Search Options

Backup for Microsoft 365 supports a number of advanced search options, including:

Smart Search Tags

Backup for Microsoft 365 supports the following Smart Search tags to narrow searches.


  • Recipient. Enter To:[Recipient Name] in the search field (e.g. To:Bob)
  • Sender. Enter From:[Sender Name] in the search field (e.g. From:Sally)
  • Subject. Enter Subject:[Subject Keyword] in the search field (e.g. Subject:Collaboration)


  • subsite:[subsite name] (e.g. subsite:marketing)
  • folder:[folder name]
  • file:[file name]
  • announcement:[announcement name]
  • contact:[contact last name]


In addition to expanded search and sort options, Backup for Microsoft 365 supports Elasticsearch.
In Elasticsearch, when a string is analyzed it gets tokenized by white space and certain special characters. For example, if an email subject line was "The big red ball", Elasticsearch mapping would index it in two ways:

  • The analyzed version would index this as ["the", "big", "red", "ball"]
  • The non-analyzed version would index this as "The big red ball"

Wildcard Search

Backup for Microsoft 365 supports wildcard characters. These are a simplified version of Regular Expression Search and include two characters: the asterisk (*) and the question mark (?).

Wildcard: Asterisk (*)

When you know only the beginning of what you are searching for or know that the first few letters are all you would need to enter to find the data. For example, if you are not sure if the name you are looking for is Matt or Matthew, you could search for Matt* which would return both Matt and Matthew. However, it would also return any data including other words starting with Matt.

Wildcard: Question Mark (?)

You can use the question mark wildcard when you aren’t sure of a letter or multiple letters in a word or phrase. For example, if you are not sure whether the person you are looking for is Kristen Jensen, Kristin Jensen, Kristen Larson, or Kristin Larsen, you could search for Krist?n Jens?n.

Regular Expression (RegExp) Search

Backup for Microsoft 365 supports Regular Expression (RegExp). This is a sequence of characters that define a search pattern, mainly for use in pattern matching with strings, or string matching. The examples below are the most common.

To perform a RegExp search in Backup for Microsoft 365 for:

  • SharePoint: Open the Advanced Search screen, check the Regular Expression checkbox, and enter your search query.
  • Exchange and OneDrive for Business, type the Smart Search tag "RegEx:" before your search query in the search field. E.g. RegEx:gr.y

RegExp Character: Period (.)

When you aren’t sure of a letter or multiple letters in a word or phrase, you can use the period sign. For example, if you are searching for the word that could be spelled “grey” or “gray”, you can search for both spellings by searching for "gr.y".

RegExp Character: Plus Sign (+)

If you are not sure how many repeated letters were used, you may use the plus sign as it matches any number of the preceding character. For example, if you don’t remember how many o’s you used when you described something that was really good. You can search for any number of o’s by searching for "go+d".

RegExp Character: Pipe Symbol (|)

When you want to query more than one word or phrase, you can use the pipe symbol. It acts as an "or" operator. For example: If you aren’t sure if the subject line of an email was Team Collaboration Kickoff or Kickoff for Team Collaboration and you don’t want to return every email that includes any of those individual words, you can search for both possibilities by searching for "Team Collaboration Kickoff"|"Kickoff for Team Collaboration".  

Search Queries

There are two types of queries you can use: a Match query or a Term query.

Match Query

To perform a match query, enter the word or words without quotations. Elasticsearch will analyze the query string and then do a check to see if any of the query terms match any of the field terms. So a "match" query where the query is "big ball" will actually tokenize the query into "big" and "ball" then go and look at the analyzed version and try to find a term that matches. It would successfully return "The big red ball" because both "big" and "ball" match the query. This is useful if you are not sure of the exact phrase you are looking for, but will potentially return more results than you are looking for, requiring you to sort through the results.

Term Query

To perform a term query, enter the word or words in quotations. In this case, Elasticsearch will not do any analysis at all. It will simply take the query you give it and try to match it against a term in the index. So "big ball" as a term query, won’t return "The big red ball" because "big ball" was not an indexed term. This is useful if you know exactly what you are looking for because it limits the results you may have to sort through. However, if it is not an exact match, it won’t return what you are searching for.