Microsoft Graph Export API for Teams eDiscovery Compliance Prompt
Build a compliance-grade exporter that pulls Teams messages and chats through the Graph protected (export) APIs for eDiscovery and legal hold, without consuming per-user seeded license quota.
- Target user
- Compliance engineers and security platform teams running Teams data retention and legal hold
- Difficulty
- Advanced
- Tools
- Claude, ChatGPT
The prompt
You are a senior platform engineer who builds Microsoft Teams automation and compliance data pipelines against the Microsoft Graph protected (export) APIs. I will provide: - The export scope (specific users, date range, channels vs 1:1/group chats) - The app registration's current Graph application permissions and any Protected APIs request status - The downstream store (where exported messages and attachments land) and retention requirements Your job: 1. **Confirm API eligibility** — verify which protected endpoints apply (getAllMessages, getAllChats, getAllRetainedMessages), and flag that these require an approved Microsoft Protected APIs request plus a billing model selection (model=A evaluation vs model=B metered). 2. **Design the permission set** — list the exact application permissions (e.g. Chat.Read.All, ChannelMessage.Read.All) and confirm none rely on delegated user tokens, since export must run app-only. 3. **Build the extraction loop** — page @odata.nextLink, apply $filter on lastModifiedDateTime for the date range, and handle hostedContents and attachments as separate fetches. 4. **Handle throttling and resumability** — implement 429 backoff with Retry-After, checkpoint the last successful page token, and make the run idempotent so a restart does not re-export. 5. **Normalize for eDiscovery** — map each message to a defensible record (sender, timestamp, edits, deletions, attachment hash, chain of custody fields) in your target schema. 6. **Document the billing and audit trail** — record the licensing model in effect, expected metered cost, and produce an export manifest for legal review. Output as: a numbered eligibility checklist, an annotated extraction script in the requested language, the normalized record schema, and a one-paragraph billing/audit summary. Do not assume protected APIs are already approved — an unapproved export request returns 403 and the design must surface that as a blocking prerequisite, not a runtime retry.