Office 365: Make and Export an eDiscovery Search

Case Setup

Sign in to Microsoft Purview and go to Solutions -> eDiscovery

https://purview.microsoft.com/ediscovery/casespage

Click on Create Case, give it a name, and click Create.

Click on Create a search, give it a name and click Create.

On this page you need to add sources and also set your search terms.

Sources

If you are search only some mailboxes, select add sources. Then you can check off on the right side the users whose mailboxes should be included in the search, then click manage or save and close.

If you want to search all mailboxes, select Add tenant-wide sources, and click save.

Search Terms

If you just want to search using search terms, you can type them into the box.

If you want to use KeyQL, click Add Conditions, then check KeyQL and click apply. Then you can put your KeyQL query into the box.

(Participants:john@smith.com OR Participants:jane@brown.com) AND Date>=2024-01-01 AND Date<=2024-12-31

Search

Once the source and search terms are in, click on Run Query at the top. Then in the slide out panel on the right, click Run Query. At this point, you have to wait for it to perform the search, which will take time.

Export

You can also click on the Export button in the top right. Enter an export name, select either PST or MSG format for messages, and click export. This will take a few minutes to complete. In the top left of the window, there is an Export tab. Over here, you can see the status of the export, and when it is ready, you can download it.