eDiscovery - Content Search - KQL Editor - Property Restrictions

Question

eDiscovery - Content Search - KQL Editor - Property Restrictions

PA4055 20

Is there a listing of all the Property Restrictions available for use in the KQL editor? I know it provides example and suggestions; however, a complete listing would be helpful. I have looked in various places with no results.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Anonymous

Hi @PA4055

Thank you for posting your query!

When you start to enter a search query in the KQL editor, the editor displays suggested autocompletion of supported search properties (also called property restrictions) that you can select. You have to type a minimum of two characters to display a list of supported properties that begin with those two characters.

The below documentation provides detailed information on the supported property restrictions and how to use them effectively in your queries. This includes properties for searching across email, chat, documents, and files stored in Exchange Online, SharePoint, and OneDrive for Business.

For more information you can refer below articles:
https://learn.microsoft.com/en-us/purview/ediscovery-kql-editor
https://learn.microsoft.com/en-us/purview/ediscovery-keyword-queries-and-search-conditions

Hope this helps. Do let us know if you any further queries.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

PA4055 20 Reputation points

2025-02-27T15:49:10.96+00:00

Partially yes, the suggested items help. However, in some instances a search can be quite extensive or vague. If there were a listing, we could use as a reference then that could possibly save time.

Ex: if someone wanted a search to include "Contoso Timesheets".

They may ask for a search using those keywords, however if you knew the timesheets were only provided as an email attachment then you could use the AttachmentNames. in the KQL editor, reducing the search results.

Without actually typing "Att" in the editor you may not know the possibility exists. Yes, the more the service is used, users learn more ways to search but for new users this could be very helpful.
PA4055 20 Reputation points

2025-02-27T16:07:55.6766667+00:00

Duplicated post. - edited
Anonymous

2025-02-28T07:18:51.7+00:00

@PA4055
Thank you for your patience!

I understand how helpful a complete reference of all KQL property restrictions would be, especially for improving search efficiency.
While Microsoft does not provide a single, exhaustive list of all property restrictions in one place, the following official documentation covers many of them:

Keyword Query Language (KQL) syntax reference the below document will help
https://learn.microsoft.com/en-us/sharepoint/dev/general-development/keyword-query-language-kql-syntax-reference

The below resource details searchable email and site properties, offering examples of property restrictions applicable in eDiscovery scenarios.
https://learn.microsoft.com/en-us/purview/ediscovery-keyword-queries-and-search-conditions

This article explains how to utilize the KQL editor within Microsoft's eDiscovery tools, highlighting features like autocomplete suggestions for search properties and operators.
https://learn.microsoft.com/en-us/purview/ediscovery-kql-editor

I hope this helps! Let me know if you need any further clarification.
PA4055 20 Reputation points

2025-02-28T14:14:32.6633333+00:00

Thank you this is very helpful.

Share via

eDiscovery - Content Search - KQL Editor - Property Restrictions

0 additional answers

Your answer