Stellark Home ยป Execute eDiscovery & Search from EOL in Office 365

Execute eDiscovery & Search from EOL in Office 365

After you have set up and configured your Compliance Management Policy with in-place eDiscovery you will then be able to execute an eDiscovery search from EAC in Office 365.

Upon completion of the search you can export the results to a .pst file or open the search results from the Discovery Mailbox directly for viewing.

Log into Office 365 and access the Exchange Admin Center

You will have the following selections to choose from:

  • Estimate search results   This option returns an estimate of the total size and number of items that will be returned by the search based on the criteria you specified.  It prepares the data for Search.
  • Preview search results   This option provides a preview of the results. Messages returned from each mailbox searched are displayed.
  • Copy search results   This option lets you copy messages to a discovery mailbox that you can use to execute your search from.

clip_image001

  • Export search results   After search results are copied to a discovery mailbox, you can export them to a PST file.

clip_image002

Select the policy you previously created and choose Copy Search Results

In the new window that opens choose the criteria you wish to search and browse/select the Discovery Mailbox you wish to copy these items to for viewing. Once all selected click Copy.

clip_image003

Should you wish to create NEW Discovery Mailboxes so that they can be monitored and locked down to secure access use the following PowerShell command

  • Create New Discovery Mailbox

New-Mailbox -Name MyDiscoveryMailbox -Discovery

  • Assign permissions to the mailbox

Add-MailboxPermission <Name of the discovery mailbox> -User <Name of user or group> -AccessRights FullAccess -InheritanceType all

By default, members of the Discovery Management role group only have Full Access permission to the default Discovery Search Mailbox.

When the Copy is completed Open the Discovery Search mailbox to view contents

If you do not see the [open] option then click the refresh button while the policy is also selected

clip_image004

Choose Language and Time Zone when prompted.

Outlook Web App will open the Discovery Search Mailbox where you will see the name of your Compliance Management Policy in an expandable Tree View. Once expanded you will see the option to display the Results of the search.

clip_image005

The results displayed will be based upon the Criteria you chose to configure in your policy. If you chose to search Everything then Everything is what will be displayed. Minus duplicates if you selected that as your copy criteria. If you wish for a more granular search then edit your Compliance Management policy to filter based on criteria.

You will then be able to quickly view Statistics on Keywords you have configured.

clip_image006

Select to Copy Search results as per above to display results for Keyword search.

Export Items to .pst File

clip_image007

Browse to a location to Save file

clip_image008

clip_image009

Enter your credentials for Office 365 who is a member of the Discovery Management group in order to retrieve the online DisoverySearchMailbox contents.  Open the .pst in outlook as you normally would any other .pst file.

4 responses to “Execute eDiscovery & Search from EOL in Office 365”

  1. Good article. It includes everything except how to actualy execute the search!

    How do you execute a search for the first time, and then subsequent times? Or is estimate results the same?

  2. Thanks for the feedback!
    First you would Estimate each mailbox you wish to conduct searched against. Then you “could” Preview the Estimated search results. Finally you would Copy the search results and select search criteria to look for. The returned results will appear in the Default Discovery Mailbox unless you have created your own unique one. Once that step is done the main page will appear. I usually select the circular arrow refresh icon to see the Status “search in progress” and once that is completed you will see {open} beneath the Discovery Mailbox you just searched. This will open the Discovery Search Mailbox in Outlook online where you can view your results. Hope that helps.

  3. Really Good Article. I especially found the Create Compliance Management Policy in Exchange Online article especially useful.

    I was wondering if you have any other guides (or templates) on actually setting up and designing a Compliance system in line with company policies
    Much Obliged

    1. I would imagine you could use the “Create Compliance Management Policy in Exchange Online” but tailor it to your companies specific needs and requirements. If this is not what you are looking for could you be more specific? Thanks

Comments are closed.