Purview eDiscovery KeyQL syntax error using ManagedProperties

Question

Hello, could help me with the correct KeyQL syntax to use in EDiscovery?

I am wanting to use the e-Discovery to test that retention labels with auto applied policies and event based triggers will find results. Prior to this I was using the old content search in Purview regularly however the new content search does not like the same syntax I was using

This query worked in old Content Search in Purview but can't get it to work in new eDiscovery: Refinablestring01:2000

Refinablestring01 is mapped to crawled property from Term Store. I can search Refinablestring01:2000 in SharePoint and get results.

Error is Unknown property name Refinablestring01:

Have also tried ManagedProperties:Refinablestring01:2000

Error is: Propertyrestriction ManagedProperties requires value of type Unknown

Remove Refinablestring01:

Answer 1

@Dileep Raj Narayan Thumula

thank you for your reply. I am using this syntax in event driven retention: RefinableString00:"ContractXYZ". the Refinablestring is mapped correctly and I can use it to search in SharePoint and was able to use it to search in the old content discovery search which is not longer avaiable.

I need to use e-Discovery to test that the queries I need to build for retention events will find results before I create the event.

When I use this same syntax in e-Discovery I get an error - see above for screen shots. Krupual recommended this syntax which also doesn't work: ManagedProperties="RefinableString00:"ContractXYZ"

My question is simple: What is the correct syntax to use in e-Discovery to search Refinablestring01?

The suggestions you and Krupual have already provided return errors.

Answer 2

Hi Cate Reilly,

Hope the below information will you.

In Azure Purview eDiscovery, RefinableString properties are crawled properties that can be used in search queries and filters to refine the search results. They represent metadata or custom properties that have been explicitly configured as refinable strings and are mapped to a corresponding managed property in the SharePoint search schema.

Refinable strings

Refinable strings are a specific type of managed property that allows you to create faceted navigation or advanced filters within your search experience.

In eDiscovery, RefinableString properties help filter and refine search results based on their assigned values. This allows you to narrow the scope of a search and focus on locating specific content more efficiently.

According to Microsoft's official documentation on event-driven retention:

This includes Content search, Microsoft Purview eDiscovery (Standard), and Microsoft Purview eDiscovery (Premium) (eDiscovery searches in eDiscovery (Premium) are called collections). You can also use the *-ComplianceSearch cmdlets in Security & Compliance PowerShell to search for these properties.

When creating an event-based retention policy in Microsoft Purview, you can specify keywords or asset IDs to target the content the event applies to. The Asset ID used must be a managed property, such as ComplianceAssetId, and it must have the appropriate value assigned.

The following types of properties are explicitly or implicitly supported for use in event-driven retention:

• ComplianceAssetId — Explicitly supported and widely used.
• RefinableStringXX — Supported if configured properly as refinable managed properties.
• Other Managed Properties — Custom or automatically generated managed properties (e.g., EventStartDateOWSTDATE, EventCSIOWSCHCS) are supported, provided they are mapped in the SharePoint Online search schema.
• System Properties (e.g., Created) — Usable only if they are promoted to managed properties, which they typically are by default.

Important: For auto-labeling and event triggers to work, the property containing the identifier must be a managed property in the SharePoint Online search schema

Syntax for Property:Value Queries

As documented in Event-driven retention in Microsoft Purview, use the following format for queries:

Format:

ManagedProperty:"value"

• String values must be enclosed in quotes.
• Dates must use YYYY-MM-DD (ISO 8601) format.
• Boolean operators (AND, OR) are supported.
• Case sensitivity: Yes — Managed property names are case-sensitive.

Examples of Valid Syntax

`ComplianceAssetId:"ProjectABC"

RefinableString00:"ContractXYZ"

Created>=2024-01-01 AND Created<=2024-12-31

EventStartDateOWSTDATE<2022-01-01

ComplianceAssetId:"asset 123" AND RefinableString00:"string value"`

You can combine queries using AND, OR, and NOT, following Keyword Query Language (KQL), which is the basis for these searches.

Further References

• Event-driven retention in Microsoft Purview
• New-ComplianceRetentionEvent (PowerShell)
• KQL syntax reference

Answer 3

@Cate Reilly

Right now Purview eDiscovery does not support RefinableStringXX managed properties directly.
ManagedProperties="RefinableString00:"ContractXYZ", that is not supported syntax for eDiscovery or KQL in Purview.

Use SharePoint Search for testing You can still use SharePoint Search REST API to test KQL with managed properties.

Use retention label search If you map RefinableString00 to a retention label or compliance tag, you can search using complianceTag: in Purview.

Create a dedicated managed property Create a crawled property → managed property mapping and configure it as queryable in SharePoint Search schema AND try exposing it via Graph Search API (preview).

File/metadata search workaround Upload test files with distinct keywords in metadata or content and test eDiscovery on those keywords directly.