Microsoft Teams has lots of great features which allow teachers and students to communicate, but what happens if something goes wrong? As much as we would like to hope our students are perfect angels, bullying and other inappropriate activity is inevitable. If it happens in the playground, it’s going to happen online as well.
So when something does go wrong, and you need to investigate and collect evidence from Microsoft Teams, what’s the best way to do it?
Where does Microsoft Teams store student data?
Let’s do an overview first. At time of writing, there isn’t a single place that a teacher can go to to quickly review a student’s chat conversations and other interactions with students and staff. Microsoft Teams is an extremely complex system and stores data all over the place, which makes it difficult for anyone but an IT admin to review. Even then, it’s not a simple process, but it is possible.
Rather than go into all of the details, I’m going to outline below the simplest method to access the type of student data that I most often need to access when carrying out disciplinary action and investigations:
- How to access private one-to-one and group student chats.
- How to export posts, conversations and other content from a team.
The easiest way for a teacher to do this currently is to reset the student’s password and login to their account. It’s not ideal, and will alert the student that something is happening with their account, but it works.
All of the steps below require you to be a Microsoft 365 administrator for your school, and the process can be complicated. I recommend only doing this if you are familiar with the Microsoft 365 Admin portal.
As I said above, Teams stores data in many places throughout your 365 services, but the important locations you need to know are:
Because chat messages are stored in individual .eml files it makes it extremely difficult to piece together conversations. To deal with this we will export the Teams Chat messages as a PST file, which allows us to open it in Outlook and view the messages as threaded email conversations. By uploading the PST to a mailbox, we can also share the chat messages and make them easily searchable.
Microsoft, if you’re listening, what we need is a way to list student conversations and view the content without the student being aware. The feature already exists within Teams chat to add a new participant and view the chat history, so surely this can’t be too difficult?
How to search student Microsoft Teams data
This search will export all student Teams chat messages for a specific student within a specific date range. It’s not possible to narrow the search to just the Teams chat messages, so it will also pull out information from the following services:
- Exchange email
- Office 365 group email
- Skype for Business
- Teams messages
To start the search, do the following:
- Open Internet Explorer on a Windows 10 machine — yes, I know, but for some reason the export feature only works in IE.
- Open your school’s Microsoft 365 admin portal by visiting https://admin.microsoft.com
- Under Admin Centers click Compliance – https://compliance.microsoft.com
- From the menu choose Content Search – this can be hidden so the direct link is: https://compliance.microsoft.com/contentsearch
- Click New search
- Remove the keywords filter. If you wish to search for specific words or phrases you can add them here, but we are going to look for all content.
- Under Locations choose Specific locations and then Modify
- To search the Teams chat and email of one or more students, click Choose users, groups, or teams and add the students.
- To search the content of a class team, click Choose sites and enter the address of the team. You can find the team address by going to the Files tab of the team, clicking SharePoint, and copying the address bar.
- When you have added all of the students and teams that you want to search, it should look like this:
- Click Save.
- Now we need to set a date range to search. You can search everything, but this can take a long time, and the export will be huge. Click Add conditions.
- Choose and add Date and set the date range you want to search.
- Click Save & run to run your search.
- Give your search a name and click Save.
Your search will now start. Depending how much data there is, and the date range you have set, this can take quite a while. Don’t worry, though, you can close the window and come back later to see how it’s getting on.
Reviewing Student Data
Once the search has finished you’ll be left with a view similar to the one below. This should all of the exported content in a readable format. Each item is a piece of data within the student’s account. Each one will show the type of data it is, for example an email, a calendar entry, a message, or an assignment, and when you click on it you will see the information within.
This is good for quickly browsing emails and chat messages, but it has a few disadvantages.
- You can’t search within the content.
- A lot of the information will be duplicated.
- You can’t quickly jump to a specific message or email.
- It’s quite clumsy to navigate.
- There’s little context for the data.
Not to worry, we have a solution!
Exporting Student Data from Microsoft Teams
Now that we’ve done our search we can export all of the discovered content and download it for sharing and easier access. To export the data, do the following:
- Click More then Export Results at the top of the search page.
- Choose your preferred options on the Export results screen. I prefer to download individual messages as it can make sharing the files easier, but you can also download them as a PST and mount them into Outlook which makes it easier to review for some.
- Click Export.
This will now generate an export of your data. This process can also take a while, but you can start the download process before the export has fully completed.
How to Download your Export
- Click on the Exports option at the top of the screen.
- Click on the name of your export. You may need to click Refresh before it will show.
- Click Download results.
- The eDiscovery Export Tool will now download and run. Most error messages at this stage are the result of not using Internet Explorer.
- Copy the export key from the export screen and paste it into the eDiscovery Export Tool.
- Click Browse and choose where you want to save the exported files.
- Click Start and the download will begin.
Your downloaded files will contain a series of folders within which is a PST file containing all of the emails and Teams chat messages. When you open the file it can look like a mess of folders. To help with this the table below shows the locations of the most common information that you will need.
|Data||Location Within Export|
|Team Chat Messages||Top of Information Store\Conversation History\Team Chat|
|Email Inbox||Top of Information Store\Inbox|
|Sent Emails||Top of Information Store\Sent Items|
|Class Team Posts||Exchange\Team Name@domain (Primary)|
|Class Team Files||SharePoint\Team Name\Team Name\Shared Documents|
If you downloaded the files as a PST, you can open it in Outlook and browse the chat files as threaded email conversations. You can also easily copy them to other mailboxes for others to review.
As I said earlier, this works, but it’s a terrible implementation of content search for schools. We need a single admin centre which is accessible by teachers to a much easier way to carry out basic safeguarding and monitoring.