I recently had a client who a hybrid environment with mailboxes hosted on an on-premise Exchange 2019 server follow the Microsoft documentation:
Content Search
https://docs.microsoft.com/en-us/microsoft-365/compliance/content-search?view=o365-worldwide
… in an attempt to search content in a Teams Chat data but noticed that launching the Admin center then Security:
… then Search > Content Search:
… and attempting to search did not yield any results.
Administrators who have come across this issue in the past, may know that this is because Teams chat data for users are stored in their primary cloud-based mailbox, while users with on-premise mailboxes are not able to store Teams chat data in their non-cloud-based mailbox. The workaround solution for this issue is outlined in the following article where a request needs to be filled out and submitted to Microsoft Support to enable this:
Search for Teams chat data for on-premises users
https://docs.microsoft.com/en-us/microsoft-365/compliance/search-cloud-based-mailboxes-for-on-premises-users?view=o365-worldwide
The process typically takes a few weeks before the changes are active while Microsoft creates a cloud-based storage area so that it can be used with eDiscovery tools to search for and export Teams chat data for on-premises users.
Having gone through this process before, I proceeded to create a ticket, had the support engineer escalate the case, then eventually received a call back a week later from the escalation engineer and was told that Microsoft had turned this feature on globally as of January 13, 2021, most likely because there have been so many requests. I was told that it may take a couple of weeks before the changes propagate through all the tenants but my guess is that by the time anyone finds this blog post, it would have been activated for them.
If you’re attempting to search Teams Chat data for a user with an on-premise Exchange mailbox, ensure that you have granted your account the following roles:
Security > Permissions
Grant the administrator account the following permissions:
- Organization Management
- Compliance Administrator
- eDiscovery Manager < if export is required (https://docs.microsoft.com/en-us/microsoft-365/compliance/assign-ediscovery-permissions?view=o365-worldwide)
Content search should return results once the above permissions are granted.
The following is an article outlining the keyword queries and search conditions that can be used for the search:
Keyword queries and search conditions for Content Search and eDiscovery
https://docs.microsoft.com/en-us/microsoft-365/compliance/keyword-queries-and-search-conditions?view=o365-worldwide
The following is the documentation for Content Search:
Content Search
https://docs.microsoft.com/en-us/microsoft-365/compliance/content-search?view=o365-worldwide
