Share via

How to Build a KQL Query for eDiscovery in Purview to Search SharePoint Public Groups/Sites?

Carmen Kyi Oo 0 Reputation points
2024-12-27T08:11:26.1066667+00:00

I'm seeking guidance on discovering sensitive information within my organization's SharePoint public groups, folders, and sites, specifically those that are openly viewable or searchable by everyone in the organisation. Is it possible to construct a KQL query for this purpose? If so, what would that query look like? My understanding is that Sharepoint has public group vs private groups, is there a way to leverage this?

Microsoft Purview
Microsoft Purview
A Microsoft data governance service that helps manage and govern on-premises, multicloud, and software-as-a-service data. Previously known as Azure Purview.
1,338 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Ganesh Gurram 3,025 Reputation points Microsoft Vendor
    2024-12-27T08:59:33.91+00:00

    Hi @Carmen Kyi Oo

    Thanks for the question and using MS Q&A platform.

    According to this documentation: Finding content in sites in eDiscovery (preview)

    You can construct a KQL (Keyword Query Language) query to search for sensitive information within your organization's SharePoint public groups, folders, and sites. While the context provided does not specifically mention public versus private groups, you can use the ViewableByExternalUsers property to identify content that is shared externally, which may also help in identifying publicly accessible content.

    User's image

    To search for documents in SharePoint that are viewable by everyone in the organization, you might use a query like: ViewableByExternalUsers:true AND ContentType:document

    This query will return documents that are shared with external users, which can include publicly accessible documents if they have been shared appropriately. You can further refine your search by including specific sensitive types or excluding certain file types using the FileExtension property.

    For example, if you want to find documents containing sensitive information like credit card numbers, you could use: ViewableByExternalUsers:true AND SensitiveType:"Credit Card Number"

    Make sure to adjust your queries based on the specific types of sensitive information you are looking for and the structure of your SharePoint sites.

    For more information, refer to the below documentations:

    Hope this helps. Do let us know if you have any further queries.

    If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.