Retrieving or tracing messages

Hi @VArmstrong
Thank you for posting your question in the Microsoft Q&A forum.

Just to clarify, Teams chat content is stored in the school’s Microsoft 365 cloud—not on the iPad itself. To recover deleted chats, the school must have the appropriate Microsoft 365 compliance settings in place, such as a Retention Policy or Legal Hold for Teams chats. Without these, the actual chat messages may not be recoverable, even if screenshots exist. However, we can still check audit logs to confirm Teams activity during specific times.
To better assistance, could you please confirm:

1. Do you know if the school has a Microsoft retention policy or legal hold for Teams chats during the dates of the screenshots? (This is key.)
2. Can the school provide the login addresses (school emails/UPNs) of the student(s) and the other people in the chat? We need these to search.
3. Does the school allow users to delete their own chat messages in Teams (messaging policy)?

This is the guideline to check retention and retrieve Teams Chats may help to your IT to confirm.
Step 1: Check retention policy or legal hold

1. Sign in to Microsoft 365 Compliance Center (compliance.microsoft.com).
2. Go to Data Lifecycle Management => Retention Policies.
3. Confirm if there is a policy for Teams chats (1:1 and group) that covers the students and the date range in question.
4. If no policy exists, check if a Legal Hold was applied to those accounts.

Step 2: If Retention or Legal Hold Exists

1. In Compliance Center, go to eDiscovery => eDiscovery (Standard or Premium).
2. Create a new case (or open an existing one).
   
3. Create New Search

1. Add Data Source and Filter the Condition then click Run Query

1. Review and export results. To download detail repot include the message, click Export
   

Add name of the report then click Export again,

After completely export. Click export at the tab Export, choose the item you need then click Download, the message in the file Items

The deleted message will mark as "Message deleted"

Step 3: If No Retention or Legal Hold Exists

• Deleted chat content cannot be recovered.
• You can still confirm activity:
  1. Go to Audit => Audit Search in Compliance Center.
  2. Search for Teams activities (e.g., “Sent message in chat”) using the same date range and accounts.
  3. Note: Audit logs show actions, not message text.

Step 4: Prevent Future Issues

• Enable a Teams chat retention policy for all student accounts.
• Consider an archiving solution (Microsoft Purview or third-party) for long-term compliance.

Note: Please understand that our initial response does not always resolve the issue immediately. However, with your help and more detailed information, we can work together to find a solution.        

Your detailed response will help us diagnose and investigate the issue more efficiently. If I misunderstood what you’re looking for, feel free to let me know or share a screenshot. I’d be happy to help further!

Thank you for your cooperation. I'm looking forward for your reply.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.