One of the more common questions I’ve been asked last year was how to search IM messages sent in Teams at a global level. The feature named Content Search is used to search IM messages in Teams and the following is a demonstration on how to use it.
Step #1 - Granting permissions for Content Search to search Teams Chat Data
Before you begin by granting the appropriate permissions to the account performing the Content Search by navigating to:
Security > Permissions
Grant the administrator account the following permissions:
- Organization Management
- Compliance Administrator
- eDiscovery Manager< if export is required (https://docs.microsoft.com/en-us/microsoft-365/compliance/assign-ediscovery-permissions?view=o365-worldwide)
Step #2 - Performing Content Search
1. Log into the Microsoft 365 admin console: https://admin.microsoft.com/
2. Click on the Security admin center:
3. Click on Search > Content search:
4. Create a new search by click on New search:
5. Add the appropriate criteria for the search:
The following is how you would configure the search to query the following:
Date: Between 2021-01-26 to 2021-01-27
Keywords: IM < this indicates that only IM messages will be returned
Specific locations: < this is configured for only a specific Teams user
More information on the keywords for queries can be found here:
Keyword queries and search conditions for Content Search and eDiscovery
https://docs.microsoft.com/en-us/microsoft-365/compliance/keyword-queries-and-search-conditions?view=o365-worldwide
6. Initiating search will return the results for the user:
The following is the documentation for Content Search:
Content Search
https://docs.microsoft.com/en-us/microsoft-365/compliance/content-search?view=o365-worldwide