Using In-place Search for Graph
When preserving an Office 365 or Microsoft consumer mailbox (e.g., Hotmail, Outlook.com, etc.) using Microsoft Graph API, it is possible to perform in-place searches to narrow down the data set. You can launch the in-place search interface for Graph by clicking the "Perform Pre-Acquisition Search" link as shown below:
FEC in-place search allows you to execute your search query on the server and preview the search results. Graph API searches use Keyword Query Language (KQL) syntax. You can find the details in Microsoft's documentation below:
1. Although the KQL syntax reference advises using double quotation marks to construct phrase searches, Graph API requires that you use single quotes instead. For instance: 'contract dispute'
2. KQL syntax looks very similar to the Advanced Query Syntax used with EWS. Please note that date searches in KQL should appear without colons, as in the example below:
received>=2016-01-01 OR sent>=2016-01-01
Saving the Search Query
Once you have finalized your search query, you can save it by using the SAVE button. This will close the in-place search window and activate your query. You will see a notice as in the screenshot below:
Clearing the Search Query
If you would like to clear the search query, you can click on the small (x) symbol next to the "Search Query Activated" text as shown in the figure above.
Limitations of Graph Search
The search functionality built into Graph API and utilized by FEC is limited to the documents that Microsoft's servers are able to recognize and index. For instance, a proprietary CAD file unrecognized by the server, or files inside an encrypted file archive would not be indexed or searched. Similarly, if a file has no extractable text (e.g., a scanned TIFF image of a document), the server would not be able to extract text from it or index it.
Given the above limitations, it may be appropriate to use the Graph API search functionality in FEC to filter messages by top-level message characteristics such as sender, recipient, and subject content. Keep these limitations in mind if you plan to use this functionality to perform a blanket search intended to search all documents and their attachments recursively.