Create a query to filter a preservation policy

Keywords can help you narrow down the content that's included in a policy. By creating focused searches for a preservation policy, you reduce the amount of content that you need to preserve in each content source.

Example of using the keyword phrase "Executive Briefing" and the search time frame of July 30, 2015 to July 30, 2017 for a new preservation policy

Queries help you narrow down these content sources and refine the content that's preserved by creating rules with keywords, operators, and wildcards. A query in a preservation policy supports Keyword Query Language (KQL). For more information, see Keyword Query Language (KQL) syntax.

Note: For content to be included in a preservation policy, it must be crawled by search. For more information about the default file types that are crawled, see Default crawled file name extensions and parsed file types in SharePoint Server 2013, which also applies to Office 365.

Operators and proximity in keywords

Special operators, such as Boolean and proximity operators, can be used to create relationships between multiple keywords. The operators must be written in all uppercase letters. If you need to use multiple operators, you can group them with parenthesis to determine the order in which they are applied.

For example, you might be looking for content with the term “executive”, but you don’t want to find the term when it appears in the title of a common report in your organization called the “Executive Summary”. When you use the phrase “executive NOT summary”, you can narrow down the number of items returned from 300 to 188 because you are eliminating any documents that contain the word “Summary”.

When two words are specified with no operator, an implied AND exists. For example: “wooly worm” is the same as “wooly AND worm”.





Find content that contains all of the words or phrases it separates.

risk and value and VAR finds all the content that contains all three words.


Find content that contains either of the words or phrases it separates.

risk OR VAR finds all the content that contains either word.


Exclude content that contains the term within a phrase.

Executive NOT Summary finds all the content that contains the phrase Executive, unless the content also contains the term Summary.

( )

Group words or phrases to show the order in which they are applied.

(Risk AND management) OR (VAR or Value-at-risk)


Finds words that are near each other, where n equals the number of words apart. If no number is specified, the default distance is 8 words.

Mid Near(5) Office finds Mid and Back Office and Mid-Office and Mid, Back, and Front Office.


Wildcards can help you expand your keywords to include terms that contain part of a keyword or terms that have alternative spellings.




* at the end of word

Find terms that contain the root word and any additional letters.

risk* finds risk, risks, risked, risking, and risky

Basic rules for using keywords in filters and queries

  • A content filter or query can include words, quoted phrases, and terms that use keywords and properties. Separate terms with spaces.

  • Commonly used words such as the, it, and by, and single-digit numbers, are ignored.

  • When you enclose a phrase in quotation marks, your search returns content within the chosen scope that contains the exact phrase that you typed. If there is any variance between the phrase in quotations and the actual content, the content will not be found.

  • Operators (for example, Boolean operators)—such as OR and AND—should be written as all uppercase.

  • You can search for a property value of a list or library with keywords. Enclose a property value in quotation marks to find an exact match, or leave the value unquoted to find partial matches that begin with the letters typed. For example, if you look for filename:"Budget" (with quotation marks), your search will return a file named "Budget.xlsx." A search for filename:budget (without quotation marks) will also return the files "Budget_Current.xlsx" and "Budget_Next.xlsx."

  • A query must include a term to find. Queries that consist only of terms to exclude will produce an error message.

Examples for applying rules


Example results

Executive Briefing

Any content that contains both Executive and Briefing, anywhere in the document, page, or metadata.

“Executive Briefing”

Any content that contains the words “Executive Briefing” together, anywhere in the document or page.

“Executive Briefing” AND “Executive Summary”

Any content that contains the words “Executive Briefing” together, anywhere in the document, page, or any content that contains the words “Executive Summary” together.


Any file with budget in its filename, such as 2016 budget projections.docx, 2016 budget priorities.pptx, 2016 budget planning.xlsx, 2016 budget review.xlsx, and so on.

filename:2016 budget filetype:xlsx

Excel worksheets that contain the phrase 2016 budget, such as “2016 budget planning.xlsx” and “2016 budget review.xlsx”

See Also

Overview of preservation policies

Create a preservation policy

Share Facebook Facebook Twitter Twitter Email Email

Was this information helpful?

Great! Any other feedback?

How can we improve it?

Thank you for your feedback!