Content Search – Security And Compliance – Search A Mailbox For Specific Content And Then Export Results

If you’re doing some compliance investigation work, you may need to search a user’s mailbox for specific words.

This is how To Search Email Content in Office 365 Security & Compliance for a specific user which sent email containing a specific word then export results.

Reference guides – Content search

Microsoft Docs Content Search

Microsoft Docs Export Search

Content Search : How to search a mailbox for specific keywords and export the data

Mircosoft 365 Admin Center -> Compliance Admin Center

Content Search > + New Search

New Search > Keywords “Blog” example > Specific Locations > Modify > Choose Users, Groups or Teams

Enter users name > Select > Choose

Done > Save > Save & Run > Save Search

This search will trigger a default alert email to be sent out

Next step, Export the results

Unable to preview results problem or export?

If you cannot preview, you need to add a role to the user account, eDiscovery Administrator role (Example) or eDiscovery Manager for specific cases / Compliance Admin / Compliance Data Administrator

You must sign out and sign in for the groups to take effect.

Now back to the search

After the you can see the preview, now you can click Export

Click Export > ReportsOnly or Export > Copy to clipboard export key > Download report > Install eDiscovery Export Tool

Export tool installs

Use the Export Key and Set a directory. 

File Downloads

Now you can open the report exported

MS 365 Compliance Admin Portal Error – Status code: 503

Issue : Trying to connect to Compliance Admin Portal to Run a content search. Error – Status Code : 503

“The operation could not be completed. Please try again later. If the problem persists, contact Microsoft support.”

https://compliance.microsoft.com/homepage

Error – Status Code : 503

Error


The operation could not be completed. Please try again later. If the problem persists, contact Microsoft support.

Show details


Request: /api/contextinfo/

Status code: 503

Diagnostic information: **{Version:17.00.4803.004,Environment:WEUPROD,DeploymentId:ee****************e9d84,InstanceId:WebRole_IN_3,SID:ea*********81c9,CID:5b8***416}

Time: Tue, 09 Jun 2020 09:47:27 GMT

Trouble loading the page

REFRESH. Tried once. Same. Waited a few mins. Connected

Searches crashing.. Tuesday problems

Request: /api/ComplianceSearch?id=Blog+Mail+Search

Status code: 503

Diagnostic information: **{Version:17.00.4803.004,Environment:WEUPROD,DeploymentId:ee608**********84,InstanceId:WebRole_IN_3,SID:eaf****1c9,CID:433***0}

Time: Tue, 09 Jun 2020 10:28:55 GMT

Finally Ran a Content Search and another page loading error

Content search

Show in navigation

Sorry, we’re having trouble loading the page. Try refreshing the page later. (page: /Ediscovery/ContentSearch/Management)

Refreshed… Paused… Refreshed 5mins later…

Reason : Check Service Health

Service Incident “Users may also encounter similar issues when attempting to access the Security & Compliance Center.”

Solution : Intermittent Refresh Screen / Wait for Microsoft to Resolve Service Issues