Use Content Search to search third-party data imported by a custom partner connector

Note

Microsoft 365 compliance is now called Microsoft Purview and the solutions within the compliance area have been rebranded. For more information about Microsoft Purview, see the blog announcement.

You can use the Content search eDiscovery tool in the Microsoft Purview compliance portal to search for items imported to mailboxes in Microsoft 365 from a third-party data source. You can create a query to search all imported third-party data items or you can create a query to search specific third-party data items. Also, you can also create a query-based retention policy or a query-based eDiscovery hold to preserve third-party data.

For more information about working with a partner to import third-party data and a list of the third-party data types that you can import to Microsoft 365, see Work with a partner to archive third-party data in Office 365.

Important

The guidance in this article only applies to third-party data that was imported by a custom partner connector. This article doesn't apply to third-party data that is imported by using the third-party data connectors in the Microsoft compliance center.

Creating a query to search all third-party data

To search (or place on hold) any type of third-party data that you've imported to Office 365, you can use the kind:externaldata message property-value pair in the keyword box for a Content Search or when creating a query-based hold. For example, to search for items imported from any third-party data source and contain the word "contoso" in the Subject property of the imported item, you would use the following query:

kind:externaldata AND subject:contoso

The previous keyword query example includes the subject property. For a list of other properties for third-party data items that can include in a keyword query, see the "More information" section in Work with a partner to archive third-party data in Office 365.

When creating queries to search and hold third-party data, you can also use conditions to narrow the search results. For more information about creating Content Search queries, see Keyword queries and search conditions for Content Search.

Creating a query to search specific types of third-party data

Instead of searching all types of third-party data, you can create queries that only search for a specify type of third-party data by using the following message property: value pair in the keyword box for a Content Search:

itemclass:ipm.externaldata.<third-party data type>* 

For example, to search Facebook data that contains the word "contoso" in the Subject property, you would use the following query:

itemclass:ipm.externaldata.Facebook* AND subject:contoso

The following table lists the third-party data types that you can search, and the value to use for the itemclass: message property to specifically search for that type of third-party data. The query syntax isn't case-sensitive.

Third-party data type Value for itemclass: property
AIM
ipm.externaldata.AIM*
American Idol
ipm.externaldata.AmericanIdol*
AOL with Pivot Client
ipm.externaldata.Pivot.IM
Apple Juice
ipm.externaldata.AppleJuice*
Ares
ipm.externaldata.Ares*
Axs Encrypted
ipm.externaldata.AxsEncrypted*
Axs Exchange
ipm.externaldata.AxsExchange*
Axs Local Archive
ipm.externaldata.AxsLocalArchive*
Axs Placeholder
ipm.externaldata.AxsPlaceHolder*
Axs Signed
ipm.externaldata.AxsSigned*
Bazaarvoice
ipm.externaldata.Bazaarvoice*
Bearshare
ipm.externaldata.Bearshare*
BitTorrent
ipm.externaldata.BitTorrent*
Blackberry
ipm.externaldata.Blackberry*
BlackBerry Call Logs
ipm.externaldata.BlackBerryCall*
BlackBerry Messenger
ipm.externaldata.BlackBerryMessenger*
BlackBerry PIN
ipm.externaldata.BlackBerryPIN*
BlackBerry SMS
ipm.externaldata.BlackBerrySMS*
Bloomberg
ipm.externaldata.Bloomberg*
Bloomberg Message
ipm.externaldata.conversation.Bloomberg Message*
Bloomberg Messaging
ipm.externaldata.BloombergMessaging*
Box
ipm.externaldata.Box*
Cisco IM & Presence Server
ipm.externaldata.Jabber.IM
Cisco Jabber
ipm.externaldata.Jabber*
CipherCloud for Salesforce Chatter
ipm.externaldata.Chatter.Post
ipm.externaldata.Chatter.Comment
Direct Connect
ipm.externaldata.DirectConnect*
Facebook
ipm.externaldata.Facebook*
FastTrack
ipm.externaldata.FastTrack*
FXConnect
ipm.externaldata.FXConnect.chat
Flickr
ipm.externaldata.Flickr*
Gnutella
ipm.externaldata.Gnutella*
Google+
ipm.externaldata.GooglePlus*
Google Talk
ipm.externaldata.GoogleTalk*
GoToMyPC
ipm.externaldata.GoToMyPC*
HipChat
ipm.externaldata.HipChat*
Hopster
ipm.externaldata.Hopster*
HubConnex
ipm.externaldata.HubConnex*
IBM Connections
ipm.externaldata.Connections*
IBM SameTime
ipm.externaldata.Sametime*
ICE Chat
ipm.externaldata.conversation.Ice Chat*
Indii Messenger
ipm.externaldata.Indii*
Instagram
ipm.externaldata.Instagram*
Instant Bloomberg
ipm.externaldata.InstantBloomberg*
InvestEdge
ipm.externaldata.InvestEdge*
IRC
ipm.externaldata.IRC*
Jive
ipm.externaldata.Jive*
JiveApiRetention
ipm.externaldata.JiveApiRetention*
JXTA
ipm.externaldata.JXTA*
LinkedIn
ipm.externaldata.LinkedIn*
MFTP
ipm.externaldata.MFTP*
Microsoft UC
ipm.externaldata.MicrosoftUC*
Mind Align
ipm.externaldata.MindAlign*
Mobile Guard
ipm.externaldata.MobileGuard*
MSN
ipm.externaldata.MSN*
MySpace
ipm.externaldata.MySpace*
NEONetwork
ipm.externaldata.NEONetwork*
OpenNap
ipm.externaldata.OpenNap*
Pinterest
ipm.externaldata.Pinterest*
Pivot
ipm.externaldata.Pivot*
QQ
ipm.externaldata.QQ*
Microsoft SharePoint
ipm.externaldata.SharePoint*
Salesforce Chatter
ipm.externaldata.Chatter*
Skype for Business
ipm.externaldata.Skype*
Slack Enterprise Grid
ipm.externaldata.Slack.IM
SoftEther
ipm.externaldata.SoftEther*
Squawker
ipm.externaldata.Squawker*
Symphony
ipm.externaldata.Symphony*
Thomson Reuters
ipm.externaldata.Reuters*
Thomson Reuters Eikon Messenger
ipm.externaldata.ReutersEikon*
Tor
ipm.externaldata.Tor*
TTT
ipm.externaldata.TTT*
Twitter
ipm.externaldata.Twitter*
UBS Chat
ipm.externaldata.UBS*
Vimeo
ipm.externaldata.Vimeo*
WinMX
ipm.externaldata.WinMX*
Winny
ipm.externaldata.Winny*
Yahoo!
ipm.externaldata.Yahoo!*
Yammer
ipm.externaldata.Yammer*
YellowJacket
ipm.externaldata.YellowJacket*
YouTube
ipm.externaldata.YouTube*