Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Caution
Microsoft retired all classic eDiscovery experiences on August 31, 2025. This retirement includes classic Content Search, classic eDiscovery (Standard), and classic eDiscovery (Premium).
The guidance in this article only applies to organizations hosted in Microsoft 365 operated by 21Vianet (China). If your organization isn't hosted by 21Vianet, use the guidance for the new eDiscovery experience in the Microsoft Purview portal.
Use the Content search tool in the Microsoft Purview portal to quickly find email in Exchange mailboxes, documents in SharePoint sites and OneDrive locations, and instant messaging conversations in Skype for Business. You can use the content search tool to search for email, documents, and instant messaging conversations in collaboration tools such as Microsoft Teams and Microsoft 365 Groups.
Search for content
The first step is to starting using the Content search tool to choose content locations to search and configure a keyword query to search for specific items. Or, you can just leave the query blank and return all items in the target locations.
- Create and run a Content search.
- Build search queries and use conditions to narrow your search.
- Feature reference for Content search.
- Configure search permissions filtering so that an eDiscovery manager can only search subset of mailboxes or sites in your organization.
- Search cloud-based mailboxes for on-premises users in Microsoft 365.
- View keyword statistics for the results of a search and then refine the query if necessary.
- Search for third-party data that your organization has imported to Microsoft 365.
- Preserve Bcc recipients so you can search for them.
- Search for Microsoft 365 Copilot and Microsoft 365 Copilot Chat data (user prompts and Copilot responses) stored in custodian mailboxes.
Perform actions on content you find
After you run a search and refine it as necessary, the next step is to do something with the results returned by the search. You can export and download the results to your local computer or in the case of an email attack on your organization, you can delete the results of a search from user mailboxes.
- Export the results of a content search and download them to your local computer..
- Search for and delete email messages, such as messages that content a virus, dangerous attachments, or phishing messages.
Learn more about content search
Content search is easy to use, but it's also a powerful tool. Behind-the-scenes, there's a lot going on. The more you know about it and understand its behavior and its limitations, the more successful you'll be using it for your organization's search and investigation needs.
- Estimated and actual search results and the reasons why there might be differences between them when you export and download search results.
- Partially indexed items in Exchange and SharePoint and how to include or exclude them when you export and download search results.
- Investigate partially indexed items and determine your organization's exposure to them.
Use scripts for advanced scenarios
Sometimes you have to perform more advanced, complex, and repetitive content search tasks. In these cases, it's easier and faster to use commands in Security & Compliance PowerShell.
To help make this easier, we've created several Security & Compliance PowerShell scripts to help you complete complex content search-related tasks.
- Search specific mailbox and site folders (called a targeted collection) when you're confident that items responsive to a case are located in that folder.
- Search the mailbox and OneDrive location for a list of users.
- Create, report on, and delete multiple searches to quickly and efficiently identify and cull search data.
- Clone a content search and quickly compare the results of different keyword search queries run on the same content locations; or use the script to save time by not having to re-enter a large number of content locations when you create a new search.