O365 Advanced eDiscovery Email Search Inquiry

Question

Article Link: https://learn.microsoft.com/en-us/microsoft-365/compliance/keyword-queries-and-search-conditions?view=o365-worldwide

Can someone verify if the following is attainable?

Search for emails FROM Jim TO Jane; and FROM Jane TO Jim.

(1) If the search is conducted by placing Jim in the FROM property box and Jane in the TO property box, we should only see emails between those two parties (or emails from Jim and to Jane with Chris also on there, but because Jim is in the FROM box and Jane is the TO box, it's still responsive). Emails FROM Jim to Chris with a carbon-copy to Jane, however, should not appear, correct?

(2) If Jim is placed in the PARTICIPANT property box and Jane is placed in the TO property box, we could potentially pull emails FROM Jim or emails where Jim is carbon-copied that were sent TO Jane?

(3) If Jim is placed in the SENDER property box and Jane is placed in the RECIPIENT property box, we could potentially pull emails only sent by Jim, but Jane could potentially be carbon-copied or blind carbon-copied?

Trying to fully understand this system and apologies if this was not submitted is in the correct location. I work for an organization that somewhat recently began utilizing this system and there is a lot of confusion amongst those who actually use it. Although I do not use it, my team and I do rely heavily on it to pull email records so when we submit requests to our IT dept to do so, we want to make sure it's done properly to eliminate duplicates and/or unnecessary emails (which is not happening, currently). Different answers are being given depending on who you ask, so it was recommended that someone on our team (yours truly) come straight to the source. Essentially, we're attempting to find a uniform way to ELIMINATE any carbon-copy emails or duplicate emails...because we get slammed with duplicates, triplicates, quadruplicates etc.

Thanks!

Answer 1

Hi @TaiT-8478

(1) Jim in the FROM property box and Jane in the TO property box,
Emails FROM Jim to Chris with a carbon-copy to Jane, should not appear.

(2) Jim is placed in the PARTICIPANT property box and Jane is placed in the TO property box
Will include emails sent from Jim to Jane, Or emails sent to Jane while Jim is in To Or Cc Or Bcc.
we could potentially pull emails FROM Jim or emails where Jim is carbon-copied that were sent TO Jane - Yes

(3) Jim is placed in the SENDER property box and Jane is placed in the RECIPIENT property box
Will include emails sent from Jim, and Jane is in To Or Cc Or Bcc.
we could potentially pull emails only sent by Jim, but Jane could potentially be carbon-copied or blind carbon-copied - Yes

And you could refer to the official document here: De-duplication in eDiscovery search results

---

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.