You cannot open another user’s private Teams chats in Teams; for an authorized school investigation, stop and contact the school’s safeguarding, legal, or compliance team unless you already have formal authorization and the required Microsoft Purview eDiscovery roles.
Teams chat compliance copies are held in hidden mailbox folders that ordinary users and administrators cannot browse directly; authorized compliance personnel search them through eDiscovery. ^1^
If you are an authorized investigator
- Obtain the required Purview permissions
- The person assigning permissions must have Organization Management or Role Management.
- In the Microsoft Purview portal, go to Settings → Role groups → eDiscovery Manager → Edit.
- Add the investigator as an eDiscovery Manager, then save.
- The applicable capabilities include Case Management, Compliance Search, Preview, and Export. An eDiscovery Manager normally accesses only cases they create or are assigned to; eDiscovery Administrators have organization-wide case access and should be tightly limited. ^2^
A general Teams administrator role by itself does not provide these eDiscovery permissions. Allow time for a newly assigned role to propagate before starting the investigation.
- Create an eDiscovery case
- Open the Microsoft Purview portal → eDiscovery → Cases.
- Create a case for the authorized investigation.
- Add only the authorized investigators as case members.
- If messages must be preserved against editing or deletion, have the compliance/legal team configure a hold within the case. Cases contain the searches, holds, and review sets for an investigation. ^3^
- Create a narrowly scoped search
- Add both users’ Exchange Online mailboxes as data sources. Compliance copies of 1:1 and group chats are stored in every participant’s mailbox. ^4^
- Use the search interface’s supported query conditions to constrain results by:
- Teams chat or conversation content type
- Both participants
- Authorized date range
- Relevant keywords, if applicable
- Searching both mailboxes alone does not isolate chats exclusively between those two users; it can return their other conversations as well. Apply participant and date conditions, then validate the results.
The exact condition names and workflow can differ according to the organization’s eDiscovery subscription and whether premium features are enabled. Follow the current Teams eDiscovery search procedure in the cited documentation rather than assuming each criterion is a simple source selector.
- Preview and validate
- Review the matching items before exporting.
- Confirm that the results contain the intended participants and dates and exclude unrelated chats.
- Keep the scope limited to the formally authorized purpose.
- Export the approved results
- Go to eDiscovery → Cases → select the case → Searches.
- Select the search, then choose Export.
- Enter an export name, select the appropriate matching-item option, and start the export. The investigator needs the Export capability. ^5^
Only messages still retained and available under the school’s retention, deletion, and hold configuration can be found. Licensing and case configuration determine which search, review, and export workflow is available; they do not restore content that is no longer retained.
If this is not a formally authorized safeguarding, legal, HR, or compliance investigation, ask the users to share the relevant messages voluntarily or move the discussion to a shared Team/channel. Do not attempt to obtain their passwords or access their accounts.
References
- Learn about retention for Microsoft Teams
- Assign permissions in eDiscovery
- Learn about eDiscovery
- Finding content in Microsoft Teams in eDiscovery
- Export search results in eDiscovery