Managing Search & Investigation
The course is part of these learning paths
This course explores how to implement and manage auditing and eDiscovery in Microsoft 365. We'll start by covering Content Search and other search and investigation tools that are used to perform content searches, and how to export content search results.
You'll also learn about auditing management, before moving on to Core eDiscovery and how to search content using the Security & Compliance Admin Center. You’ll also learn how to configure Core eDiscovery and how to create cases. Finally, we'll cover Advanced eDiscovery, and you’ll learn what Advanced eDiscovery is, how to set it up, and how to create and manage Advanced eDiscovery cases.
- Learn about Content Search and other search and investigation tools that are used to perform content searches
- Export Content Search results
- Learn how to configure audit log retention and audit policy
- Learn what Core eDiscovery is and how to search content using the Security & Compliance Admin Center
- Configure Core eDiscovery and how to create cases
- Get an overview of Advanced eDiscovery and learn how to create and manage Advanced eDiscovery cases
This course is intended for those who wish to learn how to use and manage auditing and eDiscovery in Microsoft 365.
To get the most out of this course, you should already have some basic experience of working with Microsoft 365.
Hello, and welcome to Exporting Content Search Results.
Once you run a successful content search, you’ll often need to pull the results down to your local computer. You can do this by exporting your results. Depending on the type of data you searched, the results will be exported in different formats. For example, when you export email results, they’ll be downloaded as PST files. Content from SharePoint and OneDrive for Business sites is exported as a copy of the native Office documents included in the search.
Before exporting the results of a Content Search, you first have to prepare the results. Once prepared, those results can then be exported and downloaded. I should also mention that you need to have been assigned the Export management role in the Security & Compliance Center, before you can export search results. Since this role is assigned to the built-in eDiscovery Manager role group, adding your account to that group will allow you to export and download content.
One other important thing to note is that the export management role IS NOT assigned by default to the Organization Management role group. You would think that would be a role for someone performing organization management, but it’s not included.
As I mentioned earlier, the first step when exporting search results is the preparation of those search results. More specifically, this means that when you prepare your search results, those results are uploaded to a Microsoft-provided Azure Storage location in the Microsoft cloud.
To prepare your search results, you login to https://protection.office.com and select the search that you wish to export. The output options that you choose will determine whether all items from the search are exported, or if just a subset are. If exporting Exchange data, you can export the data to one PST per mailbox, one PST for everything you export, or you can export individual messages. If you are exporting SharePoint or OneDrive for Business data, you’ll have to specify your SharePoint export options as well.
After preparing your export options, you can then export the data and download it from the Azure Storage location you exported it to. If prompted to download and install the eDiscovery Export Tool, do that, because what the eDiscovery Export Tool does is display the status of the export process.
Tom is a 25+ year veteran of the IT industry, having worked in environments as large as 40k seats and as small as 50 seats. Throughout the course of a long an interesting career, he has built an in-depth skillset that spans numerous IT disciplines. Tom has designed and architected small, large, and global IT solutions.
In addition to the Cloud Platform and Infrastructure MCSE certification, Tom also carries several other Microsoft certifications. His ability to see things from a strategic perspective allows Tom to architect solutions that closely align with business needs.
In his spare time, Tom enjoys camping, fishing, and playing poker.