Home / server / Questions / 1120037
Accepted
dragonspeed
Asked: 2023-01-12 15:07:41 +0800 CST

Design a compliance content search in O365 to ONLY return a specific person and a specific domain

  • 772

I am attempting to do a content search through Exchange on O365 to return mail between [email protected] and anyone at outsidedomain.com

I thought that this should work in the KQL:

(ParticipantDomains:outsidedomain.com) AND ((Sender:[email protected]) OR (Recipients:[email protected]))

However, this seems to include all mail to/from [email protected]

  • No matter who it is sent from/to
  • Also if [email protected] is in a group to whom it was sent.

What do I need to put, to only find direct email conversations between [email protected] and anyone at outsidedomain.com?

Thanks

microsoft-office-365

2 Answers

  1. Best Answer

    Another suggested answer, from outside this site was the following:

    (([email protected]) AND (Participants=outsidedomain.com) OR 
([email protected]) AND (Participants=outsidedomain.com))

    This appears to result in the data I was looking for.

    • 1

  2. Also if [email protected] is in a group to whom it was sent.

    To the best of my knowledge, it's not feasible to exclude this kind of mails from the results. A thought is to export the search result report file (.csv), open it in Excel to filter out mails sent to groups.

    However, this seems to include all mail to/from [email protected]

    No matter who it is sent from/to

    Although "participantdomains" looks like the most suitable property for your requirement, I cannot find any introduction about it in this official document. Also based on my test, I can reproduce that all mails would be included in the result when using "ParticipantDomains:outsidedomain.com".

    Given this situation, I'd suggest using Partifipants:"outsidedomain.com" instead. You can choose to search within the [email protected]'s Exchange mailbox only so that no other conditions need to be included in the query. enter image description here

    enter image description here

    • 0