Finding content in sites in eDiscovery

When you search for documents and files in SharePoint or OneDrive sites, adjust your query approach based on the metadata for the documents and files you're interested in. Files and documents have relevant properties like Author, Created, CreatedBy, FileName, LastModifiedTime, and Title. Most of these properties aren't relevant when searching for communications content in Exchange Online. Using these properties might lead to unexpected results if you use them across both documents and communications. Additionally, the FileName and Title of a document might not be the same. Using one or the other to try to find a file with specific content might lead to different or inaccurate results. Keep these properties in mind when searching for specific document and file content in SharePoint and OneDrive.

To learn more about finding content in sites in eDiscovery, watch the following video:

For example, to find content related to documents created by User 1, for a project called Tradewinds, for specific files named Financials, and from January 2020 to January 2022, use a query with the following properties:

• Add User 1 as a data source to the search.
• Select User 1's OneDrive site as the location of interest.
• Add additional groups and their associated SharePoint sites related to the project as data sources.
• For FileName, use Financials
• For Keyword, use Tradewinds
• For Date Range, use the January 1, 2020 to January 31, 2022 range

Searchable site properties in KeyQL

The following table lists the SharePoint and OneDrive properties supported in search using the eDiscovery KeyQL editor in the Microsoft Purview portal or by using the New-ComplianceSearch or Set-ComplianceSearch cmdlets. For a list of supported condition builder properties, see Use the condition builder to create search queries in eDiscovery.

If you set a site status to Locked and the site to NoAccess, eDiscovery doesn't return search results. For more information about managing site lock statuses, see Lock and unlock sites. In addition, if a document is restricted in the content store, the eDiscovery manager must be a site admin, site owner, or the owner or last modifier of the restricted document to access it in eDiscovery. For more information about restricted content, see Data Loss Prevention policy reference.

The table includes an example of the property:value syntax for each property and a description of the search results returned by the examples.

Searchable sensitive data types

You can use eDiscovery search tools in the Microsoft Purview portal to search for sensitive data, such as credit card numbers or social security numbers, stored in documents on SharePoint and OneDrive sites. You can do this by using the SensitiveType property and the name (or ID) of a sensitive information type in a keyword query. For example, the query SensitiveType:"Credit Card Number" returns documents that contain a credit card number. The query SensitiveType:"U.S. Social Security Number (SSN)" returns documents that contain a U.S. social security number.

To see a list of the sensitive information types that you can search for, go to Data classifications > Sensitive info types in the Microsoft Purview portal. Or you can use the Get-DlpSensitiveInformationType cmdlet in Security & Compliance PowerShell to display a list of sensitive information types.

Limitations for searching sensitive data types

• To search for custom sensitive information types, you need to specify the ID of the sensitive information type in the SensitiveType property. Using the name of a custom sensitive information type (as shown in the example for built-in sensitive information types in the previous section) returns no results. Use the Publisher column on the Sensitive info types page in the Microsoft Purview portal (or the Publisher property in PowerShell) to differentiate between built-in and custom sensitive information types. Built-in sensitive data types have a value of Microsoft Corporation for the Publisher property.

  To display the name and ID for the custom sensitive data types in your organization, run the following command in Security & Compliance PowerShell:

  Get-DlpSensitiveInformationType | Where-Object {$_.Publisher -ne "Microsoft Corporation"} | FT Name,Id
  

  Then you can use the ID in the SensitiveType search property to return documents that contain the custom sensitive data type; for example, SensitiveType:7e13277e-6b04-3b68-94ed-1aeb9d47de37

• You can't use sensitive information types and the SensitiveType search property to search for sensitive data at-rest in Exchange Online mailboxes. This limitation includes 1:1 chat messages, 1:N group chat messages, and team channel conversations in Microsoft Teams because all of this content is stored in mailboxes. However, you can use data loss prevention (DLP) policies to protect sensitive email data in transit. For more information, see Learn about data loss prevention and Search for and find personal data.

Forming a basic query

A basic query has three parts: SensitiveType, count range, and confidence range. For example, SensitiveType:"<type>" is required, and both |<count range> and |<confidence range> are optional.

Sensitive type - required

Queries typically begin with the property SensitiveType:" and an information type name from the sensitive information types inventory, and end with a ". You can also use the name of a custom sensitive information type that you created for your organization. For example, you might be looking for documents that contain credit card numbers.

In such an instance, use the following format: SensitiveType:"Credit Card Number". Because you didn't include count range or confidence range, the query returns every document in which a credit card number is detected. This is the simplest query that you can run, and it returns the most results. Keep in mind that the spelling and spacing of the sensitive type matters.

Ranges - optional

Both of the next two parts are ranges, so let's quickly examine what a range looks like. In SharePoint queries, a basic range is represented by two numbers separated by two periods, which looks like this: [number]..[number]. For instance, if 10..20 is used, that range captures numbers from 10 through 20. This article covers many different range combinations.

Let's add a count range to the query. You can use count range to define the number of occurrences of sensitive information a document needs to contain before it's included in the query results. For example, if you want your query to return only documents that contain exactly five credit card numbers, use this: SensitiveType:"Credit Card Number|5". Count range can also help you identify documents that pose high degrees of risk. For example, your organization might consider documents with five or more credit card numbers a high risk. To find documents fitting this criterion, use this query: SensitiveType:"Credit Card Number|5..". Alternatively, you can find documents with five or fewer credit card numbers by using this query: SensitiveType:"Credit Card Number|..5".

Confidence range

Finally, confidence range is the level of confidence that the detected sensitive type is actually a match. The values for confidence range work similarly to count range. You can form a query without including a count range. For example, to search for documents with any number of credit card numbers—as long as the confidence range is 85 percent or higher—use this query: SensitiveType:"Credit Card Number|*|85..".

Additional query properties and search operators

Queries in SharePoint also contain the LastSensitiveContentScan property, which can help you search for files scanned within a specific timeframe. For query examples with the LastSensitiveContentScan property, see the Examples of complex queries in the next section.

You can use SharePoint eDiscovery search properties such as Author or FileExtension. You can use operators to build complex queries.

Examples of complex queries

The following examples use different sensitive types, properties, and operators to show how you can refine your queries to find exactly what you're looking for.

Examples of queries to avoid

Not all queries work in SharePoint. The following table gives examples of queries that don't work and describes why.

Searching for site content shared with external users

You can use eDiscovery search tools in the Microsoft Purview portal to search for documents stored on SharePoint and OneDrive sites shared with people outside of your organization. This search can help you identify sensitive or proprietary information that's being shared outside your organization. Use the ViewableByExternalUsers property in a keyword query. This property returns documents or sites that you shared with external users by using one of the following sharing methods:

• A sharing invitation that requires users to sign in to your organization as an authenticated user.
• An anonymous guest link, which allows anyone with this link to access the resource without having to be authenticated.

Here are some examples:

• The query ViewableByExternalUsers:true AND SensitiveType:"Credit Card Number" returns all items shared with people outside your organization and contains a credit card number.
• The query ViewableByExternalUsers:true AND ContentType:document AND site:"https://contoso.sharepoint.com/Sites/Teams" returns a list of documents on all team sites in the organization that you shared with external users.

What content counts as shared with people outside your organization? Documents in your organization's SharePoint and OneDrive sites that you shared by sending a sharing invitation or that you shared in public locations. For example, the following user activities result in content that external users can view:

• A user shares a file or folder with a person outside your organization.
• A user creates and sends a link to a shared file to a person outside your organization. This link allows the external user to view (or edit) the file.
• A user sends a sharing invitation or a guest link to a person outside your organization to view (or edit) a shared file.

Issues using the ViewableByExternalUsers property

While the ViewableByExternalUsers property represents the status of whether a document or site is shared with external users, it has some caveats. In the following scenarios, the value of the ViewableByExternalUsers property isn't updated, and the results of a search query that uses this property might be inaccurate.

• Changes to sharing policy, such as turning off external sharing for a site or for the organization. The property still shows previously shared documents as being externally accessible even though external access might be revoked.
• Changes to group membership, such as adding or removing external users to Microsoft 365 Groups or Microsoft 365 security groups. The property isn't automatically updated for items the group has access to.
• Sending sharing invitations to external users where the recipient hasn't accepted the invitation, and therefore doesn't yet have access to the content.

In these scenarios, the ViewableByExternalUsers property doesn't reflect the current sharing status until the site or document library is recrawled and reindexed.

Searching for site content shared within your organization

You can use the SharedWithUsersOWSUser property to search for documents shared between people in your organization. When a person shares a file or folder with another user inside your organization, a link to the shared file appears on the Shared with me page in the OneDrive account of the person who the file was shared with. For example, to search for the documents shared with Sara Davis, you can use the query SharedWithUsersOWSUser:"sarad@contoso.com". If you export the results of this search, you download the original documents located in the content location of the person who shared the documents with Sara.

Documents must be explicitly shared with a specific user to be returned in search results when using the SharedWithUsersOWSUser property. For example, when a person shares a document in their OneDrive account, they can share it with anyone (inside or outside the organization), share it only with people inside the organization, or share it with a specific person.

Only documents that are shared by using the third option (shared with Specific people) are returned by a search query that uses the SharedWithUsersOWSUser property.

Character limits for searches

For more information about character limits, see eDiscovery search limits.