What Share of a Chat Collection Is Actually Relevant?

A chat collection's size reflects how it was gathered; the flagged few are what the matter requires.

Microsoft Purview eDiscovery (Premium) cannot isolate one 1:1 Teams chat at the search stage, so the participants' other chats are collected too, and the review set swells unread.

Allow me to begin with a particular instance. On 2026-07-18, a Microsoft 365 E5 customer asked on Microsoft Q&A how to export only one 1:1 chat between two users; searches on Participants, Sender, Recipients, KeyQL and Message Kind still returned other 1:1 chats, group chats and meeting chats. A Microsoft moderator answered that Conversation ID, Thread ID and Conversation Type "aren't supported search properties." The supported path is to collect the participants' chat, commit it to a review set (the working copy that reviewers code), and rebuild the thread there. Even the ConversationType field reads "Group" for 1:1 and group chats alike.

According to Microsoft Learn, Teams keeps chat in two separate copies, one for compliance, used by eDiscovery, and one for user access. The search therefore works on the compliance record. Precision must come afterwards.

My position follows from this. The message count in a chat review set records what the tools could not exclude, not what the matter requires. A per-message price built on that count overstates the burden. As a 2025 CCSP audio course put it, "Search strategies transform vast datasets into manageable review pools." No published source yet measures how manageable a chat pool becomes. I shall not invent that figure; I shall show how to find it.

What share of a chat collection is actually relevant?

No published source, OpenText's EDRM guidance included, measures the responsive share of a chat collection; the defensible figure is the one measured on your matter, each coded message traced to its source.

An analysis of 7 sources shows that none publishes a measured responsiveness rate for chat. In February 2022, OpenText reported on the EDRM blog that over 600 billion chat messages had been sent among businesses alone in the prior year, and that Microsoft Teams usage had increased by more than 330 percent; neither figure carried a cited source. By a responsiveness rate I mean the share of collected items that reviewers code as answering a discovery request. It is worthy of notice that the same post described chat as "inherently designed to encourage long threads and large volumes of data," yet offered no figure for how much of that volume ever bears upon a case.

Because the number is absent, I would put every chat estimate through what I call the reach-versus-need test, a three-question lens that separates what a collection tool gathered from what the matter requires:

1. Reach: how many messages did the search and collection return?
2. Need: how many of those fall within the custodians, dates and conversations the requests actually name?
3. Proof: of that narrower set, how many does a reviewer code responsive, with each call traced to its source message?

A common misconception is that a larger chat collection means a proportionally larger review. The reality is otherwise, and OpenText's own guidance concedes the point: it recommended breaking chat histories into blocks of time "to narrow the volume of chat that requires eyes-on review." The same post, it is curious to note, enumerated the particulars that swell a chat set, namely replies, reactions, edits, deletions, leave and join events, and attachments. In practice, a raw message count measures reach, not need, which is why a small case with chat data can still arrive as a large review job. The difference is KEY.

The economics follow from that distinction. In our experience, AI-assisted review runs cents per document, against the dollars per document and roughly $19K/GB of manual review, a difference the buyer can see on their own matter. Our outputs also link back to the exact exhibit they came from, so an attorney can verify any answer with one click before filing. I am inclined to think that this pairing, a lower unit cost and a visible trail to the source, is what allows a firm to test the need figure rather than accept the reach figure on faith.

What would a measured rate show once collected? For a particular matter, it would give the proportion of collected messages coded responsive, and it would let a buyer set that proportion beside the raw count before accepting any quote. The evidence on record does not yet supply that proportion. I shall not supply one in its place.

The takeaway is plain: price the need, not the reach.

Summary: The responsive share of a chat collection is not yet a published number, and the only figure worth trusting is the one your own matter produces, traced message by message to its source.

What will matter most for chat review over the next 12 to 24 months?

Over the next 12 to 24 months, I expect chat budgets to shift from paying per message reviewed toward paying to scope, isolate and cull conversations before any reviewer reads them.

I hold this view because three observations, drawn from quite different quarters, point the same way. None of them measures the responsive share of chat directly. That figure has not yet been published by anyone, and each signal below should be read as circumstantial rather than conclusive.

It is worthy of notice that all three signals concern the stage before review. The collection is fixed by search properties, the hold by the date on which litigation became foreseeable, and the purge by the same search that set the hold. Review inherits whatever those earlier choices produce. For that reason I am inclined to think the budget conversation will migrate upstream, toward whoever can show, in writing, why a given conversation was kept or set aside.

What would change this forecast: if Microsoft added Conversation ID, Thread ID or Conversation Type as supported search properties, chat could be isolated at the search stage. Over-collection would then shrink at the source. I would expect the argument to move from scope toward review quality, and the case for culling would weaken accordingly.

What most buyers miss: more business chat does not mean a matching rise in review bills. ComplexDiscovery projects review's share of eDiscovery task spend at 52 percent for 2030. Volume grows at collection. Need grows only as fast as the requests for production, and a buyer who budgets on the first will be paying for reach.

Why do chat collections come back larger than the matter?

Chat is collected in coarse slices, whole channels and 12-hour chunks, so non-relevant, even privileged, talk rides along; that surplus should be processed where it never leaves your control.

According to Greg Buckles, editor of eDiscovery Journal, writing on December 26, 2024, the new Microsoft Purview eDiscovery portal collects chat in 12-hour chunks. In Microsoft 365 Teams, 1-1 chats are stored in participant mailboxes, while channel messages are owned by the Team site group and stored in that group mailbox. Buckles thinks of channel chats as "recordings of conversations, reactions and item exchanges that take place in a virtual 'room' over time," in which participants come and go across "multiple interwoven topics that can cover months." It appears, upon such a description, that the unit of collection is seldom the unit of relevance.

Three particulars, as Buckles records them, carry a collection past the matter's need:

1. Coarse slices. Time-clustered hits fit the 12-hour chunks, but "occasional mentions scattered over days may require entire channel chat collection by broad time bands."
2. Uncertain sources. Custodians "frequently forget the full names of channels," so interviews alone cannot fix where a conversation lived.
3. Versioned attachments. Cloud attachments can be retrieved as the latest version only, the last 10, the last 100, or all versions, and he warns that version retrieval "can make a huge impact on matter volume."

Buckles adds that broad collection "may pose redaction/disclosure issues by collecting non-relevant conversation segments." In practice, over-collection is a privacy cost as well as a review cost.

Here, however, the simple answer breaks down. A small responsive share does not make chat a minor source. Buckles writes: "All of the key determinative evidence I have extracted from bloated holds recently seems to come from cloud instant messaging sources." He also recalls the Enron era, when his team kept a "5000/1 rule" on email: for every 5,000 emails reviewed, one violation was referred to HR. It is worthy of notice that this was never a responsiveness rate; it counted referrals, a far narrower thing. What this means is that rarity and importance travel together. The decisive message may be one among thousands.

The tension, then, is this: the surplus must be culled, yet culled with care, and it must be held somewhere safe while that work proceeds. In our experience, privileged evidence never leaves the client's control. Processing runs single-tenant, or inside the client's own AWS account under their own keys, with no vendor retention and no model training, so nothing fed to it trains anyone's model or waives privilege. I am inclined to think that in-account deployment of this kind is a trust posture no consumer AI tool, and almost no small-firm tool, can match.

TIP: I'd recommend testing any platform on the hard case rather than the easy one. Bring a messy chat collection and a hard question, and watch the system read, code and cite your own evidence instead of reading a case study about someone else's.

Summary: Chat collections outgrow the matter because the tools gather by chunk, channel and version rather than by conversation, and the few messages that matter are rare but decisive, so the surplus must be culled carefully and processed under your own control.

Does narrowing a chat search create defensibility risk?

Narrowing carries risk when it is careless or undocumented; hash-verified originals, an append-only audit trail and a fail-closed privilege gate let a narrowed chat set withstand challenge.

It is remarkable how evenly the danger is divided. According to Episode 91 of the Certified CCSP Audio Course, published in September 2025, "Poorly designed searches risk missing critical documents or overproducing irrelevant material, increasing cost." The same episode notes that in cloud environments a legal hold may involve suspending deletion policies for mailboxes, chat histories, or object storage, and that "preserving a chat without timestamps or participants renders it nearly useless in court." A narrow search is therefore no remedy if it strips away the context that makes a message intelligible.

Microsoft's own documentation shows how much weight a single chat search definition carries. According to Microsoft Learn's guidance on finding and deleting Teams chat messages, dated June 2026, "The deletion process deletes all items returned by the search," and once the purge command runs, "you can't undo it and email messages and chats can't be restored." What this means is plain. One search definition governs what is held, what is reviewed and what may be destroyed.

For that reason I'd recommend keeping what I call a scope record, a short written account of every narrowing decision, built in three steps:

1. Name the locations. Microsoft Learn places 1:1 and group chats in participants' mailboxes, standard and shared channels in the parent team's mailbox, and private channels in a dedicated mailbox for each private channel.
2. Record the terms. Microsoft advises including "a date range or several keywords to narrow the scope of the search to items relevant to your investigation," and recommends the Type condition with the "Instant messages" option to identify Teams conversations most comprehensively.
3. Report before acting. A report-only export lets you examine detailed metadata before deletion, and I would keep that report in the matter file.

The CCSP episode adds that courts respect documented egress and scoping plans as "evidence of reasonableness." In practice, a written scope is a cost control and a risk control at once.

The record needs a sound vessel. In our experience, the process holds up if opposing counsel challenges it when originals are immutable and content-hashed, audit trails are append-only, chain of custody is documented, and a fail-closed privilege gate stands before production. A fail-closed gate, in plain terms, is one that defaults to blocking production rather than allowing it.

Such discipline was long confined to enterprise platforms. Relevant e-Discovery was built to bring enterprise-grade defensibility to small-matter economics, operable and affordable for a solo or small firm on a single messy matter, the segment Relativity and Everlaw price out and cannot serve without an administrator. The takeaway is that careful narrowing no longer requires an enterprise budget.

Summary: Narrowing a chat search is not itself the danger; an undocumented or context-stripping narrowing is. Name the locations, record the terms, report before acting, and keep hashed originals behind an audit trail, and the narrowed set will bear scrutiny.

How can I reduce the cost of document review in litigation?

Reduce the set before you price it: document a conversation-level scope, measure the responsive share on a sample, and pay for review of the need rather than the reach.

For chat, I expect the price of review to follow the price of scoping. So long as Purview's search cannot isolate one conversation by its Conversation ID, the review set will record the tool's reach, and a per-message quote will charge for it. That is the whole of my argument.

According to Microsoft Learn, a report exported before a purge "helps refine your search scope and ensures a more targeted and accurate purge." I would hold chat review to the same discipline. Report first, then read.

I confess the trade-off is real. A 2025 CCSP course observed of custodians that "Missing someone risks leaving gaps in evidence, while over-inclusion inflates costs and complexity." No scope escapes that tension; a written one merely shows where the line was drawn.

In summary, the measured responsive rate for chat is still missing from the published record. Put your next collection through the reach-versus-need test, write the result into your scope record, and let the quote follow the number.