Teams chats and channel posts are a bit of a problem to manage as records because it is not easy to capture them – either individually or as a thread. The most common solution is to screenshot them but this is hardly ideal.
End-users may be able to delete or edit sent chats and posts. What happens to these? How can you know if a sent message was deleted or edited? Can you see the version history for edited messages?
This post explains.
Settings that allow deleting and editing
The Messaging policies section of the Teams admin center (https://admin.teams.microsoft.com/policies/messaging) contains the global settings that allow end-users to delete and edit sent chats and channel posts.
In addition to the global settings, Team Owners may also modify the same settings for a Team only if the above options are enabled:
Editing sent chat messages
Here is an example of a sent chat message. We can see from the little ‘eye’ icon on the right of the sent message that the recipient has seen it.
The image below is the same message that has now been edited. The time stamp doesn’t change and no version history is available to the sender or recipient (but see below). The person who received it may not necessarily notice that the text was edited (who goes back to read messages?).
Editing sent channel posts
The following is an example channel post. Only the author of a channel post can edit it.
If the message is edited, this is indicated as shown but the time stamp stays the same. Again, no version history.
How to see the version history for chats and posts
A ‘compliance copy’ of all Teams chats and channel posts is stored in Exchange Online mailboxes until they are deleted. If there is no retention policy set for these chats and posts, deleted messages are (permanently) deleted relatively quickly. If there is a retention policy, they remain in the mailbox until the end of the retention period and are then subject to whatever action is set on the policy (e.g., destroy, do nothing).
The only way to check the previous versions of a chat or post is to create a Content Search case in the Compliance admin center. However, access to Content Search is restricted because it allows the person with access to search across all emails, Teams chats and posts, OneDrive and SharePoint.
Consequently, content searches for Teams chats/posts are likely to be only carried out for specific reasons – for example, threatening or harassing messages that were then edited.
The image below shows the results of a content search for myself as the author. The search returned two results for the edited channel post – one for the original and one for the edited message. Every time the message is edited, another copy will be retained. Note that the visible timestamp hasn’t changed.
When the messages are exported (as a .eml file), the only difference between the two is the ‘CorrelationVector‘, ‘a format and protocol standard for tracing and correlation of events through a distributed system based on a light weight vector clock’.
- Original message correlation vector: “phE37FG2rU289DE7MmZndA.1.3.1.1194298459.1.0”}
- Edited message correlation vector: “kZOVelgz1UWNU5DIxmO+NQ.1.4.1.1221869943.1.0”}
Everything else (apart from the edited text) is identical.
What happens when messages are deleted?
Microsoft’s guidance on Teams messaging policies dated 25 November 2021 appears to show no difference between deleting chat and deleting sent messages.
If deleting is allowed, what happens to these deleted chats or messages depends on whether a retention policy has been applied. Either way, if the chat or post has been deleted, it will be indicated as follows:
When a chat or message is deleted:
- If there is no retention policy, the messages are completely deleted within a day or a few days and cannot be found after that via a content search.
- If a retention policy has been applied to chats and posts and it hasn’t expired, the messages can be found via a content search.
- If a retention policy that applied to these messages has expired, then the messages will be deleted within a few days unless the disposal action is ‘do nothing’ or ‘keep forever’.
Implications for records
Organisations need to decide if Teams chats/posts may be records and, if they are, how they are to be captured especially given that a ‘compliance’ copy is stored in Exchange mailboxes until they are deleted.
At least four approaches are possible:
- Allow end-users to delete Teams chats/posts whenever they like, with no retention applied. Chats or posts that are not deleted will simply remain until the Team is disposed of. This approach has potential implications if chats/posts contain harassing or offensive content.
- Set a relatively short-term retention period for both (e.g., 30 days or 3 months), on the basis that chats/posts are not official records – but end-users are encouraged to capture any that could be records, probably as screenshots stored in SharePoint (or somewhere else). This approach provides the option to recover a message within a reasonable period of time.
- For Teams 1:1 chats (that are stored in the personal mailboxes of participants), set the same retention period as the Exchange mailbox.
- For Teams channel posts (that are stored in the mailbox of the associated Microsoft 365 Group), set the same retention period as the SharePoint content.
Managing Teams chats and posts as records is not a simple process. Organisations should consider the implications of allowing end-users to delete or edit sent chats or posts and set retention periods accordingly.
Addendum – there are a number of third-party products that can capture Teams chats and posts. However, one of the biggest problems with any type of chat is that a related thread may contain several messages. It may actually be easier to focus on applying retention to the chats and posts stored in the mailboxes.)
Feature image – Miguel Á. Padriñán via Pexels.
Records about the world 
Does the banner notification update when you edit a chat
In my testing (and experience with live environments) no, neither the sender nor the recipient gets any notification that the message was edited.