Content Search in the Security & Compliance Center - Searchable Email Properties

%3CLINGO-SUB%20id%3D%22lingo-sub-859782%22%20slang%3D%22en-US%22%3EContent%20Search%20in%20the%20Security%20%26amp%3B%20Compliance%20Center%20-%20Searchable%20Email%20Properties%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-859782%22%20slang%3D%22en-US%22%3E%3CP%3EI%20am%20attempting%20to%20use%20an%20email%20messages%20message-id%20to%20be%20a%20unique%20identifier%20when%20running%20a%20search%20via%20powershell%20within%20the%20Security%20and%20Compliance%20center.%26nbsp%3B%20According%20to%20the%20searchable%20email%20properties%20MS%20link%20below%20a%20message-id%20is%20not%20able%20to%20be%20used%20but%20I%20wanted%20to%20make%20sure%20this%20was%20accurate.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fkeyword-queries-and-search-conditions%23searchable-email-properties%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fkeyword-queries-and-search-conditions%23searchable-email-properties%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20help%2Fconfirmation%20is%20appreciated.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-859782%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EWindows%20PowerShell%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-860564%22%20slang%3D%22en-US%22%3ERe%3A%20Content%20Search%20in%20the%20Security%20%26amp%3B%20Compliance%20Center%20-%20Searchable%20Email%20Properties%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-860564%22%20slang%3D%22en-US%22%3E%3CP%3EThat's%20correct.%20The%20message%20id%20is%20stamped%20as%20a%20header%2C%20and%20we%20cannot%20run%20searches%20against%20headers.%20What%20we%20can%20do%20is%20an%20ID%20search%2C%20but%20the%20ID%20used%20there%20is%20different%20one%3A%26nbsp%3B%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fcsv-file-for-an-id-list-content-search%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fcsv-file-for-an-id-list-content-search%3C%2FA%3E%3C%2FFONT%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Visitor

I am attempting to use an email messages message-id to be a unique identifier when running a search via powershell within the Security and Compliance center.  According to the searchable email properties MS link below a message-id is not able to be used but I wanted to make sure this was accurate.

 

https://docs.microsoft.com/en-us/office365/securitycompliance/keyword-queries-and-search-conditions#...

 

Any help/confirmation is appreciated.

1 Reply

That's correct. The message id is stamped as a header, and we cannot run searches against headers. What we can do is an ID search, but the ID used there is different one: https://docs.microsoft.com/en-us/office365/securitycompliance/csv-file-for-an-id-list-content-search