Office 365 Content Search Guide for Microsoft Purview eDiscovery

Use this Office 365 Content Search guide to find email, files, Teams messages, and other supported Microsoft 365 content with Microsoft Purview eDiscovery. Microsoft retired the classic Content Search experience in August 2025; current Content Searches are created and managed in the eDiscovery experience in the Microsoft Purview portal. The workflow below covers permissions, search scope, query criteria, result validation, and export.

If you are using Content Search while preparing or validating mailbox data for a tenant move, review the EdbMails Office 365 migration tool for the EdbMails migration workflow.

What is Content Search in Office 365?

Content Search is part of Microsoft Purview eDiscovery. It lets authorized users search supported Microsoft 365 data sources, including Exchange Online, SharePoint, OneDrive, Teams, Microsoft 365 Groups, and other supported locations. A search can use keywords, conditions, and property-based queries to narrow the results before they are previewed or exported.

1. Prerequisites Before Performing a Content Search

   Permissions for Content Search

   Assign only the eDiscovery permissions required for the task. Microsoft's built-in eDiscovery Manager role group supports search-related work and includes roles used to search, preview, and export results. If your organization uses custom role groups, ensure the user has the specific Search/Compliance Search, Preview, and Export permissions needed for the actions they will perform. Do not assign eDiscovery Administrator solely to run a routine search; that role has broader access across cases.

   Licensing

   Content Search and eDiscovery capabilities vary by Microsoft 365 subscription and by the features used in a case. Verify the current Microsoft Purview service description before relying on advanced review, analytics, or premium eDiscovery features. Keep licensing guidance linked to Microsoft rather than hard-coding plan assumptions that may change.

2. Steps to perform an Office 365 Content Search in Microsoft Purview

   Step 1 - Open Microsoft Purview eDiscovery

   Sign in to the Microsoft Purview portal with an account that has the required eDiscovery permissions. Open eDiscovery. For a standalone Content Search, use the Content Search case; use a dedicated eDiscovery case when the search belongs to a broader investigation.

   Step 2 - Create a search

   Open the Content Search case, select the Searches area, and create a new search. Give the search a unique, descriptive name and add a description when it will help other investigators understand its purpose.

   Step 3 - Define the search scope

   Select the users, groups, sites, or other supported Microsoft 365 data sources that the search should cover. Keep the scope as narrow as the investigation allows so the results are easier to validate and export.

   Step 4 - Build the query

   Use the condition builder for common criteria such as keywords, dates, senders, recipients, and other supported properties. Use Keyword Query Language when you need more precise property-based or Boolean queries. Review the scope and query before running it.

   Step 5 - Run and validate the search

   Run the query, then review the available statistics and sample/preview results. If the search is too broad or misses expected content, refine the locations, conditions, or query and run it again before exporting.

   Step 6 - Export the results when required

   Open the completed search and select Export. Configure the export options that match the investigation, start the export, and monitor it in the eDiscovery process experience. Download the package before it expires; Microsoft currently documents a 14-day expiry for search export packages.

3. Content Search Results: Filters, Preview, and Export

   Search Conditions and Filters

   Use supported query criteria to narrow the search, such as keywords, sender or recipient, subject, date, file type, and location where supported. Available conditions can vary by workload and the current Microsoft Purview experience, so review the options shown for the selected data sources.

   Search filter	Description
   Keywords	Search for specific words, phrases, or expressions within emails, documents, chat messages, and other indexed content. Keywords can be combined with search operators for more precise results.
   Sender	Find email messages sent by a particular user or mailbox. This filter is useful when investigating communications from a specific individual.
   Recipient	Search for messages sent to one or more recipients. You can specify individual users, distribution groups, or shared mailboxes, depending on the search scope.
   Subject	Locate emails that contain specific words or phrases in the subject line. This is helpful when searching for messages related to a known topic or project.
   Date range	Restrict the search to content created, received, or modified within a specified time period. Limiting the date range can significantly reduce the number of search results.
   File type	Search for specific document formats such as PDF, DOCX, XLSX, PPTX, TXT, or other supported file types stored in SharePoint Online or OneDrive for Business.
   Site location	Limit the search to selected SharePoint Online sites, OneDrive accounts, or specific document libraries instead of searching the entire tenant.
   Message type	Filter results based on the type of content, such as email messages, Teams chats, channel conversations, documents, or other supported Microsoft 365 data sources.

   Using Search Operators

   For more precise searches, use Keyword Query Language with supported property-based and Boolean operators. Keep the query focused and validate the results before export rather than building an unnecessarily broad expression.

   How to Preview Search Results

   Review the available statistics and sample/preview results to confirm that the search is returning the intended content. If results are too broad or expected items are missing, refine the selected data sources, conditions, or query and run the search again. Preview actions require the appropriate Microsoft Purview eDiscovery permissions.

   Export Content Search results

   After validating the search, open the completed search and select Export. Configure the export options that match the investigation, start the export, and monitor it in the eDiscovery process experience. Download the export package before it expires; Microsoft currently documents a 14-day expiry for search export packages.

   Security Considerations for Exported Data

   Exported Content Search results may contain confidential, regulated, or personally identifiable information. Store exported data in secure, access-controlled locations, restrict access to authorized personnel, protect files during storage and transfer, and remove exported data when it is no longer required under your organization's retention policies.

Best practices

• Assign only the permissions required for the administrator's search, preview, and export tasks.
• Use meaningful search names and descriptions so searches can be identified during later review.
• Limit the search to the users, groups, sites, or other data sources required for the investigation.
• Use focused keywords, dates, senders, recipients, and other supported criteria to reduce unnecessary results.
• Review statistics and sample/preview results before exporting.
• Store exported results securely and restrict access to authorized personnel.
• Review Microsoft Purview role assignments periodically and verify licensing before relying on advanced eDiscovery features.

For the complete migration sequence, use the Office 365 migration guide to plan source connection, mailbox mapping, migration, and verification. Before starting a production migration, review the Office 365 migration checklist to confirm tenant access, mailbox readiness, and other preparation items.

Conclusion

Microsoft Purview eDiscovery Content Search gives authorized administrators a focused way to locate, validate, and export supported Microsoft 365 content. Use least-privilege permissions, keep the search scope and query specific to the task, review the results before export, and protect exported data according to your organization's policies.

Frequently Asked Questions