Forum Discussion
eDiscovery: How to search based on users, IMs, and Teams channels?
Hi,
I need to search all Teams messages sent/received by a set of specific users. If I understand correctly, one-to-one and one-to-many messages are listed as "IM (Instant Message)" type but how do I also include those messages sent by these users to the Teams channels in addition to the IM messages? It seems messages sent to a Teams channel are stored in an O365 group so if I include the O365 group in the search, I suppose I also need to enable "E-mail messages" under "type." However, the search results will also include all emails sent by these users which is not what I want to include. How do people do a search to satisfy a simple query: Find all Teams messages sent/received by a set of users?
thanks,
8 Replies
Have you ever figured this out?
I am in the same boat. Posted this https://answers.microsoft.com/en-us/msteams/forum/msteams_tfb-msteams_chatg-msteams_chatser/how-to-search-chat-history-of-someone-in-ms-teams/5387ecc9-ac26-44b9-8ad9-b0242b7ca691
I tried numerous search settings but still no luck.
- Any help would really really be appreciated. I've been trying for 3 mos now
Simply use the kind:IM keyword. For more details, review the documentation.
By kind:IM, I assume you meant this?
I am new to eDiscovery and use the UI in protection.office.com web interface..
Thanks,
VasilMichev is correct. We can simply use the keyword search "kind:im" or "kind:microsoftteams"
I have tried following keyword search queries in Content Search. Both are working fine.
from:username@yourdomain.com AND kind:im from:username@yourdomain.com AND kind:microsoftteams
"kind:microsoftteams" - returns items from chats, meetings, and calls in Microsoft Teams.
I have tried this test using Content Search (https://protection.office.com/contentsearchbeta?ContentOnly=1) - not in eDiscovery.
You can refer https://docs.microsoft.com/en-us/microsoft-365/compliance/keyword-queries-and-search-conditions post to know more details about keyword queries with Email properties in Content Search.
Yes, this search will list all mails sent by the user (Ex: Group Conversations, Planner Comments) along with teams chat.
As you may know :
The actual content of Teams Channel chats are stored in the Azure Storage. In addition, Teams Channel Chats get copied to a hidden folder (\Conversation History\Team Chat) in the Exchange Online mailbox of the Office 365 Group.
So, technically searching mails under the hidden folder (\Conversation History\Team Chat) will return only teams messages. Not sure which tool we can use this kind of search (Content Search or eDiscovery, or some other powershell commands).
Kevin_Morgan wrote:Yes, this search will list all mails sent by the user (Ex: Group Conversations, Planner Comments) along with teams chat.
Based on my tests, it will also include all non-Teams emails the specified users sent which means the result is no longer limited to Teams messages... I am curious if I've set the criteria incorrectly?
