Forum Discussion

AZLearner's avatar
AZLearner
Copper Contributor
Nov 06, 2019

eDiscovery: How to search based on users, IMs, and Teams channels?

Hi, I need to search all Teams messages sent/received by a set of specific users. If I understand correctly, one-to-one and one-to-many messages are listed as "IM (Instant Message)" type but how do ...
VasilMichev's avatar
VasilMichev
MVP
Nov 07, 2019

Simply use the kind:IM keyword. For more details, review the documentation.

  • AZLearner's avatar
    AZLearner
    Copper Contributor
    Nov 07, 2019

    VasilMichev 

    By kind:IM, I assume you meant this?

    I am new to eDiscovery and use the UI in protection.office.com web interface..

    Thanks,

    • Kevin_Morgan's avatar
      Kevin_Morgan
      Iron Contributor
      Nov 07, 2019

      AZLearner 

       

      VasilMichev is correct. We can simply use the keyword search "kind:im" or "kind:microsoftteams"

       

      I have tried following keyword search queries in Content Search. Both are working fine.

      from:username@yourdomain.com AND kind:im
from:username@yourdomain.com AND kind:microsoftteams

      "kind:microsoftteams" - returns items from chats, meetings, and calls in Microsoft Teams.

       

      I have tried this test using Content Search (https://protection.office.com/contentsearchbeta?ContentOnly=1) - not in eDiscovery.

       

      You can refer https://docs.microsoft.com/en-us/microsoft-365/compliance/keyword-queries-and-search-conditions post to know more details about keyword queries with Email properties in Content Search.

       

Resources