Microsoft Teams is a powerful collaboration tool. As an admin, you need to know how to search for chat and channel messages. In this guide, we will cover various search options. Firstly, the standard user search option, secondly, the Content search and eDiscovery standard options for admins and finally, eDiscovery premium for complex needs. We’ll explain each option’s benefits and limitations to help you choose the best option for your needs.
Overview
Teams chat and channel conversations are displayed to users in a threaded message format. This shows the original message along with any responses and reactions to the post. The image below shows an example of a message, the reactions to the message and the two responses.
From an administrator’s point of view, it is crucial to view the complete message thread as the responses might be pertinent to the search purpose. I describe three different ways to search for three messages, and as you will see, administrators do not always have a user-friendly experience when searching for Teams message content.
I have created a video for Empowering Cloud walking through the three different ways to search for Teams messages.
Option 1: Use User Search to search for Teams messages
Standard user search in Teams provides a straightforward way for users to find messages, people, files, and other information shared within the platform. It is a great way for a user to search for Teams chats or channels messages they are a member of and to return the full threaded conversation. Users cannot search for content that they do not have permissions to see. Here are the key steps for conducting a standard user search:
Search Box: Start any search by typing keywords into the search box at the top of Teams. As you type, Teams will show related results. You can either choose one of the suggested items or press Enter to get a full list.
Ctrl+F (Cmd+F on macOS): To search messages within a particular chat or channel, press Ctrl+F (Cmd+F on macOS). Choose the area you want to search, such as a recent chat or a specific channel within a team. Enter your search terms and press Go. Teams will display the search results within the “Find in chat” option.
Filter Results: After entering your search terms, select the Messages tab to to refine your search to just the Team chat and channel messages.
You can further filter your Teams message by chats or channel messages, a specific Team or channel and more.
When you select a message to view, you see the full threaded conversation so the original message, any reactions, ant message responses and any linked content. If the message is a channel message you also have the option to go to the channel.
Benefits of using User Search to search for Teams messages
- The search function is user-friendly and returns results within the Teams platform, allowing you to see the full threaded conversation.
- Furthermore, search results are security trimmed ensuring that you only see content that you have permission to view.
Limitations of using User Search to search for Teams messages
- This is an end user search and not an admin search.
- Due to security trimming, searching across the tenant is not possible. The results returns will only show content the user has access to.
Option 2: Use Content Search or eDiscovery Standard to search for Teams messages
If you are an admin with the eDiscovery Manager role you can use Microsoft Content Search or eDiscovery Standard to search all content n Microsoft Teams. You can search for chat messages, posts, attachments, and more. However the major limitation with Content Search is that it does not return the threaded messaged, it only returns the individual messages. This is because eDiscovery searches the compliance copies of each messages stored in the user or group mailbox and returns the individual matches.
As Content Search and eDiscovery Standard search functionality is similar I will walk through Content Search.
From the Microsoft Purview Compliance Portal navigate to the Content search section and Click on “New search” on the Content search page to create a New Search and enter an appropriate name and description.
Then Select Search Locations and choose the Exchange Online mailboxes as the location you want to search. This is because the compliance copies of the Teams messages are stored in either the group or user mailboxes.
The next step is to decide which mailboxes to search as Teams messages are stored in different locations depending on the message type. The table below shows where each message type is stored.
| Teams Message type | Search Location |
|---|---|
| Teams 1 to 1 chats | Mailboxes of users in the chat |
| Teams group chats | Mailboxes of users in the chat |
| Teams standard channel conversations | Mailbox of the Microsoft Group related to the Team |
| Teams private channel conversations | Mailboxes of users in the private channel |
| Teams shared channel conversations | Mailbox of the Microsoft Group related to the Team |
For instance, if you are trying to search across five Teams, you can add the five group mailboxes. However, it is important to check whether any Teams have private channels. This is because private channels require searching the mailboxes of private channel members as well.
To check if a Team has private channels and to list the members of a private channel, you can use Teams PowerShell.
Get-TeamChannel -GroupId "GroupId" -MembershipType PrivateNext for each Private channel get a list of members in the private channel.
Get-TeamChannelUser -GroupId "GroupId" -DisplayName "Channel Display Name"After running the scripts and identifying private channels in a team, you can include the list of user mailboxes as well as the group mails in the search locations. This will ensure that you don’t miss any important correspondence or information related to your team’s private channels.
If you have on-premises users make sure you select the Add app content for on-premises users checkbox. Read this Microsoft Guide for full searching the Teams chat messages for on-premises users .Search for and export Teams chat data for on-premises users | Microsoft Learn
Refine Your Search with Keywords and Conditions:
To refine your search results, you can specify relevant keywords or conditions. In this case, let’s search for the keyword “award”. To add multiple keywords, it’s best to use a keyword list. Additionally, you can use the query builder or Keyword Query Language to create more advanced searches, but that’s beyond the scope of today’s discussion. However, I will cover this in detail in a future blog post.
Select submit to start the search. The search may take some time based on the number of locations to be searched. Once the search is marked as completed, you can view the results.
The system will display the number of content locations and an estimated number of search results.
Analyse Your Search Results:
After the search completes, you can preview the results or export them to a local computer.
The review sample will display a random selection of up to a 100 items per location, with a maximum of 1000 items across all locations. You can view the contents of a message by selecting it. However, it’s important to note that Teams messages are displayed individually and not as part of a threaded conversation, as you would normally see in Teams or in the user search.
You can choose to export the results to a PST file, but please be aware that Teams messages will be displayed as individual messages rather than as a message thread. This is a significant limitation of both Content Search and eDiscovery Standard. To obtain threaded Team messages, you will need to use eDiscovery Premium, but this will require E5 Compliance licenses for the users who are subject to the search.
Benefits of using Content Search or eDiscovery Standard to search for Teams messages
- Admins who belong to the eDiscovery Manager role group have the ability to search all content in the tenant.
- Additional Microsoft licensing is not required.
Limitations of using Content Search or eDiscovery Standard to search for Teams messages
- You are only able to view isolated messages, and not the entire Teams message thread.
Option 3: Use eDiscovery Premium to search for Teams messages
eDiscovery Premium is only available if you A5/E5/G5 licensing, see subscription requirements for full details. The key benefit for admins needing to search for Teams messages is that eDiscovery Premium will reconstruct the threaded Teams messages and show the reactions.
As an admin with the Discovery Manager role, navigating to the Microsoft Purview compliance portal and selecting eDiscovery Premium is a straightforward process. From there, create a New case. As we are not using discussing the full capabilities of eDiscovery in this blog we will just create a search query for Teams messages by selecting Collections and New Collection. Skip past custodians and non custodian locations pages. On the Additional locations page add in the Exchange mailbox locations for the group and user mailboxes in scope. You now have a additional search options that allow you to include Teams shared channel in scope of the search.
Then create you query. In this scenario search for the keyword award. Note eDiscovery Premium has a new search interface so will look slightly different to Content Search.
Once the Collection status shows Estimated and the Estimate status shows Successful, you can proceed to review a summary of the results. This allows you to check if the search criteria is correct and provides an option to edit the search query and make the necessary changes. Once done, you can Commit the Collection to a Review set which will allow you to access and view all the results. After updating the Collection status to Committed, click on the Review Set name to view the search results.
You can now refine your search by adding more filters and see all search results. To view the contents of an item, select it from the list, and its details will appear in the box on the right side of the screen.
The box is very small, therefore select the arrow at the top right corner of the box to expand the item to full screen. Now, it is now easier to see the entire conversation thread, including reactions, attached files, and Giphys.
If required you have the option to export the Teams messages.
Benefits of using eDiscovery Premium to search for Teams messages
- Admins who belong to the eDiscovery Manager role group have the ability to search all content in the tenant,
- The search results in the review Set show the threaded conversations for Teams messages.
Limitations of using eDiscovery Premium to search for Teams messages
- Requires A5/E5/G5 licensing. See subscription requirements for full details.
Summary
Efficient management and compliance in Teams requires mastering search capabilities, including knowing where to search and which tool to use. We have looked at three ways to search for Teams messages and shown the benefits and limitations of each approach.
| Search Type | Scope | Benefits | Limitations |
|---|---|---|---|
| User Search | End users | The search function is user-friendly and returns results within the Teams platform, allowing you to see the full threaded conversation. Furthermore, search results are security trimmed ensuring that you only see content that you have permission to view. | This is an end user search and not an admin search. Due to security trimming, searching across the tenant is not possible. The results returns will only show content the user has access to. |
| Content Search or eDiscovery Standard | Admins | Admins who belong to the eDiscovery Manager role group have the ability to search all content in the tenant. Additional Microsoft licensing is not required. | You are only able to view isolated messages, and not the entire Teams message thread. |
| eDiscovery Premium | Admins | Admins who belong to the eDiscovery Manager role group have the ability to search all content in the tenant. The search results in the review Set show the threaded conversations for Teams messages. | Requires A5/E5/G5 licensing. See subscription requirements for full details. |
Want to know more?
I have created a video for Empowering Cloud walking through the three different ways to search for Teams messages.
Microsoft References
- Overview of Content Search | Microsoft Learn
- Overview of the eDiscovery (Premium) solution in Microsoft Purview | Microsoft Learn
- Use Content Search in Microsoft Teams | Microsoft Learn
- Search for and export Teams chat data for on-premises users | Microsoft Learn
- Feature reference for Content search | Microsoft Learn