Office 365 provides the ability in all plans to search across all mailboxes. What I’ll cover here is how to do this with the Small Business Plan as that is the most challenging given that Exchange Online console is not exposed by default. If you have an M or E plan simply follow on from when the Exchange Online console comes into view.
The above screen shot shows a user with a single email in their inbox we will search for. In this case we will be searching for the text “Rescuetime”.
Login into the Office 365 portal as a tenant administrator.
Here we have logged into a Small Business tenant which provides a simplified interface. To access the Exchange Online console from a Small Business tenant use the URL:
https://outlook.office365.com/ecp/
When the Exchange Online console appears select permissions from the left hand side.
By default no user is given the ability to search through all mailboxes, not even global administrators. So the first step in the process is therefore to allow this.
Once permissions is selected, select Discovery management to the right as shown above.
Now select the pen icon at the top to edit this security group.
At the bottom of the dialog that appears, in the Members section, press the + button to add a new member.
Select and add the Office 365 users you wish to give these discovery rights to.
Press Save to update the permissions.
You may need to log out of the web portal and log back in. You may also need to wait a few minutes until the rights have been updated.
Once you have select compliance management from the menu on the left.
Unless you see more than 4 icons at the top of the table you do not have the discovery rights.
Only when you do will you see all the icons as shown directly above will you have the rights to search across multiple content.
Press the + key to create a new search.
Give the new discovery search a name and description and select next to continue.
In most cases you are going to want to search all mailboxes, however it is possible to specify which ones you wish to search.
Press the next button when you have made your selection.
Now you can specific the filter criteria for your search. In this case we need to search for the keyword ‘Rescuetime’.
Press the finish button when complete.
The search will execute immediately. The time taken will depend on the information your are searching for and how much information it has to search.
Press the close button to continue.
You should now see the item just created listed.
If you scroll down the dialog on the right you will see a hyperlink Preview search results. Select this.
You will now see an Outlook Web Access style interface with all the matches located.
With the item selected you can also use the download button to save the results to a PST file for offline review.
You can of course return to this query at any point in the future, edit the query and save it to re-run the search. This makes it very handy if you need to search for things on a regular basis.
In summary, all plans have the ability to search across your users data (in this case email). Some plans also allow you to place searched information on hold so that it is retained even if deleted by the user. You will firstly need to grant the person doing the searching the rights as a member of the Discovery Management group. You then create a query based on your requirements which you can view online or export to a PST file for offline view.
You’ll find more detailed information about these discovery options at:
CIAOPS 