What should a reasonable FOI search include? A checklist for Outlook, Teams, SharePoint, OneDrive, and everything around them

The search is the part of an access request nobody sees until it goes wrong. The requester gets records, or a letter saying none exist. If they appeal, the commissioner, tribunal or court gets the file, and what decides the appeal is rarely whether the office found everything. It is whether the office can show where it looked, who looked, with what terms, and why it stopped. In an organization that works in Microsoft 365, the places to look have multiplied: one decision can sit in an email, a Teams chat, a channel post, a file shared in that chat, a Loop component, a meeting recording, and a Copilot prompt, and Microsoft stores them in different places.

How “reasonable” is treated across jurisdictions

Every access regime asks the same question in its own words: did the institution look properly? None of them asks for proof that a record doesn't exist. Here is how each one puts it.

What they all expect

• Method, not result. A search is judged by how it was done rather than by what it found, so the record of the search matters as much as the search itself.
• The people who know the records. The OAIC says searches should be done by the officers most likely to find the documents "rather than the FOI officer," and Saskatchewan's Commissioner says it is "not reasonable for a government institution to rely on an employee's opinion that no records exist when deciding not to search."
• No credit for poor records management. In Saskatchewan, "inadequate records management practices will not be accepted as a reasonable explanation for failure to locate responsive records."
• A written account. Ontario's IPC may ask for it as an affidavit, US courts expect a reasonably detailed one, and the federal, BC, Alberta, Saskatchewan and Australian commissioners all say what it should contain. Part 5 of the checklist sets it out.

Ontario's IPC has flagged some of its guidance, including its reasonable-search fact sheet, as under review following the province's 2026 amendments, so check its site for updates.

Check your search

Work through the five parts for one request and tick each item your search did. Some items won't apply to every request, so leave those unticked: the summary lists them, and a line in the file saying why a location wasn't searched is part of a reasonable search too.

1. The request · 2. The people · 3. Microsoft 365 · 4. Outside Microsoft 365 · 5. The record of the search

1. Scope the request before anyone searches

The UK test starts with "the quality of the public authority's initial analysis of the request," and the federal Treasury Board directive asks for searches that "consider both the letter and the spirit of the request." Most failed searches fail here. In British Columbia's Investigation Report F15-03, the Commissioner found that a ministry had breached its duty to assist in part by reading a request too narrowly.

• Read the request for its letter and its spirit. Where the wording is ambiguous, ask the requester rather than narrowing it yourself, and record what was agreed.
• Fix the date range and the cut-off date, and write both down.
• List the words the records are likely to use: subjects, people's names and initials, project and file names, file numbers, acronyms, and the informal names staff actually use.
• Identify every program area likely to hold records, not only the one the request names.
• Identify the record types in scope: email, chats, channel posts, files, calendars, recordings, text messages, databases, paper.
• Suspend deletion of anything that may be responsive, including transitory records, and ask the Microsoft 365 administrator to preserve accounts that are about to expire.A records schedule, a Teams retention setting, a recording expiry or a departing employee's account can all remove a record while the request is open.

Preservation is where the Microsoft 365 defaults bite. In Canada Border Services Agency (Re), 2025 OIC 12, the request asked for Teams messages, the agency kept Teams messages for 30 days with no backups, and a registration error meant the request wasn't tasked until those days had passed, so the answer was "no records." A later search of corporate repositories found one, and the Information Commissioner found the complaint well founded: the right of access "applies to all records under the control of an institution at the time the request is made regardless of whether they are transitory or of business value." Destroying, altering or concealing a record in order to defeat access is also an offence under the federal Access to Information Act (s. 67.1), Ontario's FIPPA (s. 61(1)(c.1)) and MFIPPA (s. 48(1)(c.1)), British Columbia's FIPPA (s. 65.3), Newfoundland and Labrador's ATIPPA, 2015 (s. 115(2)), and the UK's FOIA (s. 77).

2. Choose the people who search

A search is only as good as the list of people asked to do it. In Privy Council Office (Re), 2025 OIC 61, a request that expressly covered text and Teams messages was not sent to every responsible office; a later search found 142 pages, and the Commissioner issued an order.

• Name every custodian likely to have created, received or kept responsive records, and note why each was chosen.
• Include former staff, and act on their accounts quickly.In Microsoft 365, a deleted user's mailbox is kept for 30 days unless a hold turns it into an inactive mailbox, and their OneDrive for 30 days by default (an administrator can set 30 to 3,650), with the manager given access by default.
• Include the assistants, delegates and co-organizers who manage a custodian's mailbox, calendar or meetings.
• Include records held for you by others, such as contractors, consultants and service providers, where your organization could reasonably expect to get a copy on request.That is the second half of the Supreme Court of Canada's control test in Canada (Information Commissioner) v. Canada (Minister of National Defence), 2011 SCC 25; the UK's FOIA treats information "held by another person on behalf of the authority" as held (s. 3(2)(b)).
• Ask each custodian, in writing, whether they used personal email, text messages or messaging apps for work, and have those searched too.Ontario's IPC: "If staff conduct business with personal email accounts or instant messaging programs, those accounts and programs must be included in your search."
• Give each searcher written instructions: the scope, the date range, the search terms, and the locations to search.

3. Search Microsoft 365, location by location

Microsoft 365 splits one conversation across several stores, and search coverage depends on who runs the search. A custodian searching their own Outlook, OneDrive and Teams sees what they can see. The organization's Microsoft 365 administrator, using Microsoft Purview eDiscovery (which replaced classic Content Search on August 31, 2025), can search mailboxes, OneDrive accounts, SharePoint sites and Teams content across the tenant, including the hidden mailbox folders where Teams chats and Copilot interactions are kept, and messages deleted while a hold applies. A reasonable protocol usually needs both: custodians who know what matters, and an administrator for what custodians can't reach.

Outlook and Exchange

• Every mailbox folder: Inbox, Sent Items, Deleted Items, and each custom folder and subfolder.BC's F15-03: Inbox, Sent Items and custom folders must be searched, and Deleted Items "must be searched."
• The online archive mailbox, including any auto-expanded archive storage.
• Recoverable Items, where there is reason to believe responsive email was deleted.Items a user purges stay 14 days by default (an administrator can set up to 30), calendar items 120 days; a hold stops the purge. F15-03 asks for this search only on "a reasonable belief."
• Calendar items, including meeting invitations, their bodies and attachments, plus notes, tasks (Microsoft To Do tasks are stored in the mailbox) and contacts.
• Voicemail: Teams Cloud Voicemail is delivered to the user's Exchange mailbox.
• Shared mailboxes and Microsoft 365 group mailboxes the program area uses, including Bookings mailboxes.
• Public folders, if your organization still uses them.
• Attachments, and the files linked from messages. A link points to a file in OneDrive or SharePoint, which has to be collected from there.

Teams

• 1:1 and group chats, including meeting chats.Compliance copies are kept in a hidden folder in every participant's mailbox, so each custodian's mailbox must be in scope.
• Standard channel posts, which are kept in the team's group mailbox. Search the team, not only its members.
• Private channels. Search both the team's group mailbox and members' mailboxes.Microsoft began moving private-channel messages from members' mailboxes to the team's group mailbox in late 2025. Messages edited or deleted before the move stay in members' mailboxes; an administrator can check the tenant's status with Get-TenantPrivateChannelMigrationStatus.
• Shared channels. Microsoft's eDiscovery guidance says to search the parent team's mailbox, and to include the shared channel's own SharePoint site for its files.
• Files shared in chats: the sharer's OneDrive, in the Microsoft Teams Chat Files folder.
• Files shared in channels: the team's SharePoint site. Every private and shared channel has a SharePoint site of its own.
• Deleted messages, and earlier versions of edited ones. While a hold applies, they stay discoverable in eDiscovery after they disappear from the Teams app.
• Chats with guests and external users.Guest chats are covered. A participant from another Microsoft 365 organization keeps their copy in their own tenant, and for a meeting chat with guests only the hosting organization's administrators can search it.
• Loop components: a component sent in a chat is a file in the sender's OneDrive; one sent in a channel lives in the channel's SharePoint site.
• Whiteboards, which are created in the OneDrive of the person who starts them.
• Meeting recordings and transcripts.By default, meetings save to the organizer's OneDrive, channel meetings to the channel's SharePoint site, and calls to the OneDrive of whoever pressed Record. Recordings expire after 120 days by default. See Teams meeting recordings as records.

Two Teams gaps belong in the protocol. Microsoft's retention policies for Teams don't keep code snippets, voice memos recorded in the mobile app, or other people's reactions, and Microsoft's eDiscovery documentation says plainly that "not all Teams content is eDiscoverable." Where a request turns on content like that, ask the custodian to look in the app.

SharePoint and OneDrive

• The team and communication sites the program area uses, including the site behind each team and channel.
• Each custodian's OneDrive, including the Recordings and Microsoft Teams Chat Files folders.
• Version history, where an earlier draft may be responsive.eDiscovery can export the latest version, the last 10 or 100, or all versions; versioning limits are ignored for items under retention or a hold.
• Lists and their attachments, and OneNote notebooks stored on sites or in OneDrive.
• Video files stored in SharePoint and OneDrive, which eDiscovery can find by title or by words in the transcript.
• Recycle bins, by hand, where deletion is suspected.Deleted items stay 93 days, but Microsoft says "the Recycle Bin isn't indexed and therefore searches don't find content there."
• Scanned PDFs and images, which keyword searches miss.Microsoft's eDiscovery limits show images attached to messages aren't indexed, and partially indexed items can't be previewed. Review them another way or run text recognition first.

The rest of Microsoft 365

• Copilot prompts and responses, kept in a hidden folder in the user's mailbox and searchable in eDiscovery.
• Viva Engage: user messages in users' mailboxes, community messages in the community's group mailbox, community files in its document library.
• Planner: for plans shared with groups, task attachments are in SharePoint and comments in Exchange. Personal plans and Premium plans aren't supported by Microsoft Purview.
• Microsoft Forms responses, found through the creator's mailbox or the owning group's mailbox. eDiscovery for Forms is in preview and needs premium features.
• Loop workspaces, which live in SharePoint Embedded containers that an administrator may need to add to a search by URL.

4. Search what sits outside Microsoft 365

A tenant-wide search can feel complete and still miss most of the record. The OAIC's minimum factors for a search include current and past file systems, records management systems, destruction practices and the people who can help, and its list of places to search includes "electronic documents saved on computers, tablets, smart phones and Apps."

• Line-of-business systems and databases: case management, permitting, finance, HR, and any system the program area keeps records in.
• Network file shares and legacy document management systems that were never migrated.
• Paper files, including off-site storage, and the records retention and disposition schedules that say what should still exist.
• Text messages on organization-issued phones.The federal Information Commissioner's report in Canada Border Services Agency (Re), 2024 OIC 38, records that text messages have "no automatic or set retention period"; they exist until deleted or until the phone goes back to IT. Saskatchewan's Commissioner asks institutions to explain how mobile devices were searched.
• Personal email accounts and messaging apps used for work, searched by the account holder.In Ontario Order MO-3281, email a councillor sent from a personal account was under the city's control. The UK Information Commissioner says business information in WhatsApp, Signal or private email "is very likely to be held" on the authority's behalf.
• Records held by contractors and service providers under contract.
• Backups, only where there is reason to believe they hold records that exist nowhere else.F15-03 doesn't require backups "under ordinary circumstances." The OAIC doesn't require backups that merely duplicate the main systems, but may where they hold documents not otherwise available. Ontario's IPC: "it may also be necessary to search back-up tapes."

5. Document the search

If an appeal comes, this is the part that gets read. Alberta's Commissioner put the list most plainly, and the federal Information Commissioner's guidance covers the same points:

"In general, evidence as to the adequacy of a search should cover the following points:

• The specific steps taken by the Public Body to identify and locate records responsive to the Applicant's access request
• The scope of the search conducted – for example: physical sites, program areas, specific databases, off-site storage areas, etc.
• The steps taken to identify and locate all possible repositories of records relevant to the access request: keyword searches, records retention and disposition schedules, etc.
• Who did the search
• Why the Public Body believes no more responsive records exist than what has been found or produced"

Office of the Information and Privacy Commissioner of Alberta, Order F2007-029, para. 66

Others add to it. Ontario's IPC asks for "a list of all devices, accounts or other storage sites searched," the "search terms used, dates when the search was conducted and amount of time spent," and whether any areas or file types were "intentionally left out," and why. BC's Commissioner asks for sources not searched with the reasons, and the time spent. The OAIC wants decisions to state the dates, the search parameters, the time taken and whether backups were examined. US courts look for "a reasonably detailed affidavit, setting forth the search terms and the type of search performed" (Oglesby v. U.S. Department of the Army, 920 F.2d 57, 68 (D.C. Cir. 1990)). Where the record is missing, regulators draw the obvious conclusion. When the UK's Department of Health and Social Care refused to give details of its searches on eight requests, the Information Commissioner could "only conclude… that it is likely such searches did not take place in at least some of these requests."

• Who searched, and why they were the right people: their role and what they know about the records.
• Every location searched, by name: each mailbox, archive, team, site, OneDrive, system, device and paper file.
• Every location deliberately not searched, and why.
• The search terms and date range, and how they were chosen.
• The date each search was run, and the time each person spent.
• What each search found, per person and location, including "no records."
• Whether retention and disposition schedules explain records that once existed but no longer do.
• Why you believe no further records exist.
• A signed statement from each searcher that the search was done as instructed, in affidavit form where the regime expects one.
• Where the answer is "no records," tell the requester how and where you searched, as the federal Information Commissioner recommends.

Your search summary

How AccessPoint handles it

AccessPoint runs the search as assigned work with a record behind it, so much of the documentation above is produced by doing the search rather than written up after it.

Capture from Microsoft 365 runs with each custodian's own permissions, so custodians collect what they can already see. Tenant-wide work, like a departed employee's mailbox, messages kept under a hold, or Recoverable Items, stays with your Microsoft 365 administrator in Purview eDiscovery, and what it exports joins the request as uploaded records. Everything runs inside your own Microsoft 365 and Azure tenant.

Last reviewed: September 2026.

Sources

Law, orders and regulator guidance

• Conducting a reasonable search for records — Office of the Information Commissioner of Canada (accessed September 2026).
• Access to Information Act, R.S.C. 1985, c. A-1, ss. 4(2.1) and 67.1 — Justice Laws Canada.
• Directive on Access to Information Requests, 4.2.2–4.2.3 — Treasury Board of Canada Secretariat.
• Canada Border Services Agency (Re), 2025 OIC 12, 2024 OIC 38, and Privy Council Office (Re), 2025 OIC 61 — Office of the Information Commissioner of Canada.
• Canada (Information Commissioner) v. Canada (Minister of National Defence), 2011 SCC 25 — Supreme Court of Canada.
• Order PO-4329 and Order MO-3281 — Information and Privacy Commissioner of Ontario.
• Interpretation Bulletin: Search for Responsive Records (September 2023), Fact Sheet: Reasonable Search (April 2017), and Instant Messaging and Personal Email Accounts (June 2016) — Information and Privacy Commissioner of Ontario.
• Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F.31 and Municipal Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. M.56 — Ontario e-Laws.
• Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165, ss. 6(1) and 65.3 — BC Laws.
• Order 04-27, Investigation Report F15-03, "Access Denied" (October 2015), and Guidance on FIPPA's FOI Process — Office of the Information and Privacy Commissioner for British Columbia.
• Order F2007-029 — Office of the Information and Privacy Commissioner of Alberta; Access to Information Act, s. 12(1) — Alberta King's Printer.
• Guide to FOIP, Chapter 3 (updated May 2023) — Office of the Saskatchewan Information and Privacy Commissioner.
• Access to Information and Protection of Privacy Act, 2015, s. 115 — House of Assembly of Newfoundland and Labrador.
• Freedom of Information Act 2000, sections 1, 3 and 77 — legislation.gov.uk.
• Information you hold for the purposes of FOIA, Official information held in non-corporate communications channels, and Behind the screens (July 2022) — Information Commissioner's Office.
• Freedom of Information Code of Practice, para. 1.12 (July 2018) — Cabinet Office.
• 5 U.S.C. § 552(a)(3) and 44 U.S.C. § 2911 — GovInfo.
• Weisberg v. U.S. Department of Justice, 705 F.2d 1344 (D.C. Cir. 1983) and Oglesby v. U.S. Department of the Army, 920 F.2d 57 (D.C. Cir. 1990) — CourtListener.
• Guide to the Freedom of Information Act: Procedural Requirements — U.S. Department of Justice, Office of Information Policy.
• Freedom of Information Act 1982 (Cth), s. 24A — Federal Register of Legislation; FOI Guidelines, Part 3 — Office of the Australian Information Commissioner.

Microsoft documentation

• Learn about retention for Microsoft Teams, Finding content in Microsoft Teams in eDiscovery, Private channels in Microsoft Teams, and Shared channels in Microsoft Teams — Microsoft Learn (accessed September 2026).
• Teams meeting recording and transcript storage and Manage Teams recording expiration — Microsoft Learn.
• File storage in Microsoft Teams — Microsoft Support; Teams and SharePoint integration — Microsoft Learn.
• Recoverable Items folder in Exchange Online, Learn about archive mailboxes, Learn about inactive mailboxes, and Set up Cloud Voicemail — Microsoft Learn.
• OneDrive retention and deletion, Learn about retention for SharePoint and OneDrive, and Version history limits — Microsoft Learn.
• Microsoft Purview eDiscovery legacy solutions, Data sources in eDiscovery, Export search results, Partially indexed items, and Limits in eDiscovery — Microsoft Learn.
• Search for AI application data in eDiscovery, Overview of Loop storage, Learn about retention for Viva Engage, Microsoft Planner support in Microsoft Purview, Search and review Microsoft Forms data with eDiscovery, Manage data for Microsoft Whiteboard, Video information protection and risk management, and Bookings FAQ — Microsoft Learn; Data storage and compliance in Microsoft To Do — Microsoft Support.

Related reading on this site: Teams meeting recordings as records; the FOI deadline calculator, for how long the search has; the FOI workflow quick check; the documentation for custodian assignments and adding records from Microsoft 365; or book a demo to see a search assigned, captured, attested and approved.