Create a Content Search

A Content Search in Microsoft 365 can be used to recover content from Exchange mailboxes, to a SharePoint site, or pinpoint an email conversation between two parties for an investigate. 
In the example I'll demonstrate later, we will recover an inactive mailbox as an exported *.pst file. An example could be restoring a predecessor’s email for their successor when there aren't any licenses to allocate. 

Note: To create and manage Content Searches, you will require the eDiscovery Administrator role before proceeding.

Following the steps below to ensure you have the required access: 

  1. Office 365 Security & Compliance > Permissions 
  2. Select 'eDiscovery Manager' > [Edit role group] 
  3. Select [Choose eDiscovery Manager] > edit > add account and [Save] 

 To create a Content Search:

  1. Access the Content Search portal though Internet Explorer in InPrivate mode:

https://protection.office.com/contentsearch 

  1. Navigate to Search > Content search
  2. Select the [+] New button to define a new search 
  3. In the 'New search' dialog, enter the following (The following will demonstrate a search for a mailbox)
    1. Name: Give the search a meaningful name 
    2. Where do you want us to look? : Select mail or everywhere , Search all mailboxes or Choose specific mailboxes, ie: 'Custom location selection' and leave 'Search all sites' > [+] to add a mailbox 
    3. Search, select a name and [add] > [OK] 
    4. Select 'Search all sites' and 'Don't search any public folders' > [Next] 
  1. Under 'Conditions', select [+ Add condition] to narrow down recipient, define additional conditions > [Search] 
  2. Allow the search to complete, you can do the following 
    • Export results to a computer: Exports the results as a *.pst file and imported into Outlook. You'll need to go back to this option and select 'Download exported results '. Follow the prompts to download the *.pst, pasting the key and download path 
    • Export report to a computer : This will allow you to export the results as a *.csv file, You'll need to then select 'Download report ' to retrieve the report 

You can then import the *.pst file in Outlook, saving the export where the use can access it locally. 
 
Microsoft recommends to choose 'Import items into the current folder' for an imported mailbox that you are importing that is not yours; this will create a separate view for the imported mailbox.