Continuing our articles on Microsoft 365 Lessons Learned, we will briefly discuss exporting Workplace Chat Data (Microsoft Teams) out of O365. In a later article, we will discuss using the exported data in our eDiscovery tool: VenioOnDemand.
For our purposes, extracting Teams data continues to become more and more of an important element. There can often be crucial information that was not shared over a formal email, but instead through chat on Microsoft Teams. We were recently tasked with extracting Teams data for a large project and found that going about this task was not as intuitive as anticipated.
Within the core eDiscovery, initially our assumption was that the best place to search for Teams data would be during the location phase of search setup. Within the Exchange mailboxes location, Microsoft Teams data is clearly highlighted as one of the options.
We ensured to check this option thinking this would give us the Teams results we needed. However, this method will only yield results if you have a specific server site for your Microsoft Teams data. In our case, we did not have a specific server site for the Teams data.
Content Search and using the Keyword Search:
We then attempted to use the filters to see if there was any filter that allows us to search for only Teams Data. However, there was no condition that allows to filter based on the data type. This is when we did some research and came across some searches that can be used to search specifically for Teams Data. From our research, we were able to find a couple of searches that would yield the desired results.
Below is a list of Keywords and searches that can be used in O365 as well as the type of results you will get by running these searches in O365 eDiscovery.
Search Condition:
- Kind: MicrosoftTeams = Items from Chats, Messages and Calls in Teams
- Itemclass:IPM.SkypeTeams.Message = Items from chats and convos only
- Item.Class:IPM.AppointmentSnapshop.Skype.Teams.Call = Chat during meetings.
- Participants: [email] = People who sent or received a message
In our case, we ran our searches in the Content Search section of O365 (although these keywords can be used in both Advanced and Core eDiscovery). We specifically used ran the search: itemclass:IPM.SkypeTeams.Message. This yielded the documents we desired.
As you can see in the image above, we were also able to combine the search with other conditions (in our case we were able to combine it with a specific date range).
We were then able to export the results and ingest them into Venio One. Next week, we will discuss searching through and working with these results in our eDiscovery tool.
Useful Video: Manage eDiscovery for Microsoft Teams – YouTube
Would you like to learn more about our services? Email [email protected] or call 289-803-9730. We would be happy to share more details about our self-service or fully managed eDiscovery services!
