Purview eDiscovery KeyQL — does adjacent )(Participants=...) without a space act as OR?

Question

Purview eDiscovery KeyQL — does adjacent )(Participants=...) without a space act as OR?

Dan Kwik 0

I'm building Purview eDiscovery searches and ran into something the docs don't seem to cover.

The documentation page at learn.microsoft.com/en-us/purview/edisc-search-query says a space between two property:value expressions is treated as OR. That part is clear.

What I can't figure out is whether the OR still applies when there's no space between two parenthesized predicates. So for example:

with space: (Participants=a@example.com) (Participants=b@example.com)

no space: (Participants=a@example.com)(Participants=b@example.com)

Do both forms parse the same way? Or does the missing space mean the second form isn't treated as OR?

I tried looking at the SharePoint Search KQL reference too but that's a different product (whitespace means AND there, not OR) so I'm not sure those rules apply.

If anyone knows the actual parser behavior, or can point me to docs I missed, that would be great. Also curious what the recommended way to write "any of N participants" is in Purview — repeating the property with spaces, explicit OR between predicates, or something else?

Thanks.

Dan Kwik 0 Reputation points

2026-06-01T19:43:09.73+00:00

One follow-up on this — for documentation purposes I'd like to confirm this definitively. Has the no-space adjacency behavior been tested in the current Purview eDiscovery KeyQL parser, or is this inferred from the documentation? And is there a Microsoft engineer or product-team source that confirms the no-space form (Participants=a)(Participants=b) is not treated as OR? I want to make sure I'm relying on confirmed parser behavior rather than the documentation gap. Thanks.

2 answers

Your answer

Dan Kwik 0 Reputation points

2026-06-01T19:43:09.73+00:00

One follow-up on this — for documentation purposes I'd like to confirm this definitively. Has the no-space adjacency behavior been tested in the current Purview eDiscovery KeyQL parser, or is this inferred from the documentation? And is there a Microsoft engineer or product-team source that confirms the no-space form (Participants=a)(Participants=b) is not treated as OR? I want to make sure I'm relying on confirmed parser behavior rather than the documentation gap. Thanks.

Answer 1

Pilladi Padma Sai Manisha 9,945 Microsoft External Staff Moderator

Hi MB,
Thankyou for reaching microsoft Q&A!
it turns out KeyQL in Purview eDiscovery really does rely on whitespace (or an explicit OR) to split clauses. If you run

(Participants=a@example.com)(Participants=b@example.com)

with no space between the two parenthesized predicates, the parser won’t treat it as “OR” – you’ll either get a syntax warning or only the first predicate will be picked up.

The supported ways to express “any of these N participants” are:

• Using whitespace (implicit OR)

(Participants=a@example.com) (Participants=b@example.com)

• Using the OR operator

Participants=a@example.com OR Participants=b@example.com

• Grouping values under one property

Participants:(a@example.com b@example.com)

I generally recommend the third form (Participants:(…)) since it’s compact and clearly signals “match any of these values.”

Let me know if you see a specific error in the KeyQL editor when you try the no-space version, or if you need any other examples!

Reference List

Use Keyword Query Language to create search queries in eDiscovery – https://learn.microsoft.com/purview/edisc-keyword-query-language
Search queries in eDiscovery (Properties & Boolean logic) – https://learn.microsoft.com/purview/edisc-search-query

Pilladi Padma Sai Manisha 9,945 Reputation points Microsoft External Staff Moderator

2026-06-01T01:51:02.1266667+00:00

Hi MB,
Following up to see if the below answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Dan Kwik 0 Reputation points

2026-06-02T00:32:11.53+00:00

One follow-up on this — for documentation purposes I'd like to confirm this definitively. Has the no-space adjacency behavior been tested in the current Purview eDiscovery KeyQL parser, or is this inferred from the documentation? And is there a Microsoft engineer or product-team source that confirms the no-space form (Participants=a)(Participants=b) is not treated as OR? I want to make sure I'm relying on confirmed parser behavior rather than the documentation gap. Thanks.
Pilladi Padma Sai Manisha 9,945 Reputation points Microsoft External Staff Moderator

2026-06-04T13:39:16.1433333+00:00
Hi @Dan Kwik
Thank you for the follow-up question.

From the documentation currently available, I have not found a Microsoft source that explicitly describes how the KeyQL parser handles adjacent parenthesized predicates without whitespace, such as:

(Participants=a@example.com)(Participants=b@example.com)

The official documentation explains the use of property restrictions, Boolean operators, and whitespace-separated query terms, but it does not specifically document the parser behavior for the no-space adjacency case.

Because of that, I would avoid relying on the no-space form in production searches. Instead, I recommend using one of the documented and supported patterns below:

Explicit OR:

Participants=a@example.com OR Participants=b@example.com

Separate clauses:

(Participants=a@example.com) (Participants=b@example.com)

Grouped values:

Participants:(a@example.com b@example.com)

These formats are clearer, easier to maintain, and align with the examples provided in the Microsoft documentation.

If your goal is to document the exact parser behavior of the no-space syntax, the most reliable approach would be to validate it directly in your Purview tenant or open a Microsoft support case for confirmation from the product team, as I have not located an official engineering statement that confirms how this specific syntax is interpreted.

References:

Use Keyword Query Language (KQL) in eDiscovery: https://learn.microsoft.com/purview/edisc-keyword-query-language

Search queries in Microsoft Purview eDiscovery: https://learn.microsoft.com/purview/ediscovery-search-for-content

I hope this helps. Please let us know if you'd like assistance testing specific query patterns.
Dan Kwik 0 Reputation points

2026-06-04T16:08:41.9233333+00:00

Is there a way to involve a Microsoft engineer in this thread to obtain a definitive and authoritative response from a Microsoft programmer?

I’m trying to understand whether the search parameters provided by an agency were suitable for the syntax required to perform a valid search. Alternatively, I’m wondering if there was an error in the boolean logic used, resulting in an inadequate search that failed to yield any results.

Specifically, I’m seeking an official Microsoft stance on the following syntax:

(Participants=a@example.com)(Participants=b@example.com)

Would this syntax imply an implicit OR between the search terms, or would it interpret it as AND or something else?
Dan Kwik 0 Reputation points

2026-06-09T06:21:31.4966667+00:00

Pilladi Padma Sai Manisha, thank you so much for your help thus far.

Do you know of a way to loop in a Microsoft Engineer into this thread? Or another means to get an official response?
Pilladi Padma Sai Manisha 9,945 Reputation points Microsoft External Staff Moderator

2026-06-10T04:11:31.56+00:00

Hi @Dan Kwik
As we are from microsoft support,please let us know here if you have any queries regarding we will try to address your concern.

Answer 2

KeyQL in Purview eDiscovery treats Boolean logic based on explicit operators and the documented handling of spaces, not on adjacency of parentheses.

From the eDiscovery search tips and KeyQL guidance:

A space between two keywords or two property:value expressions is equivalent to using OR in eDiscovery search queries.
Boolean operators AND, OR, NOT, and NEAR must be uppercase and are used in the KeyQL condition field.

However, the documentation does not define any special semantics for two parenthesized expressions written back‑to‑back with no space, such as:

(Participants=[a@example.com]) (Participants=[b@example.com]) → documented as OR because of the space between expressions.
(Participants=[a@example.com])(Participants=[b@example.com]) → no documented rule that this adjacency is treated as OR, and no behavior is described for this pattern.

Only the space case is explicitly defined as OR; there is no statement that adjacency without whitespace is supported or equivalent. Therefore, only the space‑separated form is documented as valid for “any of N participants” when not using explicit OR.

For a documented and predictable way to express “any of N participants” in Purview eDiscovery KeyQL:

Use explicit OR between conditions, for example:
- Participants=[a@example.com] OR Participants=[b@example.com]
Or rely on the documented space‑as‑OR behavior between conditions, for example:
- Participants=[a@example.com] Participants=[b@example.com]

The condition builder documentation also states that multiple values added to a single condition are connected by OR, which is another supported pattern for “any of N values” when using the condition builder UI.

References:

Share via

Purview eDiscovery KeyQL — does adjacent )(Participants=...) without a space act as OR?

2 answers

Your answer