Archive For Microsoft Teams - Archive Search

Microsoft Teams data can be searched within Case Review. This article describes how you can search Microsoft Teams data by Mailbox or by From/To Address. 

Accessing Case Review 

1. Log in to the Mimecast Administration Console.
2. Navigate to Archive | Case Review.
3. Case Review will launch in a new tab with options to Search by Mailbox or Search by From/To.

To perform a Search

Change Message Type from Email to Microsoft Teams.

1. Click on the Archive Search tab.
2. Complete one of the following tabs:

Search by Mailbox:

Field / Option	Description
Message Type	Microsoft Teams
Custodians	# to search Teams / Channels, e.g. #General# username: to search a username, type it in full. e.g username display name: to search a display name, use "". e.g. "James Smith" mailbox: to specify users via their mailboxes please provide complete mailbox name, e.g. [e-mail] Separate multiple entries with a space or comma. These are treated as OR functions.
Routing	All
Keywords	Specify your search keywords, using the following conditions as required: Space generates the key (word1 word2). OR creates the OR key (word1 OR word2) ! before words creates the NOT key (word1 !word2) ? matches a single unknown character (e.g. colo?r returns color and colour) * matches zero or more characters at the end of words (e.g. bet* returns bet, betting, better) "" matches word phrases and display names (e.g. "James Smith") () can be used to group terms for OR searches (e.g. word1 (word2 OR word3)
Date Range	Specify a date range for the search using the drop down

Search by From/To: 

Field / Option	Description
Message Type	Microsoft Teams
From	Specify one or more sender, using any combination of the following: Space, a comma, or OR creates the OR key, e.g. [e-mail] OR [e-mail] @ searches domains, e.g. use @company.com or company.com ! before words creates the NOT key. It can be used in conjunction with other expressions to negate particular words, e.g. @company.com OR ![e-mail] "" matches display names, e.g. "James Smith" * matches zero or more characters at the end of the address or domain (e.g. bob* returns bob, bobby, bobbi-jo)
To	Specify one or more recipient, using the any combination of the keywords from the "From" field. If both the "From" and "To fields are specified, only results matching the entries in both fields are returned.
Keywords	Specify one or more search keywords. See the "Search by Mailbox" table above for full details.
Date Range	Specify a date range for the search using the drop down

3. Click on the Advanced Search dropdown to display the following additional search options:

Field / Option	Description
Keyword Filters	Specify if the terms in the Keywords field should be applied to the subject line, message body, attachment content, attachment name, or attachment type.
Legal Hold Messages	Messages placed on legal hold are retained in the archive until the date specified, thereby overriding any retention policies. Click the Exclude tick box if you would like to exclude legal hold messages from your search results. This includes items that are on litigation hold in Mimecast by using discovery cases, saved searches and mailbox holds within Case Review.

4. Click on the Search button.

Displaying a Message's Details

With returned search details, you can display each message’s detail. To do so:

1. Click on a Message entry to view the Message Details sliding panel.
2. The Messages tab highlights the specific message in a thread that matches your search criteria:

3. The Summary tab gives the following details:

Field / Option	Description
Sender	Displays the email address of the sender
Recipient	Displays the email address/addresses of all recipients
Sent	Displays the date and time of the message
Conversation Type	Displays if the message was sent to a Channel, Group or was a Direct message
Team Name	Only applicable when the message in question was sent to a Channel. This option displays the name of the Team in a Channel
Channel Name	Only applicable when the message in question was sent to a Channel. Displays the Channel name.
Exposure	Displays if the message was sent internally or externally.
Source	The source will always be displayed as Microsoft Teams

See Also...

• Archive for Teams - Export
• Archive for Microsoft Teams - Frequently Asked Questions