After you have set up and configured your Compliance Management Policy with in-place eDiscovery you will then be able to execute an eDiscovery search from EAC in Office 365.
Upon completion of the search you can export the results to a .pst file or open the search results from the Discovery Mailbox directly for viewing.
Log into Office 365 and access the Exchange Admin Center
You will have the following selections to choose from:
- Estimate search results This option returns an estimate of the total size and number of items that will be returned by the search based on the criteria you specified. It prepares the data for Search.
- Preview search results This option provides a preview of the results. Messages returned from each mailbox searched are displayed.
- Copy search results This option lets you copy messages to a discovery mailbox that you can use to execute your search from.
- Export search results After search results are copied to a discovery mailbox, you can export them to a PST file.
Select the policy you previously created and choose Copy Search Results
In the new window that opens choose the criteria you wish to search and browse/select the Discovery Mailbox you wish to copy these items to for viewing. Once all selected click Copy.
Should you wish to create NEW Discovery Mailboxes so that they can be monitored and locked down to secure access use the following PowerShell command
- Create New Discovery Mailbox
New-Mailbox -Name MyDiscoveryMailbox -Discovery
- Assign permissions to the mailbox
Add-MailboxPermission <Name of the discovery mailbox> -User <Name of user or group> -AccessRights FullAccess -InheritanceType all
By default, members of the Discovery Management role group only have Full Access permission to the default Discovery Search Mailbox.
When the Copy is completed Open the Discovery Search mailbox to view contents
If you do not see the [open] option then click the refresh button while the policy is also selected
Choose Language and Time Zone when prompted.
Outlook Web App will open the Discovery Search Mailbox where you will see the name of your Compliance Management Policy in an expandable Tree View. Once expanded you will see the option to display the Results of the search.
The results displayed will be based upon the Criteria you chose to configure in your policy. If you chose to search Everything then Everything is what will be displayed. Minus duplicates if you selected that as your copy criteria. If you wish for a more granular search then edit your Compliance Management policy to filter based on criteria.
You will then be able to quickly view Statistics on Keywords you have configured.
Select to Copy Search results as per above to display results for Keyword search.
Export Items to .pst File
Browse to a location to Save file
Enter your credentials for Office 365 who is a member of the Discovery Management group in order to retrieve the online DisoverySearchMailbox contents. Open the .pst in outlook as you normally would any other .pst file.