How to Build a KQL Query for eDiscovery in Purview to Search SharePoint Public Groups/Sites?

Hi @Carmen Kyi Oo

Thanks for the question and using MS Q&A platform.

According to this documentation: Finding content in sites in eDiscovery (preview)

You can construct a KQL (Keyword Query Language) query to search for sensitive information within your organization's SharePoint public groups, folders, and sites. While the context provided does not specifically mention public versus private groups, you can use the ViewableByExternalUsers property to identify content that is shared externally, which may also help in identifying publicly accessible content.

To search for documents in SharePoint that are viewable by everyone in the organization, you might use a query like: ViewableByExternalUsers:true AND ContentType:document

This query will return documents that are shared with external users, which can include publicly accessible documents if they have been shared appropriately. You can further refine your search by including specific sensitive types or excluding certain file types using the FileExtension property.

For example, if you want to find documents containing sensitive information like credit card numbers, you could use: ViewableByExternalUsers:true AND SensitiveType:"Credit Card Number"

Make sure to adjust your queries based on the specific types of sensitive information you are looking for and the structure of your SharePoint sites.

For more information, refer to the below documentations:

• Finding content in sites in eDiscovery (preview)
• Keyword queries and search conditions for eDiscovery

Hope this helps. Do let us know if you have any further queries.