How to Perform a Compliance Content Search in Office 365

Organizations generate large volumes of business data every day across Exchange Online, SharePoint Online, OneDrive, Microsoft Teams, and other Microsoft 365 services. During compliance audits, legal investigations, security incidents, or internal reviews, administrators often need to locate specific emails, documents, chat conversations, or files quickly and accurately.

Microsoft 365 addresses this requirement with Office 365 Content Search, a feature within Microsoft Purview that enables authorized users to search content across multiple Microsoft 365 workloads from a centralized compliance portal. By using targeted search queries and filters, administrators can efficiently identify relevant information without manually accessing individual mailboxes or sites, helping maintain data security and regulatory compliance. Content Search also supports organizations in meeting eDiscovery, governance, and records management requirements by simplifying the process of locating business-critical information. During Exchange Online administration and tenant migration projects, it is common to perform content searches to verify mailbox data, investigate specific communications, or validate information before migration.

For organizations planning a tenant transition using the EdbMails Office 365 Migration Tool, Content Search can also assist in identifying and reviewing important mailbox data before migration begins. Understanding how this feature works, along with its permissions, search filters, and best practices, enables administrators to perform accurate and efficient compliance searches across their Microsoft 365 environment.

What is Content Search in Office 365?

Office 365 Content Search is a compliance feature in Microsoft Purview that enables authorized administrators to search for information stored across multiple Microsoft 365 services from a centralized interface. It allows organizations to quickly locate emails, documents, chat messages, and other content using keywords, search conditions, metadata, and property-based filters.

Content Search is widely used to support compliance, legal, security, and internal investigations by allowing administrators to search one or more Microsoft 365 workloads simultaneously instead of accessing each service individually.

Supported search locations include:

• Exchange Online mailboxes.
• SharePoint Online sites.
• OneDrive for Business accounts.
• Microsoft Teams chats and channel messages.
• Microsoft 365 Groups.
• Viva Engage content (where supported).

Once a search is configured, Microsoft Purview scans the selected locations and returns matching results based on the specified search criteria. Administrators can then review, refine, preview, or export the results as required.

Common use cases for Office 365 Content Search include:

• Conducting internal compliance investigations.
• Preparing data for legal discovery (eDiscovery).
• Investigating security incidents.
• Identifying sensitive or regulated information.
• Searching for deleted or retained email messages.
• Auditing organizational communications and documents.

By providing a centralized and efficient search experience, Office 365 Content Search helps organizations meet regulatory, legal, and operational requirements while maintaining control over access to sensitive business data.

1. Prerequisites Before Performing a Content Search

   Before you perform an Office 365 content search, ensure that your Microsoft 365 environment meets the necessary permission and licensing requirements. Proper configuration helps avoid access issues and ensures that searches return accurate results.

   1. Required Permissions

   Office 365 Content Search is available only to users who have been assigned the appropriate Microsoft Purview permissions. Without the required roles, users may be unable to access the Content Search page, create new searches, or view search results.

   The following Microsoft Purview role groups are commonly used to manage Content Search:

   • eDiscovery Manager – Allows users to create, manage, and review Content Searches and eDiscovery cases.
   • eDiscovery Administrator – Provides broader administrative control over eDiscovery features, including managing cases and searches across the organization.
   • Compliance Administrator – Grants access to various Microsoft Purview compliance features, including Content Search.
   • Organization Management – In some environments, administrators with this role may also have access to Content Search, depending on the organization's role assignments.

   These roles can be assigned through the Microsoft Purview portal or by using role-based access control (RBAC) within Microsoft 365. If the required permissions are not assigned, the Content Search option may not be visible, or users may receive an access denied error when attempting to create or manage searches.

   2. Licensing Considerations

   The availability of Office 365 Content Search depends on your Microsoft 365 subscription. Basic Content Search capabilities are included with many Microsoft 365 enterprise plans, while advanced eDiscovery features require additional licensing.

   Organizations should verify their licensing before using advanced compliance features, such as:

   • Microsoft Purview eDiscovery (Premium).
   • Advanced review sets.
   • Legal Hold.
   • Advanced analytics and case management.

   Because Microsoft periodically updates licensing requirements and feature availability, it is recommended to review the latest Microsoft licensing documentation before implementing compliance or eDiscovery workflows. This helps ensure that your organization has access to the required Content Search capabilities.

2. Steps to do Content Search in Office 365

   Performing an Office 365 content search in Microsoft Purview allows administrators to locate emails, documents, Teams messages, and other Microsoft 365 data from a centralized interface. Before you begin, ensure that your account has the necessary Microsoft Purview permissions and that the required Microsoft 365 workloads are available.

   Step 1: Sign in to Microsoft Purview

   • Sign in to the Microsoft Purview portal using an account that has the required compliance or eDiscovery permissions.
   • In the left navigation pane, expand Solutions (or eDiscovery, depending on your Microsoft Purview experience).
   • Select Content search to open the Content Search dashboard, where you can create and manage search queries.

     Note: If the Content search option is unavailable, verify that your account has been assigned the appropriate Microsoft Purview role.

   Step 2: Create a New Content Search

   • On the Content search page, click Create search.
   • Enter a meaningful Search name that clearly identifies the purpose of the search, such as HR Investigation - April 2026 or Finance Audit Mailboxes.
   • (Optional) Add a Description to document the reason for the search or any additional details.
   • Click Next to continue.

   Using descriptive names makes it easier to identify and manage searches, especially in organizations that maintain multiple compliance investigations.

   Step 3: Select the Search Locations

   Choose the Microsoft 365 locations that you want to include in the search. Depending on your requirements, you can search all supported locations or only specific ones.

   Supported workloads include:

   • Exchange Online mailboxes
   • SharePoint Online sites
   • OneDrive for Business accounts
   • Microsoft Teams chats and channel messages
   • Microsoft 365 Groups

   For example, if you only need to investigate a single user's mailbox, you can select that mailbox instead of searching the entire organization. Limiting the search scope helps improve performance and reduces irrelevant results.

   After selecting the required locations, click Next.

   Step 4: Configure the Search Conditions

   Define the search criteria to narrow down the results. Microsoft Purview supports keyword-based searches as well as property-based filters.

   You can search using criteria such as:

   • Keywords or phrases
   • Email subject
   • Message body
   • Sender
   • Recipient
   • File name
   • File type (PDF, DOCX, XLSX, PPTX, etc.)
   • Date range
   • Sensitive information or compliance-related properties

   For example, you can search for emails sent by a specific user during a defined period or locate documents containing particular keywords stored in SharePoint Online or OneDrive.

   Using multiple filters together produces more accurate results and minimizes unnecessary data.

   Step 5: Review and Create the Search

   Before running the search, review all configured settings, including:

   • Selected Microsoft 365 locations
   • Search query and keywords
   • Applied filters
   • Date range
   • Included workloads

   Confirm that the search scope matches your investigation requirements. Selecting incorrect locations or filters may result in incomplete or inaccurate search results.

   Once everything has been verified, click Submit or Create to start the search.

   Step 6: Run the Content Search

   After the search is created, Microsoft Purview begins processing the selected locations.

   The time required to complete the search depends on several factors, including:

   • The number of selected mailboxes or sites
   • The amount of data being searched
   • The complexity of the search query
   • Current Microsoft 365 service activity

   During processing, you can monitor the search status from the Content Search dashboard. Large enterprise environments may require additional time to complete indexing and search operations.

   Step 7: Review the Search Results

   When the search finishes, Microsoft Purview displays a summary of the results.

   Review the following information:

   • Total number of matching items
   • Estimated size of the results
   • Search status
   • Locations that were successfully searched

   If the results are broader or narrower than expected, modify the search criteria by adjusting keywords, filters, date ranges, or search locations, and then run the search again. Refining the search before exporting results helps reduce unnecessary data and improves the efficiency of compliance investigations.

3. Content Search Results: Filters, Preview, and Export

   Search Conditions and Filters

   Microsoft Purview allows administrators to refine an Office 365 content search by applying search conditions and filters. Using the right combination of criteria helps reduce irrelevant results, improves search accuracy, and speeds up investigations or compliance reviews.

   When creating a search, you can use one or more of the following filters:

   Search filter	Description
   Keywords	Search for specific words, phrases, or expressions within emails, documents, chat messages, and other indexed content. Keywords can be combined with search operators for more precise results.
   Sender	Find email messages sent by a particular user or mailbox. This filter is useful when investigating communications from a specific individual.
   Recipient	Search for messages sent to one or more recipients. You can specify individual users, distribution groups, or shared mailboxes, depending on the search scope.
   Subject	Locate emails that contain specific words or phrases in the subject line. This is helpful when searching for messages related to a known topic or project.
   Date range	Restrict the search to content created, received, or modified within a specified time period. Limiting the date range can significantly reduce the number of search results.
   File type	Search for specific document formats such as PDF, DOCX, XLSX, PPTX, TXT, or other supported file types stored in SharePoint Online or OneDrive for Business.
   Site location	Limit the search to selected SharePoint Online sites, OneDrive accounts, or specific document libraries instead of searching the entire tenant.
   Message type	Filter results based on the type of content, such as email messages, Teams chats, channel conversations, documents, or other supported Microsoft 365 data sources.

   Using Search Operators

   In addition to basic filters, Microsoft Purview supports keyword query language (KQL) and search operators that enable administrators to create more precise queries. For example, you can combine multiple keywords, exclude specific terms, or search for exact phrases to narrow down results.

   Administrators can also use property-based queries to search content based on metadata such as sender, recipient, subject, file name, or date. Combining these properties with keywords helps locate relevant information more efficiently, especially in large Microsoft 365 environments.

   For the best results, start with a broader query and gradually refine the search by adding filters or narrowing the search locations. This approach helps minimize false positives while ensuring that important content is not overlooked during compliance investigations or eDiscovery activities.

   How to Preview Search Results

   After the Office 365 Content Search finishes processing, you can preview the matching items to verify that your search query returns the expected results before exporting the data. Reviewing the results first helps ensure that the search criteria are accurate and minimizes the export of irrelevant content.

   To preview the results:

   • Open the completed Content Search from the Microsoft Purview portal.
   • Select the search and wait until its status shows Completed.
   • Open the Search results or Preview results option (depending on the Microsoft Purview interface).
   • Browse the returned items to verify that they match the search criteria.

   During the preview, you can review information such as:

   • Email subject, sender, and recipient details
   • Message date and time
   • Email body content (where supported)
   • Document names and metadata
   • File locations in SharePoint Online or OneDrive
   • Microsoft Teams messages and related metadata (when included in the search)

   If the preview shows too many unrelated items or misses expected content, refine the search by adjusting keywords, date ranges, locations, or other filters, and then run the search again. Using more specific search conditions improves the accuracy of the results and reduces the amount of data that needs to be reviewed.

   Keep in mind that preview capabilities may vary depending on the selected workload, your Microsoft 365 licensing, and the permissions assigned to your account. Only users with the appropriate Microsoft Purview roles can preview Content Search results. Following the principle of least privilege helps protect sensitive organizational data while allowing authorized administrators to perform compliance and investigation tasks effectively.

   Export Content Search results

   After reviewing the search results, administrators can export the data for legal review, compliance investigations, audits, or offline analysis. Exporting allows the search results to be shared with authorized personnel while preserving the information collected during the search.

   To export search results:

   1. Open the completed Content Search in the Microsoft Purview portal.
   2. Review the search summary and confirm that the results match your search criteria.
   3. Select Export results.
   4. Choose the appropriate export options, such as whether to export all matching items or only selected content, depending on the available Microsoft Purview features and your licensing.
   5. Start the export process and wait for Microsoft 365 to prepare the export package.
   6. Once the export is complete, download the exported data using the provided export option or utility (if applicable).

   Depending on the selected locations and Microsoft 365 licensing, the exported data may include:

   • Exchange Online email messages and attachments
   • SharePoint Online documents and document libraries
   • OneDrive for Business files
   • Microsoft Teams chat and channel messages
   • Associated metadata, such as sender, recipient, file path, creation date, and modification date

   The time required to generate an export depends on several factors, including the amount of data, the number of selected locations, and the current Microsoft 365 service workload.

   Security Considerations for Exported Data

   Exported Content Search results may contain confidential, regulated, or personally identifiable information (PII). Therefore, administrators should follow their organization's security and compliance policies when handling exported files.

   Recommended practices include:

   • Store exported data only in secure, access-controlled locations.
   • Restrict access to authorized personnel involved in the investigation or compliance process.
   • Encrypt exported files during storage and transfer whenever possible.
   • Maintain audit records of who accessed or downloaded the exported data.
   • Delete exported files when they are no longer required, in accordance with the organization's data retention policies.

   Following these practices helps protect sensitive information and ensures compliance with organizational governance, legal requirements, and industry regulations.

Best practices

Following established best practices helps improve the accuracy, efficiency, and security of Office 365 Content Search, while ensuring compliance with organizational governance policies.

• Assign only the permissions required for administrators to perform Content Searches by following the principle of least privilege.
• Use meaningful search names and descriptions so searches can be easily identified during future audits or investigations.
• Limit searches to specific mailboxes, SharePoint sites, OneDrive accounts, or Teams locations instead of searching the entire tenant whenever possible.
• Apply filters such as date ranges, keywords, senders, recipients, or file types to reduce unnecessary results and improve search performance.
• Preview search results before exporting to verify that the search query returns the intended content.
• Protect exported search results by storing them in secure locations with appropriate access controls, as exported data may contain confidential or regulated information.
• Periodically review Microsoft Purview role assignments to ensure only authorized personnel can perform compliance searches.
• Maintain documentation for significant Content Searches, including the purpose of the search, search criteria, and export details, to support compliance and audit requirements.
• Review Microsoft 365 service health if search performance or indexing issues occur unexpectedly.
• Regularly verify licensing requirements before using advanced Microsoft Purview compliance and eDiscovery features, as available functionality varies between subscription plans.

Implementing these practices helps organizations perform consistent, efficient, and defensible compliance searches while reducing administrative overhead and improving data governance.

Conclusion

Office 365 Content Search is a core Microsoft Purview capability that enables organizations to efficiently locate emails, documents, Teams conversations, and other business data across Microsoft 365 services from a centralized compliance portal. By using appropriate permissions, selecting the correct search locations, and applying precise search conditions, administrators can quickly identify relevant information for legal discovery, regulatory compliance, security investigations, and internal audits.

To achieve reliable and accurate results, organizations should follow established best practices such as assigning least-privilege permissions, using targeted search filters, validating search results before export, and regularly reviewing compliance configurations. Proper planning, governance, and licensing verification help ensure that Content Search remains an effective tool for managing compliance and responding to organizational data requests across the Microsoft 365 environment.

Frequently Asked Questions