This topic describes the email and document properties that you can search for in email items in Exchange Online and documents stored on SharePoint and OneDrive for Business sites by using the Content Search feature in the Microsoft 365 compliance center. You can also use the *-ComplianceSearch cmdlets in Security & Compliance Center PowerShell to search for these properties. The topic also describes:
Using Boolean search operators, search conditions, and other search query techniques to refine your search results.
Searching for sensitive data types and custom sensitive data types in SharePoint and OneDrive for Business.
Searching for site content that's shared with users outside of your organization
For step-by-step instructions on how to create a Content Search, see Content Search.
Note Content Search in the Microsoft 365 compliance center and the corresponding *-ComplianceSearch cmdlets in Security & Compliance Center PowerShell use the Keyword Query Language (KQL).
Searchable email properties
The following table lists email message properties that can be searched by using the Content Search feature in the Microsoft 365 compliance center or by using the New-ComplianceSearch or the Set-ComplianceSearch cmdlet. The table includes an example of the property:value syntax for each property and a description of the search results returned by the examples. You can type these property:value pairs in the keywords box for a Content Search.
Note When searching email properties, it's not possible to search for items in which the specified property is empty or blank. For example, using the property:value pair of subject:"" to search for email messages with an empty subject line will return zero results. This also applies when searching site and contact properties.
The names of files attached to an email message.
attachmentnames:annualreport.ppt attachmentnames:annual* attachmentnames:.pptx
Messages that have an attached file named annualreport.ppt. In the second example, using the wildcard returns messages with the word "annual" in the file name of an attachment. The third example returns all attachments with the pptx file extension.
The Bcc field of an email message.
bcc:email@example.com bcc:pilarp bcc:"Pilar Pinilla"
All examples return messages with Pilar Pinilla included in the Bcc field.
The categories to search. Categories can be defined by users by using Outlook or Outlook on the web (formerly known as Outlook Web App). The possible values are: