Create Compliance Search

Creates a new compliance search for Exchange Online in Microsoft Purview.

To actually perform the search, use the Start Compliance Search action.

Use the Run Compliance Search Action action to determine what to do with the result.

For more information, view the Microsoft Documentation.

info

The action may succeed with "No Output" if the permissions are invalid, but the parameters are correct.

Verify that the action returns a output and that requested operation was actually performed.

Installed version: 3.5.0

Basic Parameters

Parameter	Description
Content Match Query	Keyword Query Language (KQL) query for the search. For information on how to format the query, view the KQL documentation and eDiscovery query reference. Only matched emails will be added to the results.
Exchange Location	Where the search should take place. Can be the name of a mail group, user, or the constant all for all inboxes.
Name	Name for the compliance search.

Advanced Parameters

Parameter	Description
Description	Optional description for the search.

Example Output

{
    "PSComputerName": "eur05b.ps.compliance.protection.outlook.com",
    "RunspaceId": "67bf5df2-292f-4cdc-9276-65400e446699",
    "PSShowComputerName": false,
    "StatusMailRecipients": [],
    "LogLevel": "Suppressed",
    "IncludeUnindexedItems": true,
    "ContentMatchQuery": "subject:microsoft",
    "SearchType": "EstimateSearch",
    "HoldNames": [],
    "SearchNames": [],
    "RefinerNames": [],
    "Region": "",
    "Refiners": null,
    "Items": 0,
    "Size": 0,
    "UnindexedItems": 0,
    "UnindexedSize": 0,
    "SuccessResults": "{}",
    "SearchStatistics": "",
    "Errors": null,
    "ErrorTags": [],
    "NumFailedSources": 0,
    "JobId": "99ef59da-d25b-4df2-837c-08db1db08bc6",
    "Name": "my-search",
    "CreatedTime": "2023-03-05T19:33:49.9549564Z",
    "LastModifiedTime": "2023-03-05T19:33:49.9549564Z",
    "JobStartTime": null,
    "JobEndTime": null,
    "Description": "",
    "CreatedBy": "FFO",
    "RunBy": "",
    "TenantId": "1234567-8a55-469a-81bf-2f6a26736618",
    "NumBindings": 0,
    "Status": "NotStarted",
    "ExchangeLocation": [
        "All"
    ],
    "PublicFolderLocation": null,
    "SharePointLocation": null,
    "OneDriveLocation": null,
    "ExchangeLocationExclusion": null,
    "PublicFolderLocationExclusion": null,
    "SharePointLocationExclusion": null,
    "OneDriveLocationExclusion": null,
    "JobRunId": "812982d9-5448-41f1-837c-08db1db08bc6",
    "Retry": false,
    "AllowNotFoundExchangeLocationsEnabled": false,
    "JobOptions": 0,
    "JobProgress": 0,
    "CaseId": null,
    "CaseName": "",
    "PagingState": "",
    "Identity": "1234567-5448-41f1-837c-08db1db08bc6",
    "ContentURL": "",
    "ResultInEOP": false,
    "AzureBatchFrameworkEnabled": false,
    "IsValid": true,
    "ObjectState": "New"
}

Automation Library Example

Create Compliance Search with Exchange Online and Send Results Via Slack

Preview this Automation on desktop