Exchange Online mailbox search

Office 365 provides the ability in all plans to search across all mailboxes. What I’ll cover here is how to do this with the Small Business Plan as that is the most challenging given that Exchange Online console is not exposed by default. If you have an M or E plan simply follow on from when the Exchange Online console comes into view.

The above screen shot shows a user with a single email in their inbox we will search for. In this case we will be searching for the text “Rescuetime”.

Here we have logged into a Small Business tenant which provides a simplified interface. To access the Exchange Online console from a Small Business tenant use the URL:

https://outlook.office365.com/ecp/

When the Exchange Online console appears select permissions from the left hand side.

By default no user is given the ability to search through all mailboxes, not even global administrators. So the first step in the process is therefore to allow this.

Once permissions is selected, select Discovery management to the right as shown above.

Now select the pen icon at the top to edit this security group.

At the bottom of the dialog that appears, in the Members section, press the + button to add a new member.

Select and add the Office 365 users you wish to give these discovery rights to.

Press Save to update the permissions.

You may need to log out of the web portal and log back in. You may also need to wait a few minutes until the rights have been updated.

Once you have select compliance management from the menu on the left.

Unless you see more than 4 icons at the top of the table you do not have the discovery rights.

Only when you do will you see all the icons as shown directly above will you have the rights to search across multiple content.

Press the + key to create a new search.

Give the new discovery search a name and description and select next to continue.

In most cases you are going to want to search all mailboxes, however it is possible to specify which ones you wish to search.

Press the next button when you have made your selection.

Now you can specific the filter criteria for your search. In this case we need to search for the keyword ‘Rescuetime’.

Press the finish button when complete.

The search will execute immediately. The time taken will depend on the information your are searching for and how much information it has to search.

Press the close button to continue.

You should now see the item just created listed.

If you scroll down the dialog on the right you will see a hyperlink Preview search results. Select this.

You will now see an Outlook Web Access style interface with all the matches located.

With the item selected you can also use the download button to save the results to a PST file for offline review.

You can of course return to this query at any point in the future, edit the query and save it to re-run the search. This makes it very handy if you need to search for things on a regular basis.

In summary, all plans have the ability to search across your users data (in this case email). Some plans also allow you to place searched information on hold so that it is retained even if deleted by the user. You will firstly need to grant the person doing the searching the rights as a member of the Discovery Management group. You then create a query based on your requirements which you can view online or export to a PST file for offline view.

You’ll find more detailed information about these discovery options at:

Office 365 eDiscovery FAQ

Enable litigation hold for all Exchange Online mailboxes using PowerShell

If your Office 365 plan includes the option for litigation hold then it is generally best to turn it on for all mailboxes from day 1. The quickest and easiest method of doing that is via PowerShell.

Here’s the one line command you need to achieve that:

get-mailbox | set –litigationholdenabled $true

Of course, it won’t automatically enable any future mailboxes your create but all you need to do is run the same command again.

Adding multiple mailbox to a SharePoint eDiscovery centre

One of the great ‘enterprise’ features you receive with the higher end Office 365 plans is eDiscovery. This basically allows you to trawl through all the information you have in Office 365 looking for matches to your query.

One of the options available is to create an eDiscovery centre in SharePoint Online which I covered in a previous blog post here:

SharePoint Online eDiscovery

It is important not to overlook the fact that the SharePoint Online eDiscovery centre can be used across SharePoint Online and Exchange Online.

So if you create a new eDiscovery Set, you then need to define the Sources that the set will work across (i.e. search through). You do this by selecting the Add & Manage Sources hyperlink.

You’ll then see this take you to a dialog where you can select the individual mailboxes you wish to search along with any SharePoint locations.

But what happens if you want to search across multiple mailboxes? Do you have to enter them in individually?

In this case, because there are already email distribution groups established we can use these to select a group of users.

Here there is an existing email distribution group called Sales Team.

If you therefore enter the distribution email group into a mailbox location and select the Check Name icon to the right, you should see a green tick appear to the left indicating that it is valid.

When you save this source you should then see that all the mailboxes of the email distribution group have been added as Sources for eDiscovery.

Thus, if you want to include every email inbox simply create or use an email distribution group in Office 365 that includes all mailboxes.

Working with Exchange Online Shared mailboxes in OWA

On of the big advantages that Office 365 provides is the ability to create as many ‘shared mailboxes’ as you like. Typically these ‘shared mailboxes’ are used for common function like info@, sales@, support@ etc.

You can’t open a ‘shared mailbox’ directly, however a user with an Exchange Online license can open it via Outlook either on the desktop or via Outlook Web Access (OWA).

Firstly, navigate to a users Outlook Web Access by logging into the Office 365 portal.

In the top right corner select the users name (in this case Alex Darrow) and from the menu that appears select Open another mailbox…

Enter the email address of the mailbox to be opened (in this case (info@ciaops365d10.onmicrosoft.com). You of course need the rights to open the mailbox before hand.

This will then open that mailbox in a new browser tab as shown above.

This is all well and good if you only need to work with the ‘shared mailbox’ occasionally. What happens if you want to interact it with a lot directly from your browser?

In that case, return to Outlook Web Access and right mouse click on the name of the mailbox, which is directly above Inbox (here Alex Darrow). From the menu that appears select add shared folder…

As before, enter the email address of the shared mailbox and press OK when complete.

In a matter of moments that shared mailbox will appear below all the other folders of the primary user mailbox. Now, provided you have the rights to can also drag and drop email into or out this mailbox to your primary mailbox.

To remove this shared mailbox from you OWA, simply right mouse click on it and select removed shared folder.

So, working with ‘shared mailboxes’ is just as quick and easy as using Outlook on the desktop in Office 365.