Content Search Query (Compliance Search & Attachments)

IG 6 Reputation points
2022-05-04T18:51:04.43+00:00

The Compliance Search "ContentMatchQuery" property can search for whether emails have attachments (hasattachment:true) and the names of attachments (attachmentnames:annualreport.ppt), but is there a way in which it can search the content inside of email attachments?

Microsoft Graph
Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
11,395 questions
Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,500 questions
Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,455 questions
0 comments No comments
{count} vote

2 answers

Sort by: Most helpful
  1. Limitless Technology 39,501 Reputation points
    2022-05-10T07:33:40.747+00:00

    Hi IG-4542,

    This is possible. First, you will need to find the name of your DiscoveryMailbox:

    Get-Mailbox –RecipientTypeDetails DiscoveryMailbox | export-csv c:\temp\disc.csv

    Then run the below PowerShell code:

    $UserCredential = Get-Credential

    $exchangeSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/" -Credential $UserCredential -Authentication "Basic" -AllowRedirection

    Import-PSSession $exchangeSession -DisableNameChecking

    Get-Mailbox -ResultSize Unlimited | Search-Mailbox -SearchQuery 'Subject:"Some Text"' -targetmailbox "DiscoverySearchMailbox{Your ID number}" -targetfolder "SearchResult" -logonly -loglevel full

    Get-Mailbox -ResultSize Unlimited | Search-Mailbox -SearchQuery 'Body:"Some Text"' -targetmailbox "DiscoverySearchMailbox{Your ID number}" -targetfolder "SearchResult" -logonly -loglevel full

    You then need to add the DiscoverySearchMailbox to your Outlook to see the results.


    --If the reply is helpful, please Upvote and Accept as answer--

    0 comments No comments

  2. Kael Yao-MSFT 37,676 Reputation points Microsoft Vendor
    2022-05-11T08:41:45.537+00:00

    Hi @IG

    According to this link: Keyword queries and search conditions for eDiscovery
    There isn't a property which can be used for attachment contents.

    Thus I am afraid it is not possible.


    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.