Monday, September 22, 2014

Exchange Online mailbox search

Office 365 provides the ability in all plans to search across all mailboxes. What I’ll cover here is how to do this with the Small Business Plan as that is the most challenging given that Exchange Online console is not exposed by default. If you have an M or E plan simply follow on from when the Exchange Online console comes into view.

image

The above screen shot shows a user with a single email in their inbox we will search for. In this case we will be searching for the text “Rescuetime”.

image

Login into the Office 365 portal as a tenant administrator.

Here we have logged into a Small Business tenant which provides a simplified interface. To access the Exchange Online console from a Small Business tenant use the URL:

https://outlook.office365.com/ecp/

image

When the Exchange Online console appears select permissions from the left hand side.

By default no user is given the ability to search through all mailboxes, not even global administrators. So the first step in the process is therefore to allow this.

image

Once permissions is selected, select Discovery management to the right as shown above.

image

Now select the pen icon at the top to edit this security group.

image

At the bottom of the dialog that appears, in the Members section, press the + button to add a new member.

image

Select and add the Office 365 users you wish to give these discovery rights to.

Press Save to update the permissions.

image

You may need to log out of the web portal and log back in. You may also need to wait a few minutes until the rights have been updated.

Once you have select compliance management from the menu on the left.

image

Unless you see more than 4 icons at the top of the table you do not have the discovery rights.

image

Only when you do will you see all the icons as shown directly above will you have the rights to search across multiple content.

Press the + key to create a new search.

image

Give the new discovery search a name and description and select next to continue.

image

In most cases you are going to want to search all mailboxes, however it is possible to specify which ones you wish to search.

Press the next button when you have made your selection.

image

Now you can specific the filter criteria for your search. In this case we need to search for the keyword ‘Rescuetime’.

Press the finish button when complete.

image

The search will execute immediately. The time taken will depend on the information your are searching for and how much information it has to search.

Press the close button to continue.

image

You should now see the item just created listed.

image

If you scroll down the dialog on the right you will see a hyperlink Preview search results. Select this.

image

You will now see an Outlook Web Access style interface with all the matches located.

image

With the item selected you can also use the download button to save the results to a PST file for offline review.

You can of course return to this query at any point in the future, edit the query and save it to re-run the search. This makes it very handy if you need to search for things on a regular basis.

In summary, all plans have the ability to search across your users data (in this case email). Some plans also allow you to place searched information on hold so that it is retained even if deleted by the user. You will firstly need to grant the person doing the searching the rights as a member of the Discovery Management group. You then create a query based on your requirements which you can view online or export to a PST file for offline view.

You’ll find more detailed information about these discovery options at:

Office 365 eDiscovery FAQ