Keyword queries and search conditions for Compliance Search in Office 365 Dedicated

Applies to: Exchange Online Dedicated

This topic describes the email and document properties that you can search for in email items in Exchange Online by using the Compliance Search feature in the Exchange admin center (EAC) in Office 365 Dedicated. The topic describes the mail properties that you can search, the supported Boolean search operators, and the search conditions that you can use to narrow your search results. Compliance Search uses the Keyword Query Language (KQL). For detailed information about KQL, see Keyword Query Language syntax reference.

For more information, see Compliance Search in Office 365 Dedicated.

Contents

Searchable email properties

Search operators

Search conditions

Search tips and tricks

Searchable email properties

The following table lists email message properties that can be searched by using the Search feature in the or by using the New-ComplianceSearch or the Set-ComplianceSearch cmdlet. The table includes an example of the property:value syntax for each property and a description of the search results returned by the examples. You can type these property:value pairs in the keywords box for a compliance search.

Return to top

Search operators

Boolean search operators, such as AND, OR, and NOT, help you define more-precise mailbox searches by including or excluding specific words in the search query. Other techniques, such as using property operators (such as >= or ..), quotation marks, parentheses, and wildcards, help you refine a search query. The following table lists the operators that you can use to narrow or broaden search results.

Return to top

Search conditions

You can use conditions to your search queries to narrow a search and return a more refined set of results. Each condition adds a clause to the KQL search query that is created and run when you start the search.

Conditions for mail properties

Create a condition using mail properties when searching mailboxes. The following table lists the email properties that you can use for a condition. Note that these properties are a subset of the email properties that were previously described; these descriptions are repeated for your convenience.

Return to top

Conditions for common properties

Common properties are designed to be used when searching mailboxes and sites in the same search in other versions of Office 365. But you can still use them in Office 365 Dedicated when searching mailboxes. Alternatively, you can use just use the conditions for mailbox properties mail described in the previous section. The following table lists the available properties to use when adding a condition.

Return to top

Operators used with conditions

When you add a condition, you can select an operator that is relevant to type of property for the condition. The following table describes the operators that are used with conditions and lists the equivalent that is used in the search query.

Return to top

Guidelines for using conditions

Keep the following in mind when using search conditions.

• A condition is logically connected to the keyword query (specified in the keyword box) by the AND operator. That means that items have to satisfy both the keyword query and the condition to be included in the results. This is how conditions help to narrow your results.

• If you add two or more unique conditions to a search query (conditions that specify different properties), those conditions are logically connected by the AND operator. That means only items that satisfy all the conditions (in addition to any keyword query) are returned.

• If you add more than one condition for the same property, those conditions are logically connected by the OR operator. That means items that satisfy the keyword query and any one of the conditions are returned. So, groups of the same conditions are connected to each other by the OR operator and then sets of unique conditions are connected by the AND operator.

• If you add multiple values (separated by commas or semi-colons) to a single condition, those values are connected by the OR operator. That means items are returned if they contain any of the specified values for the property in the condition.

• The search query that is created by using the keywords box and conditions is displayed on the Search page, in the details pane for the selected search. In a query, everything to the right of the notation (c:c) indicates conditions that are added to the query.

• Conditions only add properties to the search query; the don't add operators. This is why the query displayed in the details pane doesn't show operators to the right of the (c:c) notation. KQL adds the logical operators (according to the previously explained rules) when the executing the query.

• You can use the drag and drop control to re-sequence the order of conditions. Just click on the control for a condition and move it up or down.

• As previously explained, some condition properties allow you to type multiple values. Each value is logically connected by the OR operator. This results in the same logic as having multiple instances of the same condition, where each has a single value. The following illustrations shows an example of a single condition with multiple values and an example of multiple conditions (for the same property) with a single value. Both examples result in the same query: (kind="email") OR (kind="contacts") OR (kind="meetings")

  

  

Return to top

Examples of using conditions in search queries

The following examples show the GUI-based version of a search query with conditions, the search query syntax that is displayed in the details pane of the selected search (which is also returned by the Get-ComplianceSearch cmdlet), and the logic of the corresponding KQL query.

Example 1

This example returns email items that contain the keyword "report", were sent before April 1, 2015, and that contain the word "northwind" in the subject field.

GUI

Search query syntax

report‎(c:c)‎‎(date<2015-04-01)‎‎(subject:"northwind")‎

Search query logic

report AND (date<2015-04-01) AND (subject:"northwind")

Return to top

Example 2

This example returns email messages or calendar meetings that were sent between 12/1/2014 and 11/30/2015 and that contain words that start with "phone" or "smartphone".

GUI

Search query syntax

phone* OR smartphone*‎(c:c)‎‎(sent=2014-12-01..2015-11-30)‎‎(kind="email")‎‎(kind="meetings")‎

Search query logic

phone* OR smartphone*‎ AND ‎‎(sent=2014-12-01..2015-11-30)‎ AND (‎‎(kind="email") OR ‎‎(kind="meetings"))

Return to top

Search tips and tricks

• Keyword searches are not case sensitive. For example, cat and CAT return the same results.

• The Boolean operators AND, OR, NOT, NEAR, and ONEAR must be uppercase.

• A space between two keywords or two property:value expressions is the same as using AND. For example, from:"Sara Davis" subject:reorganization returns all messages sent by Sara Davis that contain the word reorganization in the subject line.

• Use syntax that matches the property:value format. Values are not case-sensitive, and they can’t have a space after the operator. If there is a space, your intended value will just be a full-text search. For example to: pilarp searches for "pilarp" as a keyword, rather than for messages that were sent to pilarp.

• When searching a recipient property, such as To, From, Cc, or Recipients, you can use an SMTP address, alias, or display name to denote a recipient. For example, you can use pilarp@contoso.com, pilarp, or "Pilar Pinilla".

• You can use only prefix wildcard searches; for example, cat* or set*. Suffix wildcard searches (*cat) or substring wildcard searches (*cat*) aren’t supported.

• When searching a property, use double quotation marks (" ") if the search value consists of multiple words. For example subject:budget Q1 returns messages that contain budget in the in the subject line and that contain Q1 anywhere in the message or in any of the message properties. Using subject:"budget Q1" returns all messages that contain budget Q1 in the subject line.

• To exclude content marked with a certain property value from your search results, place a minus sign (-) before the name of the property. For example, -from:"Sara Davis” will exclude any messages sent by Sara Davis.

Return to top