Applies to: Office 365 for enterprises, Live@edu
Topic last modified: 2011-11-23
Use Multi-Mailbox Search in the Exchange Control Panel to search the mailboxes in your organisation for email and other message types that contain specific keywords. You can estimate the search results or copy them to a mailbox that you have specified so that you can review, organise and export them if necessary. Discovery searches users' primary mailbox and archive mailbox.
To search mailboxes, you must be a member of the Discovery Management role group. To learn how to do this, see Give Users Access to Multi-Mailbox Search. For more information about role groups, see Administrator Role Groups.
Multi-Mailbox Search is an efficient way to search for email messages and other electronic communication sent and received by people in your organisation, and to manage the results of the search.
For example, a legal case may require copies of relevant electronic communication or documents that have been sent or received by people in your organisation. Searching for documents and exchanging them with opposing legal counsel before a trial is known as legal discovery. Multi-Mailbox Search can make preparation for legal discovery a lot easier.
In schools or businesses, a messaging administrator or compliance officer might be asked to search for email messages that contain inappropriate content. Collecting this information frequently involves searching through large volumes of email that are located in mailboxes throughout an organisation. By using Multi-Mailbox Search, you can perform such searches more efficiently.
Administrators can use Multi-Mailbox Search to find and recover messages that users have accidently or maliciously purged from their mailbox. Administrators can also use the search functionality to search for and delete inappropriate or potentially harmful email messages sent to multiple mailboxes across their organisation. For more information, see the following:
During a multi-mailbox search, the Recoverable Items folder is searched by default. The Recoverable Items folder, called the dumpster in previous versions of Microsoft Exchange, retains items that are permanently deleted by the user. The retention period for items is 14 days. When the retention period for an item expires, the item is permanently removed from Exchange Online. For more information about the Recoverable Items folder, see:
In the Exchange Control Panel, select Manage My Organisation > Mail Control > Discovery > New. A mailbox search consists of the following components:
Keywords Use basic Boolean operators to search for email messages that contain keywords. You can also build more complex search queries by using Advanced Query Syntax (AQS). This lets you to narrow the scope by searching for keywords in specific components of an email message, such as the subject line, To: and From: fields, message body, or attachments. For more information, see Advanced Keyword Searches.
Include items that cannot be searched You can include items in the search results that cannot be indexed for a mailbox search in the search results. This includes unrecognised message types and messages that contain attachments that are encrypted or have an unrecognised format. For more information, see Include Unsearchable Items in the Search Results.
Select message types… In addition to email messages, you can search for keywords in other message types, such as meetings, documents, tasks and instant messaging conversations.
Messages To or From Specific Email Addresses Narrow the scope of the search by searching for messages sent or received by specific people only. You can also search for messages to or from any person in a specific domain.
Date Range Specify a date range when the messages that you want to find were sent or received.
Mailboxes to Search You select exactly which mailboxes you want to search. You can also search the mailboxes of members of a group.
Note As previously mentioned, the Recoverable Items folder in a user’s mailbox is searched by default. If the user’s archive mailbox is enabled, it is also included in the search.
Search Name, Type and Storage Location There are two types of searches:
Estimate the search results This search type estimates how many hits meet the search criteria but it doesn't copy the results to the mailbox where the search results are stored. This lets you quickly determine whether you need to refine the search criteria to narrow the results.
Copy the search results This search type also displays the search estimates in the details pane, but it copies the results to a destination mailbox. For searches that have a large number of hits, this can take a long time.
Search results consist of copies of the message types that meet the search criteria. They are stored in a folder in the destination mailbox that is named with the search name you provide and are organised in subfolders for each user mailbox that contains results that meet the search criteria.
You also have the option to save only one copy of duplicate messages in the search results. This is called deduplication. If you don't select this option, one copy for each mailbox that contains the message is saved.
When the search is finished, use Microsoft Outlook or Outlook Web App to access the mailbox where the search results are stored, and review, organise and export the search results. For more information, see: