Portable components that stay in sync and move freely across Microsoft 365 apps

– Damir Kahvedžić, Ph.D. and Ryan Hemmel –

Ever since being released in 2016, Microsoft Teams has become the de facto standard in corporate collaborative chat software. It has subsumed Microsoft Classrooms1 and Skype for Business2 and is a serious challenger to Slack and Zoom3. In the aftermath of COVID-19 and subsequent lockdowns around the globe, Teams usage has further skyrocketed4. Microsoft has invested significant energy into developing Teams, and new features have been integrated at a brisk pace. Not only has the pace of change given us some hilarious Teams usage fails as users come to grips with the new features, but it has also introduced several compliance and eDiscovery challenges. How can we keep up with these changes and present a comprehensive and accurate data set to our clients? Sometimes not even Microsoft has an answer.

Exhibit A: Microsoft Loop components. Loop components were introduced to Microsoft Teams last year, allowing chat participants to collaboratively edit a single message in real time across multiple Microsoft 365 tools5. The problem is that Loop components are saved as custom independent files in OneDrive, and once collected, there is no way to review the contents. There are no tools within Microsoft or otherwise that can accurately display the content within a Loop component. Microsoft’s own advice is to turn the feature off if this presents a problem for discovery or compliance. Given that Loop is enabled by default, this guidance may come too late for clients deep into their litigations when their users have already generated and shared Loop content.

Let’s explore Loop components and the challenges they present.

What are Loop Components?

Loop components are a new Microsoft data type allowing users to create sharable content that can be modified collaboratively by multiple users across many Microsoft 365 applications, including Teams, Outlook, and Word. Any user with access to the chat, email, or file where a Loop component is shared can collectively edit the contents of that Loop. Think of them as much smaller shared Microsoft 365 documents. Where a document is a large object containing lots of different content, a Loop is a small object (a list, a table, a small piece of text) that can be embedded within other applications, in our case a Teams chat. In both cases, documents and Loop components, when the resource is edited in one location, the changes are propagated in real time to all locations where the file has been shared.

Figure 1. Loop components in the Teams interface with a sample list Loop

Currently, six types of Loop components can be created in Teams: Bulleted List, Checklist, Numbered List, Paragraph, Table, and Task List. Regardless of type, the Loop component is stored as a file with a .fluid extension in the OneDrive of the person who created it. It is simply presented as a link in any target document that displays it. They are essentially treated as a new type of modern attachment.

What’s the Problem?

A new feature is not necessarily good news for eDiscovery or compliance. Here are just a few issues that we have identified:

Collection Is Difficult

The Loop component is a new binary file type viewable only in Microsoft 365 applications. The .fluid file in which the data is stored cannot be previewed or processed using Microsoft’s own eDiscovery platform, Purview, or with other processing tools. The file is not indexed and thus will not be found when performing a keyword search to look for content within the Loop component.

Instead, the file can only be collected as part of a general sweep of documents in a custodian’s OneDrive or, since it is a modern attachment, as part of a collection targeting data types where that Loop is shared, such as a Teams chat. Microsoft Purview eDiscovery Premium is needed to collect modern attachments.

No Native Review

Microsoft 365 Purview exports a native fluid file and a text file of the extracted text. There is no offline viewer for the native, and the corresponding text file is an empty 0KB file.

Microsoft is currently working on an “offline consumable export format” to address this issue, but there is no date for when this will become available. The only solution for viewing the file is for users to upload the file into their own Microsoft 365 instance and view it there. This is obviously not an appropriate solution in controlled eDiscovery environments. Relativity viewer integration is even further off.

Audit and History Tracking is Tricky

The main purpose of Loop components is continuous collaborative editing of content. If we could review the fluid files, we would also like to know who edited what part of the component and when. A typical scenario is an old Loop component being edited now. When doing collections within a certain time range, we would want to see the version of the Loop during the specified period, not the most current one. True, this is an issue in any modern attachments, such as a Word or Excel file, but it is doubly important for Loop components since collaborative editing is the entire point of their existence.

The good news is that Microsoft is planning to roll out a feature that will allow the collection of a modern attachment’s version as it was when the document was shared. It will be interesting to see how this is handled with fluid files since their content is much more (dare I say it) fluid than the file analogues.

Figure 2: Versions of a sample Loop

Handling Loop Components

Relativity Review

It is possible that Loop files form parts of document deliveries already. These files would have a .fluid extension and can be easily found by searching for that extension. Relativity can’t process the binary file and would flag the documents as Relativity Native Type: Unknown format.

Interestingly, Relativity does extract some text from the native fluid file. Even though the file is a binary file, some elements of the Loop are found in clear text and are therefore searchable. For example, the below extracted text was found for the Loop in the screenshot at the top of the page. The user-added content is found as text within the Loop binary. Of course, this just finds text. It does not show the formatting, audit, images, or structure of the Loop. But in the absence of anything else, it is something.

Figure 3: Extracted text of a sample Loop

Turning Off Loop

Given the issues that Loop components present for eDiscovery and compliance, some organizations may wish to disable them within their Microsoft 365 tenant. To do so, Microsoft 365 administrators can use the latest version of the SharePoint PowerShell module. After connecting to the module, run the command Get-SPOTenant | Select- Object -Property IsFluidEnabled to verify that the value for IsFluidEnabled is set to true. To disable Loop components, run the command Set -SPOTenant -IsFluidEnabled $false.

Figure 4: Disabling Loop via PowerShell

Per Microsoft, this change can take a short time to apply across your organization’s Microsoft 365 tenant. If your organization has multiple regions and/or Microsoft 365 tenants, you will need to disable Loop components in each of those regions/tenants.

Once disabled, the Loop button will no longer appear for end users within the Teams client. Previously shared Loop components will no longer render within Teams but will instead be displayed with the text “Loop component,” which links to the component within SharePoint/OneDrive.

Figure 5: Behavior in Teams after disabling Loop

Is This Really a Problem?

New software, new data types, and new files are constantly being developed. We can’t expect our favorite eDiscovery platforms to support every type of file out there. So what’s the problem? Given that 270 million people use Teams in their day-to-day working lives and that remote work is here to stay, it is safe to say that Loop components will feature in many a data set in the future6.

The Loop feature is on by default in all Microsoft 365 tenants. Loop components have been recognized as a significant Teams addition by Microsoft, and Microsoft has announced plans to further expand Loop capabilities. At ProSearch, we have already seen data sets with Loop components in them. They will quickly become an unavoidable data type within discovery collections.

By the time clients realize they are a problem for litigation, it may be too late. There may be relevant content in Loop components that litigation teams will want to review. ProSearch’s Microsoft 365 Advisory Services team has a finger on the pulse of the latest developments and keeps clients informed of them so that they can identify issues before they become a problem. For more information on Loop components, or any other Microsoft 365 features, contact Damir Kahvedžić, or Ryan Hemmel.

1 https://support.microsoft.com/en-us/topic/microsoft-teams-5aa4431a-8a3c-4aa5-87a6-b6401abea114?redirectSourcePath=%252farti- cle%252faea2bae4-40d3-4a10-bd69-ea8fc7313795

2 https://learn.microsoft.com/en-us/microsoftteams/skype-for-business-online-retirement

3 https://zapier.com/blog/zoom-vs-teams/

4 https://www.windowscentral.com/microsoft-teams-now-has-more-270-million-monthly-active-users

5 https://learn.microsoft.com/en-us/microsoftteams/loop-components-in-teams

6 https://www.businessofapps.com/data/microsoft-teams-statistics/

 

View Original PDF

Filed under:

Whitepapers
Damir Kahvedžić

Damir Kahvedžić

Damir Kahvedžić is a technology expert specializing in providing clients with technical assistance in eDiscovery and Forensics cases. He has a PhD in Cybercrime and Digital Forensics Investigations from the Centre for Cybercrime Investigation in UCD and holds a first-class Honours B.Sc in Computer Science. Experienced in the use of industry leading software, such as Relativity, EnCase, NUIX, Cellebrite, Clearwell, and Brainspace, Damir is also a PRINCE2 and PECB ISO 21500 qualified project manager. Damir has published both academic and technical papers at several international conferences and journals including the European Academy of Law, Digital Forensic Research Workshop (DFRWS), Journal of Digital Forensics and Law amongst others.