Almanac
Microsoft/teamsMicrosoft 365

Consultant-focused KB for Microsoft Teams: implementation notes, gotchas and configuration decisions beyond the official docs — across chat and collaboration, meetings, webinars and town halls, Teams Phone, PSTN connectivity (Direct Routing, Operator Connect, Calling Plans, Teams Phone Mobile), auto attendants, call queues and contact centre integration, Teams Rooms and devices, apps and extensibility, Copilot in Teams, administration and governance, security and compliance, network and call quality, and licensing — plus cross-cutting decision guides.

teams/10-security-and-compliance/feature-security-teams-ediscovery.md
feature-security-teams-ediscovery.mdv1 · history
CurrentApplies to Teams Enterprise, Microsoft 365 E5Updated 3 weeks agoSource Microsoft Learn ↗

What it does

Microsoft Purview eDiscovery searches, holds and exports the compliance copies of Teams messages that the substrate writes into Exchange Online, plus the files and recordings in OneDrive and SharePoint. With the Premium features you get conversation threading, so a matching message comes back with the chat around it rather than as an isolated line.

Key facts

  • Teams data lives in Azure Cosmos DB; the compliance record is captured into hidden folders in Exchange Online mailboxes, and that's what eDiscovery searches.
  • 1:1 and group chats: a copy in every participant's mailbox. Shared files sit in the sharer's OneDrive.
  • Standard channels: the team's group mailbox; files in the team's SharePoint site.
  • Private channels: members' mailboxes (being migrated to the group mailbox) and a dedicated SharePoint site per channel.
  • Shared channels: a system mailbox tied to the channel, searched via the parent team's mailbox, with its own dedicated SharePoint site.
  • Meeting recordings and transcripts are in the OneDrive of the person who recorded; in review sets they appear as a .zip holding transcript, .mp4, thumbnail and metadata.
  • Conversation threading (Premium): for chats, 12 hours either side of a responsive message is pulled in with search parameters, or a 24-hour window with a date-only search. For channels, all replies to a responsive post.
  • Edited messages are flagged with the ContainsEditedMessage property, and reactions are kept in the transcript.
  • Cloud attachments (links to files in chat) are collected automatically into the review set and grouped with the conversation by FamilyId and ConversationId.
  • Standard features (search, holds, export, search and delete) are available with the right Purview roles; review sets, conversation threading, cloud attachments, OCR and analytics need Office 365 E5, Microsoft 365 E5 or an E5 add-on.
  • Classic eDiscovery was retired on 31 August 2025; Content search, Standard and Premium are now one case-based experience in the Purview portal.

When to use / skip

Every Teams tenant needs someone who can run an eDiscovery search, even if it's only for HR investigations and subject access requests. Under UK GDPR a DSAR covering Teams chat is the most common reason I see this used, ahead of litigation.

The real decision is Standard versus Premium. If legal only needs to find and export messages occasionally, Standard is enough and the HTML export is readable. If they're doing proper review, or need the chat context around a hit rather than the single matching line, Premium's threading is the difference between a usable export and a pile of fragments. Don't sell Premium to a client who'll run three searches a year.

Configuration decisions

  • Who holds the eDiscovery Manager and Administrator roles, and how the client separates HR investigations from legal cases. Case membership is the access boundary.
  • Licensing: which custodians need E5 or an add-on for Premium features to apply to their data.
  • Hold strategy for leavers. Inactive mailboxes need a hold or retention policy to survive licence removal.
  • Whether guests and external parties are in scope, given that cross-tenant messages may only exist in your users' copies.
  • Export format and where exports land, given they'll contain personal data.
  • How private and shared channel sources get added: they're not picked up by searching the team alone.
  • Whether search and delete is in scope for spillage incidents, and who's allowed to run it.

Gotchas

  • Shared channels aren't found by searching the members' mailboxes. Search the parent team's group mailbox.
  • Private channel files are in their own SharePoint site, not the team site. Miss that and the export is quietly incomplete.
  • Including custodians' OneDrives and cloud attachments together gives you duplicates. Microsoft's advice is to drop OneDrive from the collection scope and let cloud attachments come in with the conversation.
  • The same 1:1 chat appears once per custodian. They share a ConversationId; deduplicate on that, not on message content.
  • Messages a user deleted, or that a retention policy has expired, stay discoverable in SubstrateHolds until the timer job removes them. Useful for investigations, awkward if someone assumed the data was gone.
  • Recordings live with whoever pressed record. If that person has left and their OneDrive has been cleaned up, the recording has gone too.
  • Guest users' messages in your tenant don't get retention, so don't promise long-term discoverability for them.

Consultant notes

  • Run a dry-run search with the client's legal or HR lead during the project so they've seen what a Teams export looks like before they need it urgently.
  • Write a one-page "where Teams data lives" table for the client; it answers most of the questions they'll ask later.
  • Line up the OneDrive retention period for leavers with the eDiscovery and retention design, or recordings vanish early.
  • Audit (Standard/Premium) is the companion for "who did what when". Make sure it's on and the retention period is understood.
  • Keep DSAR handling out of the legal case workflow if you can; separate cases, separate permissions.

Revisit when private channel messages have fully moved to group mailboxes, and if Microsoft changes the threading windows

Was this accurate?
Related
Files in Teams — where they actually live in SharePoint and OneDrive01-chat-and-collaborationRetention policies for Teams chats and channel messages10-security-and-complianceCopilot in Teams chats and channels, and the Channel Agent08-copilot-and-ai-in-teamsTeams Premium vs Microsoft 365 Copilot for meeting intelligence13-decision-guidesData loss prevention for Teams chat and channel messages10-security-and-complianceFacilitator agent in Teams meetings08-copilot-and-ai-in-teams