- 24 minutes to read
In this article
You can use the Content Search eDiscovery tool in the compliance center in Office 365 or Microsoft 365 to search for in-place items such as email, documents, and instant messaging conversations in your organization. Use this tool to search for items in these services:
Exchange Online mailboxes and public folders
SharePoint Online sites and OneDrive for Business accounts
Skype for Business conversations
Microsoft 365 Groups
After you run a Content Search, the number of content locations and an estimated number of search results are displayed in the search statistics. You can also quickly view statistics, such as the content locations that have the most items that match the search query. After you run a search, you can preview the results or export them to a local computer.
Create a search
To have access to the Content search page to run searches and preview and export search results, an administrator, compliance officer, or eDiscovery manager must be a member of the eDiscovery Manager role group in the Security & Compliance Center. For more information, see Assign eDiscovery permissions.
Go to https://protection.office.com and sign in using your Microsoft email address and password.
Click Search > Content search.
On the Search page, click the arrow next to New search.
You can choose one of the following options:
Guided search: This option starts a wizard that guides you through the creating the search. The user interface to select content locations and build the search query are the same as the New search option.
New search: This option displays an updated user interface to create a search. This is the default option if you click New search.
Search by ID List: This option lets you search for specific email messages and other mailbox items using a list of Exchange IDs. To create an ID list search (formally called a targeted search), you submit a comma-separated value (CSV) file that identifies the specific mailbox items to search for. For instructions, see Prepare a CSV file for an ID list Content Search in Office 365.
The remainder of the steps in this procedure follows the default new search workflow.
Click New search in the drop-down list.
Under Search query, specify the following things:
Keywords to search for: Type a search query in Keywords box. You can specify keywords, message properties such as sent and received dates, or document properties such as file names or the date that a document was last changed. You can use more complex queries that use a Boolean operator, such as AND, OR, NOT, and NEAR. You can also search for sensitive information (such as social security numbers) in documents, or search for documents that have been shared externally. If you leave the keyword box empty, all content located in the specified content locations is included in the search results.
Alternatively, you can click the Show keyword list checkbox and the type a keyword in each row. If you do this, the keywords on each row are connected by a logical operator (c:s) that is similar in functionality to the OR operator in the search query that’s created.
Why use the keyword list? You can get statistics that show how many items match each keyword. This can help you quickly identify which keywords are the most (and least) effective. You can also use a keyword phrase (surrounded by parentheses) in a row. For more information about search statistics, see View keyword statistics for Content Search results.
To help reduce issues caused by large keyword lists, you’re now limited to a maximum of 20 rows in the keyword list.
Conditions: You can add search conditions to narrow a search and return a more refined set of results. Each condition adds a clause to the search query that is created and run when you start the search. A condition is logically connected to the keyword query (specified in the keyword box) by a logical operator (c:c) that is similar in functionality to the AND operator. That means that items have to satisfy both the keyword query and one or more conditions to be included in the results. This is how conditions help to narrow your results. For a list and description of conditions that you can use in a search query, see the “Search conditions” section in Keyword queries and search conditions for Content Search.
Locations: Choose the content locations to search.
All locations: Use this option to search all content locations in your organization. This includes email in all Exchange mailboxes (including all inactive mailboxes, and mailboxes for all Microsoft Teams, Yammer Groups, and Microsoft 365 Groups), all Skype for Business conversations, all SharePoint and OneDrive for Business sites (including the sites for all Microsoft Teams, Yammer Groups, and Microsoft 365 Groups), and items in all Exchange public folders.
Specific locations: Use this option to search specific content locations. You can search all content locations for a specific Office 365 service (such as searching all Exchange mailboxes or search all SharePoint sites) or you can search for content in specific locations of any of the Office 365 services that are displayed.
You can also add distribution groups to the list of Exchange mailboxes to search. For distribution groups, the mailboxes of group members are searched. Dynamic distribution groups aren’t supported.
When you search all mailbox locations or just specific mailboxes, data from other Office 365 applications that’s saved to user mailboxes is included when you export the results of a Content Search. This data won’t be included in the estimated search results and isn’t available for preview. It is included when you export and download the search results. For more information, see Content stored in Exchange Online mailboxes.
After you’ve set up your search query, click Save & run.
On the Save search page, type a name for the search, and an optional description that helps identify the search. The name of the search has to be unique in your organization.
Click Save to start the search.
After you save and run the search, any results returned by the search are displayed in the results pane. Depending on how you have the preview setting configured, the search results are display or you have to click Preview results to view them. See the next section for details.
To access this content search again or access other content searches listed on the Content search page, select the search and then click Open.
To clear the results or create another search, click New search.
Preview search results
There are two configuration settings for previewing search results. After you run a new search or open an existing search, click Individual results to view the following preview settings:
Preview results automatically: This setting displays the search results after you a run a search.
Preview results manually: This setting displays placeholders in the search results pane, and displays the Preview results button that you have to click to display the search results. This is the default setting. It helps enhance search performance by not automatically displaying the search results when you open an existing search.
There are limits related to how many items are available to be previewed. For more information, see Limits for Content Search.
For a list of supported file types that can be previewed, see Previewing search results in the “More information about content search” section. If a file type isn’t supported for preview or to download a copy of a document, you can click Download original file to download it to your local computer. For .aspx Web pages, the URL for the page is included though you might not have permissions to access the page.
Also note that unindexed items aren’t available for previewing.
View information and statistics about a search
After you create and run a content search, you can view statistics about the estimated search results. This includes a summary of the search results, the query statistics such as the number of content locations with items that match the search query, and the name of content locations that have the most matching items. You can display statistics for one or more content searches. This lets you quickly compare the results for multiple searches and make decisions about the effectiveness of your search queries.
You can also download the search statistics and keyword statistics to a CSV file. This lets you use the filtering and sorting features in Excel to compare results, and prepare reports for your search results.
To view search statistics:
On the Content search page, click Open and then click the search that you want to view the statistic for.
On the flyout page, click Open query.
In the Individual results drop down list, click Search statistics.
In the Type drop down list, click one of the following options depending on the search statistics you want to view:
Summary: Displays statistics for each type of content locations searched. This contents the number of content locations that contained items that matched the search query, and the total number and size of search result items. This is the default setting.
Queries: Displays statistics about the search query. This includes the type of content location the query statistics are applicable to, part of the search query the statistics are applicable to (note that Primary indicates the entire search query), the number of the content locations that contain items that match the search query, and the total number and size and items that were found (in the specified content location) that match the search query. Statistics for unindexed items (also called partially indexed items) are also displayed. However, only partially indexed items from mailboxes are included in the statistics. Partially indexed items from SharePoint and OneDrive are not included in the statistics.
Top locations: Displays statistics about the number of items that match the search query in each content location. The top 1,000 locations are displayed.
For more detailed information about search statistics, see View keyword statistics for Content Search results.
Export search results
After a search is successfully run, you can export the search results to a local computer. When you export email results, they can be downloaded to your computer as PST files or as individual messages (.msg files). When you export content from SharePoint and OneDrive sites, copies of native Office documents are exported. There are also other documents and reports that are included with the exported search results. You can also export the search results report and not the actual items.
To export search results:
On the Content search page, click the search that you want to export the search results for.
On the flyout page, click More, and then click Export results. You can also export a search results report.
Complete the sections on the Export results fly out page. Be sure to use the scroll bar to view all export options.
For more detailed instructions and troubleshooting tips, see:
More information about content search
See the following sections for more information about content searches.
Content search limits
Building a search query
Searching OneDrive accounts
Searching Microsoft Teams and Microsoft 365 Groups
Searching Yammer Groups
Searching inactive mailboxes
Searching disconnected or de-licensed mailboxes
Previewing search results
Partially indexed items
Searching for content in a SharePoint Multi-Geo environment
Content search limits
For a description of the limits that are applied…