Export Content Search results from the Office 365 Security & Compliance Center

After a Content Search is successfully run, you can export the search results to a local computer. When you export email results, they're downloaded to your computer as PST files. When you export content from SharePoint and OneDrive for Business sites, copies of native Office documents are exported. There are additional documents and reports that are included with the exported search results.

Additionally, any RMS-encrypted email messages that are included in the results of a Content Search will be decrypted when you export them (as individual messages). This decryption capability is enabled by default for members of the eDiscovery Manager role group. This is because the RMS Decrypt management role is assigned to this role group. See the More information section for details about RMS decryption when you export search results.

Exporting the results of a Content Search involves preparing the results, and then downloading them to a local computer.

Step 1: Prepare search results for export

Step 2: Download the search results

More information about exporting search results

Before you begin

·         To export search results, you have to be assigned the Export management role in the Office 365 Security & Compliance Center. This role is assigned to the built-in eDiscovery Manager role group. It isn't assigned by default to the Organization Management role group. For more information, see Assign eDiscovery permissions in the Office 365 Security & Compliance Center.

·         The computer you use to export the search results has to meet the following system requirements:

o    32- or 64-bit versions of Windows 7 and later versions

o    Microsoft .NET Framework 4.7

o    A supported browser:

§  Microsoft Edge

§  OR

§  Microsoft Internet Explorer 10 and later versions

Note: Microsoft doesn't manufacture third-party extensions or add-ons for ClickOnce applications. Exporting search results using an unsupported browser with third-party extensions or add-ons isn't supported.

When you download search results (described in Step 2), you can increase the download speed by configuring a Windows Registry setting on the computer you use to export the search results. For more information, see Increase the download speed when exporting eDiscovery search results from Office 365.

When you export search results, the data is temporarily stored in a unique Microsoft Azure storage location in the Microsoft cloud before it's downloaded to your local computer. Be sure your organization can connect to the endpoint in Azure, which is *.blob.core.windows.net (the wildcard represents a unique identifier for your export). The search results data is deleted from the Azure storage location two weeks after it's created.

·         If your organization uses a proxy server to communicate with the Internet, you need to define the proxy server settings on the computer that you use to export the search results (so the export tool can be authenticated by your proxy server). To do this, open the machine.config file in the location that matches your version of Windows.

o    32-bit   %windir%\Microsoft.NET\Framework\[version]\Config\machine.config

o    64-bit   %windir%\Microsoft.NET\Framework64\[version]\Config\machine.config

Add the following lines to the machine.config file somewhere between the <configuration> and </configuration> tags. Be sure to replace ProxyServer and Port with the correct values for your organization; for example, proxy01.contoso.com:80 .

<system.net>

     <defaultProxy enabled="true" useDefaultCredentials="true">

       <proxy proxyaddress="http://ProxyServer:Port"

              usesystemdefault="False"

              bypassonlocal="True"

              autoDetect="False" />

     </defaultProxy>

</system.net>

·         See the More information section for a description of the limits for exporting search results.

·         The maximum size of a PST file that can be exported is 10 GB. If you want to change this default size, you can edit the Windows Registry on the computer that you use to export the search results. See Change the size of PST files when exporting eDiscovery search results.

Step 1: Prepare search results for export

The first step is to prepare the search results for exporting. When you prepare results, they are uploaded to an Azure storage location in the Microsoft cloud. Note that content from mailboxes and sites is uploaded at a maximum rate of 2 GB per hour.

1.       Go to https://protection.office.com.

2.       Sign in to Office 365 using your work or school account.

3.       In the left pane of the Security & Compliance Center, click Search & investigation > Content search.

4.       On the Content search page, select a search.

5.       In the details pane, under Export results to a computer, click Start export.

Note: If the results for a search are older than 7 days, you are prompted to update the search results. If this happens, cancel the export, click Update search results in the details pane for the selected search, and then start the export again after the results are updated.

6.       On the Export the search results page, under Include these items from the search, choose one of the following options:

o    Export only indexed items

o    Export indexed and unindexed items

o    Export only unindexed items

See the More information section for a description about how unindexed items are exported. For more information about unindexed items, see Unindexed items in Content Search.

7.       Under Export Exchange content as, choose one of the following options:

o    One PST file for each mailbox   Exports one PST file for each user mailbox that contains search results. Any results from the user's archive mailbox are included in the same PST file. Note that this option reproduces the mailbox folder structure from the source mailbox.

o    One PST file containing all messages    Exports a single PST file (named Exchange.pst) that contains the search results from all source mailboxes included in the search. Note that this option reproduces the mailbox folder structure for each message.

o    One PST file containing all messages in a single folder    Exports search results to a single PST file where all messages are located in a single, top-level folder. This option lets reviewers review items in chronological order (items are sorted by sent date) without having to navigate the original mailbox folder structure for each item.

o    Individual messages    Exports search results as individual email messages, using the .msg format. If you select this option, email search results are exported to a folder in the file system. The folder path for individual messages is the same as the one used if you exported the results to PST files.

Important: To decrypt RMS-encrypted messages when they're exported, you must export email search results as individual messages. Encrypted messages will remain encrypted if you export the search results as a PST file.

8.       Click the Enable de-duplication checkbox to exclude duplicate messages. This option appears only if the content sources of the search includes Exchange mailboxes or public folders.

If you select this option, only one copy of a message will be exported even if multiple copies of the same message are found in the mailboxes that were searched. The export results report (Results.csv) will contain a row for every copy of a duplicate message so that you can identify the mailboxes (or public folders) that contain a copy of the duplicate message. For more information about de-duplication and how duplicate items are identified, see De-duplication in eDiscovery search results.

9.       Click the Include versions for SharePoint documents checkbox to export all versions of SharePoint documents. This option appears only if the content sources of the search includes SharePoint or OneDrive for Business sites.

10.   Click the Export files in a compressed (zipped) folder checkbox to export search results to compressed folders. This option is available only when you choose to export Exchange items as individual messages and when the search results include SharePoint or OneDrive documents. This option is primarily used to work around the 260 character limit in Windows file path names when items are exported. See Filenames of exported items in the More Information section.

11.   Click Start export.

The search results are prepared for downloading, which means they're being uploaded to the Azure storage location in the Microsoft cloud. When the search results are ready for download, the Download exported results link is displayed under Export results to a computer in the details pane.

Step 2: Download the search results

The next step is to download the search results from the Azure storage location to your local computer.

As previously explained, you can increase the download speed by configuring a Windows Registry setting on the computer you use to export the search results. For more information, see Increase the download speed when exporting eDiscovery search results from Office 365.

1.       In the details pane for the search that you started the export for, under Export results to a computer, click Download exported results.

The Download exported results window is displayed and contains the following information about the search results that will be downloaded to your computer.

o    The number of items that will be downloaded.

o    The estimated total size of the items that will be downloaded.

o    Whether indexed or unindexed will be exported. Unindexed items are items that have an recognized format, are encrypted, or weren't indexed for other reasons. For more information, see Unindexed items in Content Search.

o    Whether or not versions of SharePoint documents will be downloaded.

o    The status of the export preparation process. You can start downloading search results even if the preparation of the data isn't complete.

1.       Under Export key, click Copy to clipboard. You will use this key in step 5 to download the search results.

Note: Because anyone can install and start the eDiscovery Export tool, and then use this key to download the search results, be sure to take precautions to protect this key just like you would protect passwords or other security-related information.

2.       Click Download results.

3.       If you're prompted to install the MicrosoftOffice 365 eDiscovery Export Tool, click Install.

4.       In the eDiscovery Export Tool, paste the export key that you copied in step 2 in the appropriate box.

5.       Click Browse to specify the location where you want to download the search result files.

Note: Due to the high amount of disk activity (reads and writes), you should download search results to a local disk drive; don't download them to a mapped network drive or other network location.

1.       Click Start to download the search results to your computer.

The eDiscovery Export Tool displays status information about the export process, including an estimate of the number (and size) of the remaining items to be downloaded. When the export process is complete, you can access the files in the location where they were downloaded.

https://support.office.com/en-us/article/Export-Content-Search-results-from-the-Office-365-Security-Compliance-Center-ed48d448-3714-4c42-85f5-10f75f6a4278