Building eDiscovery searches with the condition builder and KeyQL

Searches are built on a case’s Searches tab by choosing data sources and then a query, using either the condition builder or the Keyword Query Language (KeyQL) editor.

Condition builder

• The Keywords condition is always first and supports only the Equal operator; conditions that follow are joined to it with AND.
• Multiple values in one condition (separated by commas or semicolons) are joined with OR; different conditions are joined with AND or OR as selected.
• The Keyword and KeyQL conditions can each be used only once in a query, and a KeyQL condition must stand alone rather than mix with other conditions.
• At least two keyword rows are needed to produce a keyword report in Statistics; each row becomes a separate segment (c:s) in the generated KeyQL.
• In the generated query, everything after (c:c) is a condition; (c:c) must not be typed into manual queries.

The Date condition offers Before, After and Between; the Size condition adds Greater, Less, Equals and similar numeric operators. For imported mail, Received and Sent are more reliable than Date.

KeyQL rules

• Searches run in UTC and keyword matching is always case-insensitive; only the operators AND, OR, NOT and NEAR are case-sensitive and must be uppercase.
• A space between terms behaves like OR; mixing spaces and OR in one query can give unexpected results.
• property:value must not have a space after the colon, otherwise the value becomes a free-text keyword.
• Only prefix wildcards work (budg*), with at least three letters before the asterisk; suffix, infix and substring wildcards aren’t supported.
• Quotation marks make a phrase and switch off wildcards inside them; a minus sign before a property excludes matches.
• Site paths need a trailing slash to avoid matching similarly named sites.
• An empty keyword condition returns every item in the selected sources, not nothing.

(subject:"project falcon" OR budget*) AND kind:email AND received>=2026-01-01
participants:user1@example.com AND sent=2026-03-01..2026-03-31
kind:microsoftteams AND "release date"
path:"https://example.sharepoint.com/sites/Finance/" AND filetype:xlsx

The first line finds email whose subject contains the phrase or any term starting with “budget” received on or after 1 January 2026; the second finds mail involving one user in March; the third finds Teams chats, meetings and calls containing a phrase; the fourth limits results to Excel files in one site.

Microsoft Security Copilot can draft KeyQL from natural language (preview), but the result still has to be pasted into the KeyQL condition and run.

Common trap: Writing *report or rep*rt to catch variants - eDiscovery supports only prefix wildcards such as report*, and only with at least three characters before the asterisk.

Common trap: Typing to: user1@example.com with a space after the colon - the space turns the value into a full-text keyword search instead of a recipient filter.

Get the whole book

This note is one section of Ultra Transcenders SC-401: Administering Information Security in Microsoft 365, an independent study guide that explains every topic the exam covers by technology, with comparison tables, diagrams and the common traps, plus a glossary linked to Microsoft Learn.

About the book · SC-401 terms in the glossary · All SC-401 study notes