Table of Contents
Slower and Buggy
I can’t find a notification that the Microsoft 365 compliance center was to receive a GUI makeover for content searches, but maybe I missed that memo. As it turns out, the notification is MC246002, but it dates back to March 23 and was overtaken by events. In my unaware state, I was surprised when a new user interface is now available in the tenants I have checked. The documentation is dated May 11, so I assume that’s when things changed. Curiously, the documentation refers to Office 365 Groups instead of Microsoft 365 Groups and insists on talking about the mailbox associated with a team (for channel messages). This perpetuates the nonsense that Teams uses Exchange Online to store data and ignores the storage of compliance records for personal and group chats in user mailboxes, but hey, it’s only documentation.
The old content search interface was around for several years and needed a refresh, and this release brings the interfaces for content searches and Core eDiscovery in line with that used for Advanced eDiscovery (which requires Office 365 E5). It also aligns the interface with Microsoft’s accessibility guidelines. The problem of refreshing anything is the potential of breaking things or making a feature work worse than before. Microsoft has succeeded splendidly in attaining both objectives. The new content search interface is both slow and buggy. Let’s hope it improves over time.
Fresh Interface
The good news is that the new interface is better looking and in line with the other sections of the Microsoft 365 compliance center. Microsoft has clearly paid attention to simplifying the creation of searches. For example, they’ve rationalized the set of locations into three types: Exchange mailboxes, SharePoint sites, and Exchange public folders (Figure 1). This is a good step because it avoids getting worried about differentiating between user, shared, and group mailboxes, compliance records for Yammer and Teams (and Planner in the future), OneDrive and SharePoint, and so on.
Also, content searches now automatically include “app content.” Although this checkbox says that it includes content for on-premises users, it means content stored in cloud-only mailboxes created by the Microsoft 365 substrate to hold messages sent by hybrid, guest, and federated users. This capability existed in the old interface, but a tenant had to ask Microsoft support to enable support for app content. It’s good that the option is now available to all.
Problems in the Location Pickers
Unfortunately, things start to go downhill from this point. First, the picker used to select Exchange mailboxes is very slow. Even on my small tenant, it takes ten seconds or more to find a mailbox. Also, note that the email address field is promised but not displayed (Figure 2). Seeing the email address is often helpful in distinguishing mailboxes with similar display names. On the upside, the picker allows selection of distribution lists and Microsoft 365 groups, which makes adding a bunch of mailboxes easier. You can also add inactive mailboxes to a search.
The picker also suffers a deselection problem. Take the example where you have selected several mailboxes, groups, and lists for a search and the decide that you want to start over. Figure 3 shows that a search has eight mailboxes selected, but details of the mailboxes are not shown to allow their removal. The only way I have found to deselect a mailbox is to search for it again and then remove the check against its name. This might be acceptable for one mailbox; it is tiresome when a search spans many mailboxes.
The SharePoint site picker still insists on URLs to find sites. It’s reasonably easy to find the URL for a site, but it would also be good if the picker allowed input of the site name. Bizarrely, if you go back to the site picker to update the list of selected sites, a list of the selected sites is available and it’s easy to uncheck a site (Figure 4).
Keywords and Conditions
After selecting target locations, the next step is to add the keywords and conditions for the search. There isn’t much change in the keyword list, but the way to select conditions has changed. In the past, each condition showed if it was common (applied to both Exchange and SharePoint) or specific to a workload. For instance, the Sent date condition applies only to email whereas the last modified condition is really a document condition (emails don’t change after sending). Now, there’s no assistance about what condition can be used with the different locations.
If you try to use a condition not supported by a selected workload, you’ll see an error (Figure 6). In this case, I selected the message kind condition which SharePoint doesn’t support.
Fine. Let’s remove the offending condition. The compliance center still wasn’t happy and generated an obscure, impenetrable error (Figure 7). The point here is that Microsoft has worked on content searches for over five years. It’s unacceptable when error messages fail to tell the end user exactly what they need to do to resolve the issue. As I worked through content searches over several days, I encountered more errors and problems than in the last year, and most of the errors were incomprehensible.
After going back to the search summary screen, even more gobbledygook erupted with diagnostic information that might make sense to a computer but means absolutely zilch to me. In this case, the search criteria (query) still includes the problematic message kind condition, but the error persisted even after removing the condition.
There was no way out except to abandon editing the search and start over. Eventually, I created an acceptable set of conditions and keywords and saved the search. The compliance center then launches an estimate search to create a sample set of results.
Samples and Previews
An estimate search is just that. It is a quick search to estimate what items a full search will find. To help the searcher figure out if their query works, the estimate returns a small sample of items matching the query. In the past, this was called a preview search.
When the estimate is complete, the summary screen for the search displays search statistics such as the number of matching items found and how many mailboxes and sites the search processed. Unlike previously, you now need to use an explicit option (Review sample) to see the items retrieved by the search.
Running the estimate search seems slower than before. This is a gut feel because I don’t have the two interfaces to test. However, I have run enough content searches over the year to know when something is not quite right. Retrieving the review sample items is also slow. Painfully slow at times. In addition, the preview screen (Figure 9) doesn’t tell you how many sample items are available.
Two problems surfaced here. First, scrolling through the list of preview items sometimes failed and I had to return to the search summary to start again. Second, the previous facility to choose to display 50, 100, or 200 preview items is gone. You can only see what search chooses to display,
Another irritation is that although Microsoft’s documentation says Word documents can be previewed, this version stubbornly refused to preview documents.
Impact on Core eDiscovery
Content searches underpin the Core eDiscovery functionality in the Microsoft 365 compliance center. The new interface now appears for Core eDiscovery. However, the ability to perform bulk operations has disappeared. This creates a big gap because a major difference between running individual content searches and an eDiscovery case is that the eDiscovery case can span multiple searches, each with their own locations and search criteria. In the past, eDiscovery managers have been able to combine the results from multiple searches into a single bulk export. That option is no longer available.
Nice Interface, Shame About the Slowness and Bugs
The remainder of the content search lifecycle (exporting search results and reports) works largely as before and doesn’t need any commentary. But getting to the point where results can be exported now takes longer and the experience, although mitigated by a nice UI, is spoilt by slow and buggy code. I don’t know if any of the Microsoft engineers and testers who worked on the new content search UI have ever conducted a search in anger in the context of something like a fraud investigation. If they had, they might just have realized that what’s been given to customers has some real problems. And that’s sad.
I’m sure Microsoft will fix the problems in due course. Hopefully, that’s sooner rather than later. And it would nice if they tested the code first before releasing it to paying customers.
Update May 28: I’ve had a conversation with Microsoft about the issues noted above. Microsoft acknowledges that they have work to do to fix bugs and improve performance. We’ll track this activity in future.
We’re busily revising the Office 365 for IT Pros eBook to include details of the new UI for content searches. Subscribers will see this work in a monthly update coming soon.
The more I use it, the less I like it.
Dumb down the Administrator’s interface… What could possibly go wrong?
At least there’s always PowerShell…