Universities finding their E3 subscription level limiting, using 3rd party software to fill in the gaps

Numerous articles have been written about the advantages and disadvantages of moving email from an on-premise system to a cloud-based one. For educational institutions running a fully on-premise email environment, the in-house system offers extensive flexibility and control – but the university is 100 percent responsible for its operation and security. As these institutions migrate to cloud-based services such as Microsoft 365, that responsibility becomes shared. Solution providers, like Microsoft, manage the physical infrastructure, security, and networking. For the university, this means no longer needing to build out data centers or being wholly responsible for setting up network controls. The downside is that institutions may feel that they’re limited to the management and compliance tools that the provider supplies.

For example, many universities are using Microsoft 365 with great success from a user perspective. From a compliance standpoint, though, the typical E3 subscription level is limiting for their IT and Compliance departments. In order to maximize their O365 tool, educational institutions would have to pay for the E5 subscription – an additional $100K or more, depending on the number of users/students.


Advanced compliance and analytic tools are NOT included with the basic Microsoft 365 E3 subscription

As a more cost-effective alternative, universities implement third-party compliance tools, such as Sherpa’s Altitude platform, to fill in the necessary gaps without overextending their budgets. The compliance features of Altitude are not tied to any particular Microsoft 365 tier, allowing you to bypass the additional costs of upgrading your subscription to the E5 level while enjoying the same full scope of security and compliance features. What’s more, these capabilities apply not only for your cloud-based email, but for your on-premise data as well.

Even at the premium E5 level – which includes full access to the Microsoft 365 Compliance Center – there are areas where the data governance capabilities of the platform fall short. Specialized software such as Altitude can provide your compliance, risk, and legal teams with supplemental capabilities that extend their data governance oversight of Microsoft 365 content in a few ways. Here are some examples:

  • Identify and manage content across your environment, including user workstations
  • Support for additional unstructured content sources
  • Robust retention policy enforcement
  • Rapid ediscovery search and collection with robust search criteria
  • Search across all content types, including PCI/PII data
  • Custodian legal hold notification
  • Minimize the risk of costly data breaches

Conducting a data inventory can help accurately assess exposure to compliance initiatives like PCI, HIPAA, CCPA, and GDPR. If suspect content is uncovered, Altitude can relocate it to a secure audit location or even permanently delete it from the environment, including removal from workstations. Microsoft 365 does a great job with email and related content stored in SharePoint or OneDrive, but that’s where its reach ends. Altitude is designed with a modular architecture which targets specific content sources. Altitude supports all Microsoft email containers (mailbox, archive, PST) as well as content stored in the Windows file system and local workstations. This allows IT and legal teams to conduct eDiscovery searches or apply retention controls to content located on network file shares and local workstations. Using this approach, universities can successfully reclaim a significant amount of network storage capacity and streamline their eDiscovery process.

While Microsoft 365 does support some rudimentary retention rules for email, it is largely limited to (a) selecting messages based on an age or date, then (b) either deleting those messages or moving them to the archive. Mature retention policies often require a more sophisticated set of rules. Altitude retention workflows select message or file content based upon a wide variety of criteria, then take advanced actions on those items.

Many tiers of Microsoft 365 offer the ability to ‘preserve’ content by placing a mailbox owner on legal hold. Legal Hold Notification is the process of officially informing custodians that they have been named as part of a legal hold preservation order, instructing them on their responsibility to preserve content, and soliciting feedback on other relevant material that they may possess (i.e. paper files or thumb drives). Altitude supplements the native Microsoft 365 preservation by electronically notifying custodians that a hold has been enacted, tracking their acknowledgment of that notice, and reminding them on a recurring basis of their preservation responsibility.

If you would like to learn more about how Sherpa Software products can supplement your Microsoft 365 deployment, please visit www.sherpasoftware.com.

Feel free to download our complimentary white paper “Why Microsoft 365 is Not Enough.”