All About Yammer Compliance Records

Communications Compliance Gains Yammer Support

The advent of support for Yammer conversations in Microsoft 365 Communications Compliance policies created some questions about how monitoring works and if Yammer compliance records served any role. The answer is simple:

• A Yammer network can’t support communications compliance unless it is configured in native Microsoft 365 mode. This step connects Yammer communities with Microsoft 365 groups.
• When in Microsoft 365 mode, the Microsoft 365 substrate captures compliance records for Yammer conversations. The compliance records are mail items stored in the Exchange Online mailbox for the Microsoft 365 group belonging to the community. Compliance records for private Yammer conversations are in the Exchange Online mailboxes for conversation participants.
• Communications compliance policies monitor compliance records to look for problematic content such as threatening behavior. If policies detect issues, investigators work with copies of compliance records stored in special supervision mailboxes to resolve whatever is found.

All of this sounds very familiar because it’s exactly the same approach used by Teams. The only difference is that Teams stores its compliance records in a folder called TeamsMessagesData while Yammer uses one called MessageIngestion\Yammer. Both folders are in the non-IPM section of mailboxes and are invisible to users.

Indeed, in early 2021, Microsoft announced that Planner would adopt the same substrate-driven approach to achieve compliance. However, they have since taken that idea off the table.

eDiscovery

The compliance records for Yammer are mail items. Like the compliance records captured for Teams, the Yammer compliance records are not perfect copies of the messages posted to Yammer communities or privately between users. However, the items are good enough for compliance purposes, and because they’re stored in Exchange Online, the items are indexed and discoverable.

Yammer messages come in several types, including:

• Praise.
• Questions.
• Announcements.
• Polls.
• Discussion.

In addition, the messages can include GIFs, graphics, and reactions.

To discover what content is captured and discoverable, I posted a range of message types to a Yammer community and in private messages. I then ran a content search to find the messages (Figure 1). You’ll notice that the mail items the substrate creates for Yammer compliance records do not support preview. Also, Praise messages don’t have subjects or titles, which accounts for the message with No subject in the sample set.

By definition, the preview sample retrieved by a content search (or in Core eDiscovery) is not every message that a search can find. The full set is only recovered by exporting search results. To examine the items, you can export the results to a PST (or a PST per mailbox) and open the PST in Outlook. Figure 2 shows a Yammer message with a GIF as displayed by Outlook.

You can see that the search found items in the Yammer folder as expected. Some also came from the SubstrateHolds subfolder in Recoverable Items. For some reason, these items stored Yammer poll messages.

Reactions are the only major missing element for Yammer compliance records. This isn’t surprising because the same issue exists for Teams.

Because the compliance records are in Exchange Online mailboxes, you can examine their properties and content with the MFCMAPI utility. Figure 3 shows the compliance record for a Yammer private message as viewed in MFCMAPI. The message is a single line of text surrounded by a bunch of HTML that doesn’t seem to do a lot.

Tracking Yammer Community Activity

Early versions of the Teams and Groups Activity Report used the Get-ExoMailboxFolderStatistics cmdlet to check the presence of compliance records in group mailboxes to understand the activity level of teams and groups. Although the latest version of the script sped up processing by using Graph API calls instead, the cmdlet is still a good way to check the Microsoft 365 Groups used by Yammer communities for activity.

The code needed is straightforward. First, find the set of groups used by Yammer. Next, use Get-ExoMailboxStatistics to fetch the folder data. Finally, report the data after calculating how long it’s been since someone posted to the community. Here’s the basic code:

[array]$YammerGroups = Get-UnifiedGroup -ResultSize Unlimited |?{$_.GroupSku -eq "Yammer"}

If (!($YammerGroups)) {Write-Host "No Microsoft 365 Groups found for Yammer -exiting"; break}

$YammerData = [System.Collections.Generic.List[Object]]::new()
ForEach ($Group in $YammerGroups) {
  Write-Host "Processing" $Group.DisplayName
  $Folder = (Get-ExoMailboxFolderStatistics -Identity $Group.ExternalDirectoryObjectId -Folderscope NonIPMRoot -IncludeOldestAndNewestItems | ?{$_.FolderType -eq "Yammer"})
  If ($Folder.NewestItemReceivedDate) {
    $TimeSincePost = New-TimeSpan ($Folder.NewestItemReceivedDate)
    $FormattedTime = "{0:dd}d:{0:hh}h:{0:mm}m" -f $TimeSincePost }
  Else { 
      $FormattedTime = "N/A" }
  $ReportLine = [PSCustomObject][Ordered]@{  
     DisplayName = $Group.DisplayName
     Items       = $Folder.ItemsInFolder
     NewestItem  = $Folder.NewestItemReceivedDate
     TimeSincePost = $FormattedTime }
  $YammerData.Add($ReportLine)
} # End For
     
$YammerData | Sort Items -Descending | Out-GridView

The script is available for download in the Office 365 for IT Pros GitHub repository.

Figure 4 shows the community statistics generated from the compliance records in my tenant. Obviously, Yammer doesn’t get much usage, but the data is sufficient to prove the point.

Only Modern Yammer

Remember that Yammer (or rather, the Microsoft 365 substrate) generates compliance records only when networks run in native Microsoft 365 mode. This is now the default for new tenants who’ve never used Yammer before. For older tenants still using traditional Yammer, some work needs to be done before they can enjoy the useful compliance records.

---

Learn more about how Office 365 really works on an ongoing basis by subscribing to the Office 365 for IT Pros eBook. Our monthly updates keep subscribers informed about what’s important across the Office 365 ecosystem.