Microsoft 365 eDiscovery & Teams; trouble finding 1:1 chat

Posted by dnuohxof-1@reddit | sysadmin | View on Reddit | 10 comments

Wondering if I can get some tips here as Google isn’t helping and Reddit is very thin on this subject. I have a request to find any chats between Jane Smith and Joe Shmidt I create a eDiscovery, set Jane and Joe as custodians, and run a query. But what comes back feels incongruent from my search. I find group chats and things from other people that don’t match my search terms. All I need is a damn transcript of Jane and Joes 1:1 chat. Why is that so hard compared to discovering emails and documents…

Reply to Post

10 Comments

[-]

DesolationUSA@reddit

What you actually want is 'Content Search' in the left hand pannel. Under Locations, turn on Exchange Mailboxes. Under 'Define your search conditions' select the KQL Editer. Input the following: kind=microsoftteams Now select back to Query Builder. The KQL will still affect the search. Then simply use 'Add condition' to input one condition for the 'Date' range and another for the 'Sender(s). This should auto find by username as to easily select the correct one. Once the search has completed, under 'Actions' chose Export results. Under 'Output Options' leave the first dot selected. under 'Export Exchange content as' I select 'Individual messages' (This makes every teams message an individual .msg file so I can easily find an exact message by time stamp). I personally also always select the checkbox for 'Enable de-duplication for Exchange content'. !A WARNING! In my experience it is never a good idea to check the 'Export files in a compressed folder...' option. For some damn reason Microsoft always limits the download of these to single digit KBs. Once the export is complete you can download the folder and it will be auto separated by users email and each .msg will have the correct date and within 1-3 minute accurate time stamps. With them being .msg files it also means File Explorers search can search the contents within each if you aren't sure when exactly it happened.

[-]

ITGuyThrow07@reddit

You haven't really said specifically what you tried, but 1-to-1 chats are stored in the user's mailboxes, so first off make sure you scope the Content Search to just their mailboxes. Then for Message Kind, you want "microsoftteams". https://learn.microsoft.com/en-us/purview/ediscovery-keyword-queries-and-search-conditions#search-conditions. Then I assume you'd want to set your date and sender/recipients appropriately. Teams messages from Content Search are a nightmare to go through. Each message is stored as a .msg file. Unless something has changed and I missed it, there's no easy way to go through them.

[-]

dnuohxof-1@reddit (OP)

So my data source is just the 2 users mailboxes and then the Collection Search is scoped to the Teams chats. I updated my post with the raw query. My issue is from the Review Set, I see threads for group chats both are members of, I just want their 1:1 and I can’t figure out the right query to scope just that. It seems no matter what some group or other chats with mentions get lumped into the search.

[-]

kev-tron@reddit

I usually will just search one users mailbox and add the other person in the filter for "sender/author". I'll then load the pst in Outlook and sort the teams messages by the 'To' field within the folder. I collapse all the now categorized messages and find the messages that only contains the owner of the mailbox. This should show the messages that were sent directly to the user of the mailbox. I'd move these to a separate folder. Unfortunately, you will have to repeat this step vice versa to get the other side of the chat.

[-]

YSFKJDGS@reddit

Honestly this probably won't help you, but what I have done is just run a search that will grab the data (obviously more than you need), then I just export those results into a single PST file and then just made a powershell thing to use outlook COM objects to parse the pst file and find messages. Since they basically show up as 'email' in pst files, you look for messages sent and received between the two people and then can either extract or parse based off of that.

[-]

Smart_Dumb@reddit

Trying to audit anything in 365 sucks. I have items in a SharePoint site recycle bin showing a former employee deleting items systematically. But if I try to run an Audit search for that exact scenario, nothing comes up.

[-]

cetrius_hibernia@reddit

Premium ediscovery will output it in the way the chat is formatted, rather than individual messages. However you need a license up to use it (E5, I think)

[-]

dnuohxof-1@reddit (OP)

I do have E5 and am using Premium ediscovery. I can see threads in the Review Set and for example the group chats are lumped, but it’s not like say, just logging into Jane’s account and opening teams and clicking Joes name and export the transcript. I’m only getting pieces of Jane and Joes messages and can’t tell if I’m missing content or if there just that long of gap between chats and it’s not in a single thread. Review Sets seem to break all chats up by a string of time. If Jane messages Joe on July 4th and there’s no activity until July 18th, it shows as two different threads and there’s no way to link them into one single transcript (at least that I can find)

[-]

--_II_--@reddit

Sounds like you're stuck in eDiscovery hell. It's notoriously tricky with Teams. Instead of setting both as custodians, try running a search with Jane as the custodian and filter for communications with Joe, and vice versa. Might save you from the group chat noise.

[-]

dnuohxof-1@reddit (OP)

Hell, it is. I have tried that and I get some pieces but not others. One query combo I seemed to have gotten a 1:1 thread but was just 2-3 messages. And then found another 2 messages on their own, so I couldn’t tell if they were part of a different chat or there was just a huge gap in time in the teams chat.