Creating a content search
In this, we learn how to create a content search.
You can use the Content Search eDiscovery tool in the Microsoft 365 compliance center to search for in-place content. This can be email, documents, and instant messaging conversations in your organization. Use this tool to search for content in these Microsoft 365 data sources:
- Exchange Online mailboxes
- SharePoint Online sites and OneDrive for Business accounts
- Microsoft Teams
- Microsoft 365 Groups
- Yammer Groups
Create and run a search
- Firstly, go to https://compliance.microsoft.com and sign in using the credentials of an account that’s been assigned the appropriate permissions.
- Secondly, in the left navigation pane of the Microsoft 365 compliance center, click Show All, and then click Content search.
- Thirdly, on the Content search page, click New search.
- Fourthly, type a name for the search, an optional description that helps identify the search. The name of the search must be unique in your organization.
- Then, on the Locations page, choose the content locations that you want to search. You can search mailboxes, sites, and public folders.
- Exchange mailboxes: Set the toggle to On and then click Choose users, groups, or teams to specify the mailboxes to place on hold. Use the search box to find user mailboxes and distribution groups (to place a hold on the mailboxes of group members) to place on hold.
- SharePoint sites: Set the toggle to On and then click Choose sites to specify SharePoint sites and OneDrive accounts to place on hold. Type the URL for each site that you want to place on hold.
- Exchange public folders: Set the toggle to On to put all public folders in your Exchange Online organization on hold. You can’t choose specific public folders to put on hold. Leave the toggle switch off if you don’t want to put a hold on public folders.
- Keep this checkbox selected to search for Teams content for on-premises users.
- After that, on the Define your search conditions page, type a keyword query and add conditions to the search query if necessary.
- Specify keywords, message properties such as sending and receiving dates, or document properties such as file names or the date of the last document. You can use more complex queries that use a Boolean operator, such as AND, OR, NOT, and NEAR.
- Alternatively, you can click the Show keyword list checkbox and type a keyword in each row. If you do this, the keywords on each row are connected by a logical operator (c:s) that is similar in functionality to the OR operator in the search query that’s created.
- You can add search conditions to narrow a search and return a more refined set of results. Each condition adds a clause to the search query that is created and runs when you start the search. A condition logically connects to the keyword query by a logical operator (c:c) that is similar in functionality to the AND operator.
- Lastly, review the search settings (and edit if necessary), and then submit the search to start it. And, to access this content search again or access other content searches listed on the Content search page, select the search and then click Open.
Reference: Microsoft Documentation