📖 What is Content Search?
Content Search is a tool within the Microsoft Purview compliance portal used to find information across all Microsoft 365 services. It allows administrators to search for specific keywords or patterns across mailboxes, SharePoint sites, and OneDrive accounts for legal or investigative purposes.
"This is the foundational tool for eDiscovery; remember that you need specific 'eDiscovery Manager' roles to perform these searches."
📚 Certification: Microsoft 365 Administrator (MS-102)
🔑 What are the Key Concepts of Content Search?
- ▸ Utilizes Keyword Query Language (KQL) to perform precise searches using boolean operators and property restrictions to filter specific metadata or content.
- ▸ Covers a broad scope of data including Exchange mailboxes, SharePoint sites, OneDrive for Business accounts, and Teams chat history.
- ▸ Requires specific role assignments in the Microsoft Purview compliance portal, as Global Administrator permissions do not automatically grant search access.
- ▸ Serves as the primary mechanism for identifying data before it is exported to PST files or used within an eDiscovery case.
- ▸ Allows for the preview of search results to verify accuracy before initiating a full export of the identified content.
🎯 How does Content Search appear on the MS-102 Exam?
You may be asked to identify the correct tool to use when a legal team requests a search for all documents containing a specific keyword across all OneDrive accounts and SharePoint sites without needing to place a legal hold.
A scenario might describe a situation where an administrator has Global Admin rights but cannot find or run a Content Search; you must identify that the eDiscovery Manager role is required.
Expect questions about the difference between a basic Content Search and eDiscovery Standard, specifically regarding whether the requirement is simply to find data or to preserve it via a legal hold.
❓ Frequently Asked Questions
Does Content Search include Microsoft Teams messages?
Yes, Teams messages are stored in hidden folders within the user's Exchange mailbox and the group's mailbox, making them fully searchable through the Content Search tool using KQL.
What is the difference between Content Search and eDiscovery?
Content Search is used solely for finding and exporting data. eDiscovery builds upon this by adding case management and the ability to place legal holds to prevent data deletion.
Can a Global Administrator perform a Content Search by default?
No, the Global Administrator role does not include the permissions to search content. You must explicitly assign the eDiscovery Manager or eDiscovery Administrator role in the Purview portal.