Microsoft Purview eDiscovery search queries: keywords and KeyQL

MICROSOFT 365 REFERENCE GUIDE · NOT AN APP FEATURE · Fictional examples · Updated October 2026

Start with the condition builder

In an authorised Microsoft Purview eDiscovery search, use conditions for keywords, people, dates and content locations. Review each condition before running the search. Some operators and property names differ between content types.

Basic keyword-query examples

In a supported keyword or KeyQL input, an exact phrase can be enclosed in quotation marks:

"Project Cedar"

An example combining alternative names would be:

"Project Cedar" OR "Cedar rollout"

For more complex requirements, use the current KeyQL editor and its suggestions rather than copying untested query syntax into a live investigation.

Narrow carefully

1. Start from the written search purpose.
2. Select the right custodians or data sources rather than searching everything by default.
3. Use approved date and sender/recipient conditions where appropriate.
4. Preview a representative sample of hits and refine the query.
5. Record query changes and findings so another reviewer can reproduce the work.

What can make results incomplete?

• Partially indexed or unindexed items may not behave like fully indexed results.
• Data-source choices can unintentionally exclude relevant locations.
• Date semantics can differ between email messages and documents.
• A query may match a message but not prove the underlying personal-data disclosure obligations have been met.

Where TenantPilot fits

TenantPilot does not run eDiscovery KeyQL searches. This guide explains Microsoft Purview functionality for staff responsible for authorised compliance searches.