Content Search within the Security and Compliance Center enables administrators to perform a search for Microsoft Teams data across SharePoint Online, Exchange Online and OneDrive for Business.
Every Microsoft Team is supported by an Office 365 Modern Group, which includes a Group SharePoint site and Exchange Online mailbox. Both Private and Channel chats are stored in the Azure Powered Chat Service.
In addition, Private Chats (including group chats) get copied to a hidden folder within the users’ mailboxes involved in the chat, and Channel Chats get copied to a hidden folder in the Exchange Online mailbox of the Office 365 Group.
In this example we will set up two content searches. One to look for all files and conversations regarding designs and calculations within a Team, and another to look for all chat conversations that reference the project designs.
Searching within a whole Team
First of all, we will set up a search to look within our team for any files that have been uploaded/shared that contain references to the design and calculations for the project. To do this we create a new search.
We then give the search a name, and select the locations for the search. In this case we select the Team’s Office 365 Group mailbox, and add the URL for the Team’s SharePoint site.
To narrow the search results, we create a query that will search for the keywords design and calculations (in this case this acts with an OR operator) and a date range after the initiation of the project on the 1st February 2018.
When we hit search, this will create a new search and show us the statistics and allow us to preview the results.
As you can see, this returns an Excel file and an IM referencing our search terms. This is great if we want to find references in Channel Chat or the document library for the Team, but what if we want to look for conversations about the project that take place outside of Channel Chat, i.e. chat conversations between users within Teams.
Search for all conversations
In this example we will create a search to look at all users for references to Project T-Rex designs. We again create a new search, however, this time in the search locations we will select All Mailboxes and we won’t specify any SharePoint sites.
In this query we will get a little more advanced, and use the (c:c) operator to look for design AND Project T-Rex in messages.
When you hit search, you will be given the same overview statistics information, and when we preview the results you can see an example of the messages returned.
So here you can see a couple of examples of how you can use Content Search within the Office 365 Security and Compliance Center to identify content within Microsoft Teams.