How can an administrator find Teams messages of a specific user?

To find Teams messages of a specific user using Microsoft Purview, you need to ensure that you are searching the correct content locations. Teams direct messages (1:1 chats) are stored in the Exchange Online mailbox of all chat participants. Therefore, when performing your content search, you should specify the Exchange Online mailbox of the user whose messages you want to find.

Additionally, make sure you are including the appropriate content types in your search query. For Teams messages, you should include the content type for chat messages, which encompasses content in standard Teams channels, 1:1 chats, and group chats.

If you are still not getting results, double-check the date range you are specifying and ensure that the user has indeed sent messages within that timeframe. Also, verify that you have the necessary permissions to access the user's mailbox and that the messages are not subject to any retention policies that might prevent them from being returned in your search results.

Dear @Danny Hernandez,

Thank you for reaching out to Microsoft Q&A forum.
I understand you’re trying to retrieve Teams messages for a specific user via Microsoft Purview. I tested this scenario in my environment and was able to locate all Teams messages successfully. Here’s how I performed the Content Search:
Option 1: Using Content Search in Microsoft Purview

1. Open Content Search in Microsoft Purview.
2. Create a Case and then create a Search.
3. In the Conditions section:
   • Add a condition for Content Kind.
   • Specify the content type as Message (0x0107).
4. Add Source:
   • Search for and select the specific user.
5. Run the query.
6. Under Choose Search Result, in Statistics, check:
   • Include categories.
   • Include query keyword report.
7. After the search completes:
   • Choose Add to review set and name the new review set.
   • All messages for that user will appear here.

Option 2: Using Keyword Query Language (KQL)
This query targets all content indexed as Microsoft Teams communication.

In the Conditions section > Add conditions > KeyQL
In the Keywords box, use: kind:microsoftteams
Select Locations:

• Add the specific user’s Exchange mailbox.
• Include M365 Group mailboxes for relevant channels.

Run the search and add results to a review set as in Option 1.
If you still get zero results after following these steps, the issue is likely a matter of Permissions (you may need the eDiscovery Manager role) or a data indexing problem within your tenant.

For reference: Getting started with the new Purview Content Search | Microsoft Community Hub
As a forum moderator, I genuinely wish I could directly access your account or delve into the backend systems to diagnose and fix this for you. However, our role here is limited to providing general guidance and solutions that can be applied by users.  

If none of the above solutions work, I recommend that you create a service request with Microsoft Support. A technical support engineer can perform a remote session to investigate the situation, verify the backend configurations, and run any necessary synchronization tools to resolve the problem. If the issue requires further attention, they can escalate it to a specialized team for deeper analysis. Please create a service request with Microsoft support to get advanced technical assistance and diagnostics. For detailed instructions on how to get support, please refer to Get support - Microsoft 365 admin.

For additional assistance, use this link to find the appropriate contact number: Global Customer Service phone numbers - Microsoft Support 

I truly hope you get your issue resolved swiftly. Please know that even though I can't directly intervene, directing you to the correct, specialized support is the most effective help I can provide from my position. Thank you for your patience and understanding. I'm looking forward to your reply.  

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".  

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.