IIRC, you have to do something called a "compliance export," which just like any other compliance feature (SSO, HIPAA BAA, audit logs, etc.) usually requires the highest plan. It's designed to add some extra friction so admins can't just add themselves to a DM from the main UI like they could with a channel, but it is possible.