Short answer: To find every email that mentions a word or phrase across all employees in Microsoft 365, use Microsoft Purview eDiscovery. You create a case, search all mailboxes with keywords and dates, review the counts, and export the matches as PST or .msg files with an item report your attorney can use. Exports expire after 14 days, so download them right away.
When an attorney asks for “every email that mentions X, from everyone,” exporting each mailbox from Outlook is the wrong tool. It copies whole mailboxes, one person at a time, with no keyword filter and no record of what was searched. Microsoft 365 already includes a better tool for this: Microsoft Purview eDiscovery.
This guide walks through the current eDiscovery workflow step by step. Microsoft retired the classic Content Search screens in August 2025, so older guides no longer match what you will see. If your company runs on Google Workspace instead, see our companion guide on searching and exporting Google Workspace email without Takeout.
Which Microsoft 365 tool should you use?
Use Purview eDiscovery whenever the request is keyword-based or covers more than one person. Outlook export and litigation hold solve different problems: one copies a single mailbox, the other preserves mail but does not export it.
| Tool | Keyword search | All mailboxes at once | Output | Best for |
|---|---|---|---|---|
| Purview eDiscovery (case + search) | Yes, keywords, dates, senders | Yes | PST or .msg files plus item report CSV | Attorney requests, investigations |
| Outlook “Export to a file” | No | No, one mailbox at a time | .pst of whole mailbox or folders | Moving one person’s mail |
| Litigation hold / eDiscovery hold | No (preserves only) | Yes | Nothing exported | Stopping deletion while a matter is open |
| Third-party archive or backup tool | Depends on product | Usually | Varies | Companies that already own one |
What license do you need?
Microsoft’s eDiscovery documentation says the person running searches and exports needs a Microsoft 365 or Office 365 E3 or E5 license, and its Purview licensing guide lists eDiscovery under those plans. Placing mailboxes on hold also requires Exchange Online Plan 2, or Plan 1 with the Exchange Online Archiving add-on.
Most small businesses we support are on Business Basic, Standard or Premium. In that case the usual fix is to license only the admin account doing the search, rather than upgrading every user for one legal matter. Microsoft’s licensing terms can also count the people whose mail is searched, so confirm the right setup with your licensing provider before you rely on it for litigation.
How do you search and export Microsoft 365 email?
The whole process runs in the Microsoft Purview portal. Plan on about 15 minutes of setup, then however long the search and export take, which depends on how much mail matches.
Step 1: Give yourself eDiscovery permissions
Go to purview.microsoft.com as a global admin. Open Settings, then Roles and scopes, then Role groups. Open eDiscovery Manager and add the account that will run the search as an eDiscovery Administrator. Sign out and back in so the role takes effect.
Step 2: Create a case
Open the eDiscovery solution, select Cases, then Create case. Name it after the matter, for example the client and project name, and add a short description. You land on the case’s Searches tab.
Step 3: Build the search
- Select Create search and give it a name.
- Under Data sources, add the people whose mail you need, or All people and groups for everyone. Include departed users if their mailboxes still exist.
- In the condition builder, enter your Keywords. Put phrases in quotes and join variations with OR, for example
"project name" OR projectname. - Add a Date range if the attorney gave one. Leave it off for all time.
- Select Run query and choose Statistics to get counts per mailbox first.
Step 4: Check the counts with the attorney
The Statistics tab shows how many items matched and in which mailboxes. Send those numbers to the attorney before exporting. It is much easier to tighten a keyword now than after you have downloaded gigabytes of mail. Use the Sample tab to spot-check that the matches are what you expect.
Step 5: Export the results
In the search, select Export and use these settings for an attorney review:
- Items to include: Indexed items that match your search query. Add partially indexed items only if the attorney wants everything that could not be fully searched.
- Export type: Export items with items report.
- Export format: Create .msg files for messages (one file per email), or Create PSTs for messages if the reviewer works in Outlook.
- Package options: Organize data from different locations into separate folders or PSTs, and Include folder and path of the source.
Select Export. Track progress under Process manager.
Step 6: Download within 14 days
When the export finishes, open it in Process manager, select the packages and choose Download packages. Search exports are deleted automatically 14 days after creation, so download them the same day. Microsoft recommends Edge with pop-ups and multiple downloads allowed, and 7-Zip instead of the built-in Windows unzip.
Step 7: Hand it over with a fingerprint
Zip the downloaded packages together with the items report and record the zip’s SHA-256 hash with PowerShell:
Get-FileHash .\export.zip -Algorithm SHA256Send that value with the file so the attorney can confirm it arrived unchanged. Share it through an access-controlled link, not as an email attachment. Do not forward Microsoft’s download links; they are tied to your account.
What can’t this method do?
- Recover purged mail. Without a hold or retention policy, items deleted past the recoverable items window, 14 days by default, are gone.
- Search deleted accounts. Once a user account is deleted and its mailbox purged, eDiscovery cannot reach it. Convert departing users’ mailboxes to shared or inactive mailboxes before deleting them.
- Keep exports forever. Packages expire after 14 days. Keep your downloaded copy and the hash.
- Replace legal advice. Whether you need a hold, a review set or a forensic collector is the attorney’s call. We handle the technical side.
Frequently Asked Questions
Can you search all employee email in Microsoft 365 for a keyword?
Yes. Microsoft Purview eDiscovery searches every mailbox, OneDrive and Teams chat in the tenant at once using keywords, dates and senders, then exports the matches as PST or individual .msg files. You need an admin with eDiscovery permissions and the right license.
What license do I need for Microsoft 365 eDiscovery?
Microsoft says the person running eDiscovery searches and exports needs a Microsoft 365 or Office 365 E3 or E5 license. On Business Basic, Standard or Premium, licensing only the admin doing the search is usually cheaper than upgrading everyone. Confirm with your licensing provider first.
Can I export one mailbox to PST without eDiscovery?
Yes. Outlook for Windows can export a mailbox you have access to with File, Open and Export, Import and Export, Export to a file. It exports the whole mailbox or folders, not keyword matches, and it does not produce a report or hashes for an attorney.
How long do eDiscovery exports stay available?
Search export packages expire 14 days after you create them, and Microsoft deletes them automatically. Download every package and verify it as soon as the export finishes, then store the copy somewhere access-controlled.
Does eDiscovery find deleted emails?
It finds items still in mailboxes, including the Deleted Items and Recoverable Items folders while they are retained. If a mailbox had no hold or retention policy, items purged past the deleted item retention period, 14 days by default, are gone.
Want us to run it for you?
If an attorney has asked for an email export and you would rather not learn eDiscovery under a deadline, we can run the search, export and verification for you and hand over a clean package. Contact us or get a quote. We also cover this as part of our Office 365 support services and compliance work.
Related: Microsoft 365 and Outlook troubleshooting guide · Backup and disaster recovery