absence in ungoverned
1324
01:12:00,800 –> 01:12:02,240
neighbors.
1325
01:12:02,240 –> 01:12:05,920
We reconcile that simulation is not execution.
1326
01:12:05,920 –> 01:12:11,240
The point is timing and class targeting, not deletion.
1327
01:12:11,240 –> 01:12:13,760
Revalidate assumptions quarterly.
1328
01:12:13,760 –> 01:12:15,240
Document baseline shifts.
1329
01:12:15,240 –> 01:12:17,440
Every quarter we replay three controls.
1330
01:12:17,440 –> 01:12:22,560
A creation burst with space saves, a re-home of one transient class to govern that birth
1331
01:12:22,560 –> 01:12:25,760
and a recurring discovery run with items reports.
1332
01:12:25,760 –> 01:12:27,360
We compare against last quarter.
1333
01:12:27,360 –> 01:12:31,600
If baselines move, we record the shift and adjust drift bands.
1334
01:12:31,600 –> 01:12:33,760
No change is not a goal.
1335
01:12:33,760 –> 01:12:37,200
Persistent flatness without explanation is an incident.
1336
01:12:37,200 –> 01:12:39,240
DSC and automation.
1337
01:12:39,240 –> 01:12:45,480
We export tenant baselines with Microsoft 365 DSC for policies that affect our dials,
1338
01:12:45,480 –> 01:12:50,200
versioning defaults, autosave client channels, recording storage locations.
1339
01:12:50,200 –> 01:12:54,080
We compare desired versus actual with drift only flags.
1340
01:12:54,080 –> 01:12:59,160
Changes to these controls require a variance plan attached to change tickets.
1341
01:12:59,160 –> 01:13:04,280
Before after measurements for creation ratio, survival, hit rate and discovery coverage.
1342
01:13:04,280 –> 01:13:07,680
No user impact is not accepted without numbers.
1343
01:13:07,680 –> 01:13:09,080
Change management gates.
1344
01:13:09,080 –> 01:13:14,160
Any toggle that can alter creation granularity, birth, location or indexing cadence carries
1345
01:13:14,160 –> 01:13:15,360
three gates.
1346
01:13:15,360 –> 01:13:17,320
Pre-change baselines captured.
1347
01:13:17,320 –> 01:13:21,920
Change measurements within one week and a rollback plan keyed to the dials.
1348
01:13:21,920 –> 01:13:27,320
Gate failure is defined as drift outside bands without an approved explanation.
1349
01:13:27,320 –> 01:13:30,840
We do not rely on vendor release nodes to infer no impact.
1350
01:13:30,840 –> 01:13:34,760
Single first action alert on flat e-discovery execution overgrowth.
1351
01:13:34,760 –> 01:13:36,080
We implement this now.
1352
01:13:36,080 –> 01:13:42,280
Weekly for every recurring KQL, we compute upload velocity for the custodial window, execution
1353
01:13:42,280 –> 01:13:45,440
duration, statistics and coverage ratio.
1354
01:13:45,440 –> 01:13:51,280
If velocity rises and both duration and counts remain flat, we fire the alert with required
1355
01:13:51,280 –> 01:13:56,480
coverage nodes, which locations contributed which did not and whether upstream births
1356
01:13:56,480 –> 01:13:57,800
changed.
1357
01:13:57,800 –> 01:14:02,080
This is the earliest cheap signal that discoveries inheriting less.
1358
01:14:02,080 –> 01:14:03,800
Instruments survival clocks.
1359
01:14:03,800 –> 01:14:09,400
We chart label arrival time distributions per class against typical deletion times.
1360
01:14:09,400 –> 01:14:14,200
If label arrival p50 exceeds deletion p50, we have a timing inversion.
1361
01:14:14,200 –> 01:14:18,160
The place to govern at birth or impose a minimum holding period.
1362
01:14:18,160 –> 01:14:19,520
We test on a subset.
1363
01:14:19,520 –> 01:14:21,720
If the inversion resolves, we scale.
1364
01:14:21,720 –> 01:14:25,000
We write down wins and failures to reduce guesswork next time.
1365
01:14:25,000 –> 01:14:30,640
Set ownership and cadence each dial has an owner, creation ratio, content platform lead,
1366
01:14:30,640 –> 01:14:34,560
survival hit rate, records management, discovery coverage, e-discovery lead.
1367
01:14:34,560 –> 01:14:39,640
Weekly reviews are 15 minutes with the three plots and a decision column.
1368
01:14:39,640 –> 01:14:42,480
Observe, calibrate, intervene.
1369
01:14:42,480 –> 01:14:45,880
No status reads without actions or no action documented.
1370
01:14:45,880 –> 01:14:46,880
Publish constraints.
1371
01:14:46,880 –> 01:14:51,600
We create one page per class and workflow that states the measured limits.
1372
01:14:51,600 –> 01:14:55,520
Co-authoring with autosave compresses near term versions.
1373
01:14:55,520 –> 01:14:59,320
Expect course checkpoints unless spaced saves are enforced.
1374
01:14:59,320 –> 01:15:04,600
Recordings kept under three days will not be labeled reliably unless governed at birth.
1375
01:15:04,600 –> 01:15:07,640
We socialize these constraints where promises are made.
1376
01:15:07,640 –> 01:15:09,240
Add a retrospective.
1377
01:15:09,240 –> 01:15:14,920
In an audit or case outcome surprises a stakeholder, we run a drift review, not a blame review.
1378
01:15:14,920 –> 01:15:21,400
We replay the three loops, show the dials, and reconcile where meaning diverged from execution.
1379
01:15:21,400 –> 01:15:24,400
We adjust the playbook where our instruments were blind.
1380
01:15:24,400 –> 01:15:26,360
We end with an operational rule.
1381
01:15:26,360 –> 01:15:28,480
Stability requires evidence.
1382
01:15:28,480 –> 01:15:30,640
Flat equals incident until variance is explained.
1383
01:15:30,640 –> 01:15:31,640
We run the play.
1384
01:15:31,640 –> 01:15:32,880
Then we run it again.
1385
01:15:32,880 –> 01:15:34,520
The callback.
1386
01:15:34,520 –> 01:15:36,200
Understanding beats fixing.
1387
01:15:36,200 –> 01:15:37,200
Nothing failed.
1388
01:15:37,200 –> 01:15:38,360
The outcome was correct.
1389
01:15:38,360 –> 01:15:42,560
So we stop fixing the outputs and start understanding the behavior that produced them.
1390
01:15:42,560 –> 01:15:44,360
We draw the parallel plainly.
1391
01:15:44,360 –> 01:15:46,960
Source code investigations don’t begin by patching.
1392
01:15:46,960 –> 01:15:49,240
They begin by replaying with instrumentation.
1393
01:15:49,240 –> 01:15:50,240
We did the same.
1394
01:15:50,240 –> 01:15:56,200
We replayed creation, survival, and discovery with dials that describe behavior.
1395
01:15:56,200 –> 01:16:01,840
That’s when we realized our earlier successes were just reruns without observability.
1396
01:16:01,840 –> 01:16:06,560
We restarted because the lights were green, not because the meaning held.
1397
01:16:06,560 –> 01:16:11,480
Understanding beats fixing because the platform evolves under stable outputs.
1398
01:16:11,480 –> 01:16:13,800
Intelligent versioning will continue to optimize.
1399
01:16:13,800 –> 01:16:17,600
Autosave will continue to compress churn into useful states.
1400
01:16:17,600 –> 01:16:22,680
Cleanup pressures will continue to accelerate, where storage and UX demanded.
1401
01:16:22,680 –> 01:16:27,800
E-discovery will continue to deliver steady performance inside its declared scope.
1402
01:16:27,800 –> 01:16:29,320
None of these are malfunctions.
1403
01:16:29,320 –> 01:16:31,760
They are optimizations.
1404
01:16:31,760 –> 01:16:37,760
If we don’t observe the differences they introduce, our patches become rituals that satisfy repetition.
1405
01:16:37,760 –> 01:16:40,240
So we restate the working stance.
1406
01:16:40,240 –> 01:16:45,040
Our loop ends when interpretation changes, not when policies are reapplied.
1407
01:16:45,040 –> 01:16:47,320
On success is an availability claim.
1408
01:16:47,320 –> 01:16:49,280
Intersects is an evidence claim.
1409
01:16:49,280 –> 01:16:54,560
Understanding means we ask whether the thing we promised, recoverable checkpoints at expected
1410
01:16:54,560 –> 01:17:01,240
resolution, survival long enough for governance clocks to tick, searches, aligned to lived
1411
01:17:01,240 –> 01:17:04,560
work is visible at the cadence we run.
1412
01:17:04,560 –> 01:17:10,000
If not, we change the question we’re asking the system, not the checkbox we toggle.
1413
01:17:10,000 –> 01:17:12,560
We turn that stance into posture.
1414
01:17:12,560 –> 01:17:15,000
Governance posture means we instrument variance.
1415
01:17:15,000 –> 01:17:18,520
We stop grading policy execution and start grading behavioral drift.
1416
01:17:18,520 –> 01:17:22,320
We treat flat dashboards as incidents until explained.
1417
01:17:22,320 –> 01:17:28,040
We accept optimizations as constraints we can state, not as adversaries we must fight.
1418
01:17:28,040 –> 01:17:30,760
We publish those constraints where promises are made.
1419
01:17:30,760 –> 01:17:36,320
That avoids silent renegotiations with stakeholders who thought retain all versions meant infinite
1420
01:17:36,320 –> 01:17:39,200
micro steps under co-authoring.
1421
01:17:39,200 –> 01:17:41,840
We move from fixing to measuring meaning.
1422
01:17:41,840 –> 01:17:43,480
That changes our cadence.
1423
01:17:43,480 –> 01:17:45,320
Quarterly revalidation isn’t ceremonial.
1424
01:17:45,320 –> 01:17:47,240
It’s a replay with controls.
1425
01:17:47,240 –> 01:17:50,320
Spaced saves verify creation granularity.
1426
01:17:50,320 –> 01:17:54,080
Rehoming transient births verify survival clocks.
1427
01:17:54,080 –> 01:17:57,160
Recurring Kekil with coverage ratios verifies discovery scope.
1428
01:17:57,160 –> 01:18:00,040
If deltas fail to appear filtration moved, we look for it.
1429
01:18:00,040 –> 01:18:03,040
We don’t assume intent held because the policy executed.
1430
01:18:03,040 –> 01:18:05,160
We align teams to behavior.
1431
01:18:05,160 –> 01:18:10,560
Content platform owns the creation ratio and safe spacing constraints.
1432
01:18:10,560 –> 01:18:15,000
Records management owns survival hit rates and label arrival distributions against deletion
1433
01:18:15,000 –> 01:18:16,000
times.
1434
01:18:16,000 –> 01:18:22,680
E-discovery owns coverage ratios and execution profiles with location contribution.
1435
01:18:22,680 –> 01:18:27,760
Weekly they meet for 15 minutes with three plots and a decision column.
1436
01:18:27,760 –> 01:18:31,480
Observe, calibrate, intervene, no roll-ups without notes.
1437
01:18:31,480 –> 01:18:34,440
We accept that understanding includes refusal.
1438
01:18:34,440 –> 01:18:39,080
For classes of content where the business does not need discoverability or recovery, we
1439
01:18:39,080 –> 01:18:42,920
document that they will die before governance ever sees them.
1440
01:18:42,920 –> 01:18:47,200
We make no implied promises when we know the clocks won’t meet.
1441
01:18:47,200 –> 01:18:51,800
That is understanding in practice an explicit negative, not a quiet hope.
1442
01:18:51,800 –> 01:18:54,200
We add one more quiet discipline.
1443
01:18:54,200 –> 01:18:59,360
When a result surprises a stakeholder, a missing recording, a course, roll-back, a flat
1444
01:18:59,360 –> 01:19:02,680
search, we run a drift review, not a fix it review.
1445
01:19:02,680 –> 01:19:05,440
We replay the three loops with the dials.
1446
01:19:05,440 –> 01:19:11,680
We show where creation compressed, where survival ended, where discovery reflected persistence.
1447
01:19:11,680 –> 01:19:13,720
We update constraints or processes.
1448
01:19:13,720 –> 01:19:18,040
We avoid inventing exceptions that contradict the system’s behavior.
1449
01:19:18,040 –> 01:19:22,480
That’s when we realized we were not trying to make the system behave like our narrative.
1450
01:19:22,480 –> 01:19:27,480
We were trying to write a narrative that matched observed behavior and could be verified
1451
01:19:27,480 –> 01:19:29,160
on the next run.
1452
01:19:29,160 –> 01:19:33,920
Understanding beats fixing, because correctness without meaning is the easiest state for
1453
01:19:33,920 –> 01:19:35,600
a complex system to hold.
1454
01:19:35,600 –> 01:19:39,120
It will obligeingly repeat, so we ran it one more time and then we stopped.
1455
01:19:39,120 –> 01:19:40,520
The outcome was correct.
1456
01:19:40,520 –> 01:19:42,520
Our interpretation changed.
1457
01:19:42,520 –> 01:19:46,720
The sentence that closed the loop holds, if your results never change, your governing
1458
01:19:46,720 –> 01:19:49,240
repetition, not reality.
1459
01:19:49,240 –> 01:19:50,880
One sentence take away.
1460
01:19:50,880 –> 01:19:55,760
If your results never change, your governing repetition, not reality.
1461
01:19:55,760 –> 01:20:01,120
If this reframed how you read green, subscribe and set your first alert for flat discovery
1462
01:20:01,120 –> 01:20:06,480
on rising activity, then watch this next episode where we instrument creation, survival,
1463
01:20:06,480 –> 01:20:10,120
and discovery in a life tenant and reconcile variance on air.
