Did someone say something? or Do you just need to document what has been said for later?

Here is how you can use eDiscovery to get chat and channel history. In this guide I use the two following scenarios:

1. I need to find a chat with one certain keyword

2. I need to find all chats with a certain user or between certain users.

Here is what it looks like:

Search result from a private chat
search result from a channel

Here is what you need to do:

1. Get an admin to grant you an eDiscovery Role. You need this in order to view or pull reports. Have a conversation with your organization about having a manager or a reader role. There are plenty of roles to choose from but you MUST have a reviewer role to see the preview-results

How to set eDiscovery Manager premissions
Select the user and remember to click Save.

2. Now it is time to create an eDiscovery Search. Logon with our user that has the new rights (remember, even a global admin needs to be assigned this right. https://protection.office.com is where you log in. Then click “Search” and “Content Search”

Here is what the new search experience look like. You may switch back to the old one if you want to, black circle.

3. It is time to create some conditions in order to scope the search. I have images of two conditions below. One where I lookup a keyword and one where I lookup an user or external user. Remember, dont click save just yet. Jump to point 4 first below these images.

Here it will look for the keyword “Kommune”
Here it will look for a specific users interaction on your tenant

4. Now you may modify where to look in order to minimize the time it takes to run the eDiscovery query. Click on Modify and in this scenario I want the first option only for Microsoft Teams. Check the first slider and click save.

The search can also be scoped to users and groups or even teams inside this location picker.

5. While you run eDiscovery, your administrator will be notified by email. It looks like this:

eDiscovery has been executed by me.

6. I prefer the old eDiscovery preview so I will switch to the old panel in order to browse the results. Then select your search, if you do not see it just click refresh. Now on the right side click “Preview Search results” if your query is large it might take some time for the preview to be avaliable.

Time to get your results
This result will get the latest instance when I used the word “Kommune”

7. If you need an element simply click “Get Original item” and your chat string will be downloaded to you as a *.eml

That is it. Simple but with some clicking.

Advertisements