How to run a content search query to find documents over 10 years old

Step by step guide to using Purview to run a query job to return matching items.

Let's say you have a retention policy that files on SharePoint should not be kept for longer than 10 years. That is today minus 10 years based on "Modified date". I.e. targeting files that have not been edited for over 10 years.

You could run a Power Automate flow to get thin information, but you can also get this data from Purview using the content search function.

Go into the "eDiscovery" tab and click on "Content search"

Guide to using Content Search

Let's start by assuming you don't already have a search created, so let's create it by clicking on the "Create a search" button.

You can also see other searches that other users have carried out and their status, so make sure whatever you run here isn't confidential.

Select a suitable name for your search and also a description if necessary. Then click "Create".

From here, we need to select both a) a source of data that we want to search. b) condition that matches our criteria.

For this example, we will click the various items to make sure we pick up only this site collection, and only target files and not emails or people.
Scope items by - Choose all sources in the tenant

Locations to include - Choose site only in this case, and only do mailboxes if you have proper eDiscovery permissions. You will also see mailbox columns in the finishing template, and these can be largely ignored since they will be blank.

Search - Past in the site collection URL and click "Search". Then be sure to tick the returned site

Click "Save and Close"

Adding sources

Since we want documents that haven't been modified for the last 10 years, we write the KQL query like this.
LastModifiedTime<2016-06-22
Click on "Run Query" and then "Run Query" again on the next page.
Finally, we get the results. In this case I have nothing matching, but if you did, you can click "Export" and get the results exported to CSV format.