In-Place eDiscovery in Exchange Online (2023)

  • Article
  • 17 minutes to read


As we continue to invest in different ways to search for mailbox content, we're announcing the retirement of In-Place eDiscovery in the Exchange admin center (EAC) in Exchange Online. Starting July 1, 2020, you won't be able to create new In-Place eDiscovery searches. But you'll still be able to manage In-Place eDiscovery searches in the EAC or by using the Set-MailboxSearch cmdlet in Exchange Online PowerShell. However, starting October 1, 2020, you won't be able to manage In-Place eDiscovery searches. You'll only be able to remove them in the EAC or by using the Remove-MailboxSearch cmdlet. Using In-Place eDiscovery in Exchange Server and Exchange hybrid deployments will still be supported. For more information about the retirement of In-Place eDiscovery in Exchange Online, see Retirement of legacy eDiscovery tools.

If your organization adheres to legal discovery requirements (related to organizational policy, compliance, or lawsuits), In-Place eDiscovery in Exchange Online can help you perform discovery searches for relevant content within mailboxes. You can also use In-Place eDiscovery in an Exchange hybrid environment to search on-premises and cloud-based mailboxes in the same search.


In-Place eDiscovery is a powerful feature that allows a user with the correct permissions to potentially gain access to all messaging records stored throughout the Exchange Online organization. It's important to control and monitor discovery activities, including addition of members to the Discovery Management role group, assignment of the Mailbox Search management role, and assignment of mailbox access permission to discovery mailboxes.

How In-Place eDiscovery works

In-Place eDiscovery uses the content indexes created by Exchange Search. Role Based Access Control (RBAC) provides the Discovery Management role group to delegate discovery tasks to non-technical personnel, without the need to provide elevated privileges that may allow a user to make any operational changes to Exchange configuration. The Exchange admin center (EAC) provides an easy-to-use search interface for non-technical personnel such as legal and compliance officers, records managers, and human resources (HR) professionals.

Authorized users can perform an In-Place eDiscovery search by selecting the mailboxes, and then specifying search criteria such as keywords, start and end dates, sender and recipient addresses, and message types. After the search is complete, authorized users can then select one of the following actions:

  • Estimate search results: This option returns an estimate of the total size and number of items that will be returned by the search based on the criteria you specified.

  • Preview search results: This option provides a preview of the results. Messages returned from each mailbox searched are displayed.

  • Copy search results: This option lets you copy messages to a discovery mailbox.

  • Export search results: After search results are copied to a discovery mailbox, you can export them to a PST file.

In-Place eDiscovery in Exchange Online (1)

Exchange Search

In-Place eDiscovery uses the content indexes created by Exchange Search. Exchange Search has been retooled to use Microsoft Search Foundation, a rich search platform that comes with significantly improved indexing and querying performance and improved search functionality. Because the Microsoft Search Foundation is also used by other Office products, including SharePoint 2013, it offers greater interoperability and similar query syntax across these products.

(Video) In Place eDiscovery and Hold

With a single content indexing engine, no additional resources are used to crawl and index mailbox databases for In-Place eDiscovery when eDiscovery requests are received by IT departments.

In-Place eDiscovery uses Keyword Query Language (KQL), a querying syntax similar to the Advanced Query Syntax (AQS) used by Instant Search in Microsoft Outlook and Outlook on the web. Users familiar with KQL can easily construct powerful search queries to search content indexes.

For more information about the file formats indexed by Exchange search, see File Formats Indexed By Exchange Search.

Discovery Management role group and management roles

For authorized users to perform In-Place eDiscovery searches, you must add them to the Discovery Management role group. This role group consists of two management roles: the Mailbox Search role, which allows a user to perform an In-Place eDiscovery search, and the Legal Hold role, which allows a user to place a mailbox on In-Place Hold or litigation hold. For more information about roles and role groups, see Permissions in Exchange Online.

By default, permissions to perform In-Place eDiscovery-related tasks aren't assigned to any user or Exchange administrators. Exchange administrators who are members of the Organization Management role group can add users to the Discovery Management role group and create custom role groups to narrow the scope of a discovery manager to a subset of users. To learn more about adding users to the Discovery Management role group, see Assign eDiscovery permissions in Exchange.


If a user hasn't been added to the Discovery Management role group or isn't assigned the Mailbox Search role, the In-Place eDiscovery & Hold user interface isn't displayed in the EAC, and the In-Place eDiscovery cmdlets aren't available in Exchange Online PowerShell.

Auditing of RBAC role changes, which is enabled by default, makes sure that adequate records are kept to track assignment of the Discovery Management role group. You can use the administrator role group report to search for changes made to administrator role groups. For more information, see Search the role group changes or administrator audit logs.

Custom management scopes for In-Place eDiscovery

You can use a custom management scope to let specific people or groups use In-Place eDiscovery to search a subset of mailboxes in your Exchange Online organization. For example, you might want to let a discovery manager search only the mailboxes of users in a specific location or department. You do this by creating a custom management scope that uses a custom recipient filter to control which mailboxes can be searched. Recipient filter scopes use filters to target specific recipients based on recipient type or other recipient properties.

For In-Place eDiscovery, the only property on a user mailbox that you can use to create a recipient filter for a custom scope is distribution group membership. If you use other properties, such as CustomAttributeN, Department, or PostalCode, the search fails when it's run by a member of the role group that's assigned the custom scope. For more information, see Create a custom management scope for In-Place eDiscovery searches.

eDiscovery in an Exchange hybrid deployment

To successfully perform cross-premises eDiscovery searches in an Exchange Server hybrid organization, you will have to configure OAuth (Open Authorization) authentication between your Exchange on-premises and Exchange Online organizations so that you can use In-Place eDiscovery to search on-premises and cloud-based mailboxes. OAuth authentication is a server-to-server authentication protocol that allows applications to authenticate to each other.

OAuth authentication supports the following eDiscovery scenarios in an Exchange hybrid deployment:

  • Search on-premises mailboxes that use Exchange Online Archiving for cloud-based archive mailboxes.

  • Search on-premises and cloud-based mailboxes in the same eDiscovery search.

  • Search on-premises mailboxes by using the eDiscovery Center in SharePoint Online.

For more information about the eDiscovery scenarios that require OAuth authentication to be configured in an Exchange hybrid deployment, see Using Oauth Authentication to Support eDiscovery in an Exchange Hybrid Deployment. For step-by-step instructions for configuring OAuth authentication to support eDiscovery, see Configure OAuth Authentication Between Exchange and Exchange Online Organizations.

(Video) eDiscovery in Microsoft 365 | How eDiscovery works | Step by Step guide to use eDiscovery in M365

For information about running an In-Place eDiscovery search in Exchange Server, see Create an In-Place eDiscovery search in Exchange Server.

Discovery mailboxes

After you create an In-Place eDiscovery search, you can copy the search results to a target mailbox. The EAC allows you to select a discovery mailbox as the target mailbox. A discovery mailbox is a special type of mailbox that provides the following functionality:

  • Easier and secure target mailbox selection: When you use the EAC to copy In-Place eDiscovery search results, only discovery mailboxes are made available as a repository in which to store search results. You don't need to sort through a potentially long list of mailboxes available in the organization. This also eliminates the possibility of a discovery manager accidentally selecting another user's mailbox or an unsecured mailbox in which to store potentially sensitive messages.

  • Large mailbox storage quota: The target mailbox should be able to store a large amount of message data that may be returned by an In-Place eDiscovery search. By default, discovery mailboxes have a mailbox storage quota of 50 gigabytes (GB). This storage quota can't be increased.

  • More secure by default: Like all mailbox types, a discovery mailbox has an associated Active Directory user account. However, this account is disabled by default. Only users explicitly authorized to access a discovery mailbox have access to it. Members of the Discovery Management role group are assigned Full Access permissions to the default discovery mailbox. Any additional discovery mailboxes you create don't have mailbox access permissions assigned to any user.

  • Email delivery disabled: Although visible in Exchange address lists, users can't send email to a discovery mailbox. Email delivery to discovery mailboxes is prohibited by using delivery restrictions. This preserves the integrity of search results copied to a discovery mailbox.

Exchange Setup creates one discovery mailbox with the display name Discovery Search Mailbox. You can use Exchange Online PowerShell to create additional discovery mailboxes. By default, the discovery mailboxes you create won't have any mailbox access permissions assigned. You can assign Full Access permissions for a discovery manager to access messages copied to a discovery mailbox. For details, see Create a discovery mailbox.

In-Place eDiscovery also uses a system mailbox with the display name SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9} to hold In-Place eDiscovery metadata. System mailboxes aren't visible in the EAC or in Exchange address lists. In on-premises organizations, before removing a mailbox database where the In-Place eDiscovery system mailbox is located, you must move the mailbox to another mailbox database. If the mailbox is removed or corrupted, your discovery managers are unable to perform eDiscovery searches until you re-create the mailbox. For details, see Delete and re-create the default discovery mailbox in Exchange.

Estimate, preview, and copy search results

After an In-Place eDiscovery search is completed, you can view search result estimates in the Details pane in the EAC. The estimate includes number of items returned and total size of those items. You can also view keyword statistics, which returns details about number of items returned for each keyword used in the search query. This information is helpful in determining query effectiveness. If the query is too broad, it may return a much bigger data set, which could require more resources to review and raise eDiscovery costs. If the query is too narrow, it may significantly reduce the number of records returned or return no records at all. You can use the estimates and keyword statistics to fine-tune the query to meet your requirements.


Keyword statistics also include statistics for non-keyword properties such as dates, message types, and senders/recipients specified in a search query.

You can also preview the search results to further ensure that messages returned contain the content you're searching for and further fine-tune the query if required. eDiscovery Search Preview displays the number of messages returned from each mailbox searched and the total number of messages returned by the search. The preview is generated quickly without requiring you to copy messages to a discovery mailbox.

After you're satisfied with the quantity and quality of search results, you can copy them to a discovery mailbox. When copying messages, you have the following options:

  • Include unsearchable items: For details about the types of items that are considered unsearchable, see the eDiscovery search considerations in the previous section.

  • Enable de-duplication: De-duplication reduces the dataset by only including a single instance of a unique record if multiple instances are found in one or more mailboxes searched.

  • Enable full logging: By default, only basic logging is enabled when copying items. You can select full logging to include information about all records returned by the search.

    (Video) In-Place eDiscovery & hold (Exchange Online Admin Center)

  • Send me mail when the copy is completed: An In-Place eDiscovery search can potentially return a large number of records. Copying the messages returned to a discovery mailbox can take a long time. Use this option to get an email notification when the copying process is completed. For easier access using Outlook on the web, the notification includes a link to the location in a discovery mailbox where the messages are copied.

Export search results to a PST file

After search results are copied to a discovery mailbox, you can export the search results to a PST file.

In-Place eDiscovery in Exchange Online (2)

After search results are exported to a PST file, you or other users can open them in Outlook to review or print messages returned in the search results. For more information, see Export eDiscovery search results to a PST file.

Different search results

Because In-Place eDiscovery performs searches on live data, it's possible that two searches of the same content sources and using the same search query can return different results. Estimated search results can also be different from the actual search results that are copied to a discovery mailbox. This can happen even when rerunning the same search within a short amount of time. There are several factors that can affect the consistency of search results:

  • The continual indexing of incoming email because Exchange Search continuously crawls and indexes your organization's mailbox databases and transport pipeline.

  • Deletion of email by users or automated processes.

  • Bulk importing large amounts of email, which takes time to index.

If you do experience dissimilar results for the same search, consider placing mailboxes on hold to preserve content, running searches during off-peak hours, and allowing time for indexing after importing large amounts of email.

Logging for In-Place eDiscovery searches

There are two types of logging available for In-Place eDiscovery searches:

  • Basic logging: Basic logging is enabled by default for all In-Place eDiscovery searches. It includes information about the search and who performed it. Information captured about basic logging appears in the body of the email message sent to the mailbox where the search results are stored. The message is located in the folder created to store search results.

  • Full logging: Full logging includes information about all messages returned by the search. This information is provided in a comma-separated value (.csv) file attached to the email message that contains the basic logging information. The name of the search is used for the .csv file name. This information may be required for compliance or record-keeping purposes. To enable full logging, you must select the Enable full logging option when copying search results to a discovery mailbox in the EAC. If you're using Exchange Online PowerShell, specify the full logging option using the LogLevel parameter.


When using Exchange Online PowerShell to create or modify an In-Place eDiscovery search, you can also disable logging.

Besides the search log included when copying search results to a discovery mailbox, Exchange also logs cmdlets used by the EAC or Exchange Online PowerShell to create, modify or remove In-Place eDiscovery searches. This information is logged in the admin audit log entries. For details, see View the administrator audit log.

In-Place eDiscovery and In-Place Hold

As part of eDiscovery requests, you may be required to preserve mailbox content until a lawsuit or investigation is disposed. Messages deleted or altered by the mailbox user or any processes must also be preserved. This is accomplished by using In-Place Hold. For details, see In-Place Hold and Litigation Hold.

(Video) Microsoft 365 - How to create an eDiscovery case to search, hold and export company data

Be aware of the following:

  • You can't use the option to search all mailboxes. You must select the mailboxes or distribution groups.

  • You can't remove an In-Place eDiscovery search if the search is also used for In-Place Hold. You must first disable the In-Place Hold option in a search and then remove the search.

Preserving mailboxes for In-Place eDiscovery

When an employee leaves an organization, it's a common practice to disable or remove the mailbox. After you disable a mailbox, it is disconnected from the user account but remains in the mailbox for a certain period, 30 days by default. The Managed Folder Assistant does not process disconnected mailboxes and any retention policies are not applied during this period. You can't search content of a disconnected mailbox. Upon reaching the deleted mailbox retention period configured for the mailbox database, the mailbox is purged from the mailbox database.


In Exchange Online, In-Place eDiscovery can search content in inactive mailboxes. Inactive mailboxes are mailboxes that are placed on In-Place Hold or litigation hold and then removed. Inactive mailboxes are preserved as long as they're placed on hold. When an inactive mailbox is removed from In-Place Hold or when litigation hold is disabled, it is permanently deleted. For details, see Create and manage inactive mailboxes.

In on-premises deployments, if your organization requires that retention settings be applied to messages of employees who are no longer in the organization or if you may need to retain an ex-employee's mailbox for an ongoing or future eDiscovery search, do not disable or remove the mailbox. You can take the following steps to ensure the mailbox can't be accessed and no new messages are delivered to it.

  1. Disable the Active Directory user account using Active Directory Users & Computers or other Active Directory or account provisioning tools or scripts. This prevents mailbox logon using the associated user account.


    Users with Full Access mailbox permission will still be able to access the mailbox. To prevent access by others, you must remove their Full Access permission from the mailbox. For information about how to remove Full Access mailbox permissions on a mailbox, see Manage permissions for recipients.

  2. Set the message size limit for messages that can be sent from or received by the mailbox user to a very low value, 1 KB for example. This prevents delivery of new mail to and from the mailbox.

  3. Configure delivery restrictions for the mailbox so nobody can send messages to it. For details, see Configure message delivery restrictions for a mailbox.


You must take the above steps along with any other account management processes required by your organization, but without disabling or removing the mailbox or removing the associated user account.

(Video) 65. How to Create In-Place Hold in Exchange 2019 | E-Discovery

When planning to implement mailbox retention for messaging retention management (MRM) or In-Place eDiscovery, you must take employee turnover into consideration. Long-term retention of ex-employee mailboxes will require additional storage on Mailbox servers and also result in an increase in Active Directory database because it requires that the associated user account be retained for the same duration. Additionally, it may also require changes to your organization's account provisioning and management processes.

In-Place eDiscovery documentation

The following table contains links to topics that will help you learn about and manage In-Place eDiscovery.

Assign eDiscovery permissions in ExchangeLearn how to give a user access to use In-Place eDiscovery in the EAC to search Exchange mailboxes. Adding a user to the Discovery Management role group also allows the person to use the eDiscovery Center in SharePoint 2013 and SharePoint Online to search Exchange mailboxes.
Create a discovery mailboxLearn how to use Exchange Online PowerShell to create a discovery mailbox and assign access permissions.
Message properties and search operators for In-Place eDiscoveryLearn which email message properties can be searched using In-Place eDiscovery. The topic provides syntax examples for each property, information about search operators such as AND and OR, and information about other search query techniques such as using double quotation marks (" ") and prefix wildcards.
Search limits for In-Place eDiscoveryLearn In-Place eDiscovery limits in Exchange Online that help maintain the health and quality of eDiscovery services for Microsoft 365 or Office 365 organizations.
Export eDiscovery search results to a PST fileLearn how to export the results of an eDiscovery search to a PST file.
Create a custom management scope for In-Place eDiscovery searchesLearn how to use custom management scopes to limit the mailboxes that a discovery manager can search.
Search for and delete email messagesLearn how to use Content Search to search for and then delete email messages.
Reduce the size of a discovery mailbox in ExchangeUse this process to reduce the size of a discovery mailbox that's larger than 50 GB.
Delete and re-create the default discovery mailbox in ExchangeLearn how to delete the default discovery mailbox, re-create it, and then reassign permissions to it. Use this procedure if this mailbox has exceeded the 50 GB limit and you don't need the search results.
Using Oauth Authentication to Support eDiscovery in an Exchange Hybrid DeploymentLearn about the eDiscovery scenarios in an Exchange hybrid deployment that require you to configure OAuth authentication.

For more information about eDiscovery in Microsoft Purview, see the Get started with eDiscovery (Standard).


What is eDiscovery Exchange Online? ›

In-Place eDiscovery is a powerful feature that allows a user with the correct permissions to potentially gain access to all messaging records stored throughout the Exchange Online organization.

How do I set up eDiscovery in Office 365? ›

Go to compliance portaland sign in using the credentials for an admin account in your Microsoft 365 organization. On the Permissions page, select the eDiscovery Manager role group. On the eDiscovery Manager flyout page, select Edit next to the eDiscovery Manager section.

Does Office 365 have eDiscovery? ›

Microsoft Purview eDiscovery (Standard) in Microsoft Purview provides a basic eDiscovery tool that organizations can use to search and export content in Microsoft 365 and Office 365.

What is the difference between Office 365 content search and eDiscovery? ›

Therefore, an eDiscovery search feature is generally used to identify content (including content on hold) to be exported and presented to a legal counsel as potential evidence. A content search tool, however, does not provide any legal or administrative capabilities like eDiscovery.

What is the difference between discovery and eDiscovery? ›

Discovery refers to the first phase of litigation during which the parties to a dispute must provide each other with all relevant case evidence, including records and information. Electronic discovery, or eDiscovery, refers to discovery in which the information sought is in electronic format.

What are the different types of eDiscovery in Office 365? ›

Microsoft Purview provides three eDiscovery solutions: Content search, eDiscovery (Standard), and eDiscovery (Premium). Content search. Use the Content search tool to search for content across Microsoft 365 data sources and then export the search results to a local computer.

What is the difference between Office 365 eDiscovery and Advanced eDiscovery? ›

In a Core eDiscovery case, organizations can run content searches, and place holds to preserve content indefinitely. Using an Advanced eDiscovery case, organizations can collect, review, analyze, and export data, manage custodians, and add notification workflows to communicate with these custodians.

What is the difference between eDiscovery and Advanced eDiscovery? ›

For example Core eDiscovery contains all the features included in Content search, and Advanced eDiscovery contains all the features included in Core eDiscovery, thus contains all the features in Content search as well. Content Search allows: Role-based permissions. Export search results.

How do I give access to eDiscovery? ›

Assign eDiscovery permissions
  1. Next to eDiscovery Manager, select Edit.
  2. On the Choose eDiscovery Manager wizard page, select. ...
  3. Select the user (or users) you want to add as an eDiscovery manager, and then select Add.
  4. When you're finished adding users, select Done.
Feb 21, 2023

What is the difference between Office 365 eDiscovery E3 and E5? ›

The core differences between E3 and E5 are audio-conferencing features and security functionality. But there are also other benefits, including advanced analytics, compliance and information protection, and advanced retention policies for email.

What o365 permissions are required for eDiscovery? ›

To access Advanced eDiscovery, Office 365 users must have an Office 365 E5 license. Keep in mind that if you are an IT administrator, eDiscovery manager, lawyer, paralegal, or investigator using Advanced eDiscovery to manage cases you do not need an E5 license or add-on license.

How to export a PST file from Office 365 using eDiscovery? ›

Use the Exchange admin center to export In-Place eDiscovery search results to a PST
  1. Go to Compliance management > In-place eDiscovery & hold.
  2. In the list view, select the In-Place eDiscovery search you want to export the results of, and then click Export to a PST file.
Jan 27, 2023

What are the 2 types of Microsoft 365 groups? ›

Distribution groups are used for sending email notifications to a group of people. Security groups are used for granting access to resources such as SharePoint sites.

What role is required to perform an eDiscovery search on a mailbox? ›

This role group consists of two management roles: the Mailbox Search Role, which allows a user to perform an In-Place eDiscovery search, and the Legal Hold Role, which allows a user to place a mailbox on In-Place Hold and Litigation Hold.

What is the Autodiscover for Office 365? ›

The Autodiscover record allows client computers to automatically find Exchange and configure the client properly. The MX record tells other mail systems where to send email for your domain.

What are the stages of eDiscovery? ›

The Six Step eDiscovery Process
  • Data Collection.
  • Data Transfer.
  • Data Processing.
  • Early Case Assessment.
  • Document Review and Exchange (Production)
  • Case Termination.
Oct 27, 2021

Why is eDiscovery expensive? ›

Your Time is Valuable

eDiscovery involves collecting and reviewing a significant amount of data, and it could take hours upon hours to complete this process manually, taking time away from other crucial work that needs to be done. When it comes to trial, a lawyer often needs to produce a document for court quickly.

What is eDiscovery in simple terms? ›

E-discovery is a form of digital investigation that attempts to find evidence in email, business communications and other data that could be used in litigation or criminal proceedings. The traditional discovery process is standard during litigation, but e-discovery is specific to digital evidence.

Why would you use eDiscovery? ›

It ensures the security of sensitive or private information while also easing the use of evidence in court, providing reliability and longevity across difficult cases. eDiscovery is a valid and useful resource to access electronically stored information (ESI) for the purpose of litigation.

What is the difference between Office 365 eDiscovery premium and standard? ›

eDiscovery (Premium) adds the following tabs: Data sources allows you to specify the users who might have relevant information about the case matter (these are called custodians). In standard eDiscovery case, they would be simply added to the Legal hold.

What is Microsoft Exchange eDiscovery export tool? ›

You can use the eDiscovery Export tool in the Exchange admin center (EAC) to export the results of an In-Place eDiscovery search to an Outlook Data File, which is also called a PST file. Search results will contain items from mailboxes and public folders, depending on the content sources from the eDiscovery search.

What is the difference between Office 365 E1 and E3? ›

E1 also includes email, file storage (OneDrive for Business), real-time collaboration (SharePoint), communication (Yammer) and instant messaging and online meetings (Teams). E3 Subscriptions include all the features in E1 with Microsoft Office apps available on desktop, web and mobile.

What license is required for eDiscovery? ›

License requirement for eDiscovery search

Organizations need a Microsoft 365 E3 license to access the core eDiscovery and E5 license to use the advanced eDiscovery tool.

Why is eDiscovery difficult in the cloud? ›

E-Discovery in the Cloud

Those IT challenges include: The need to collect, store, and manage large quantities of diverse data, along with its metadata and history. As much as 40% of enterprise data is created and stored outside of the enterprise network, such as on mobile devices and in cloud applications.

What does C's mean in eDiscovery? ›

The keywords in each row are connected by a logical operator (which is represented as c:s in the search query syntax) that is similar in functionality to the OR operator in the search query that's created. This means items that contain any keyword in any row are in the search results.

What is eDiscovery workflow? ›

Electronic discovery -- also called e-discovery or ediscovery -- is the process of obtaining and exchanging evidence in a legal case or investigation. E-discovery is used in the initial phases of litigation when involved parties are required to provide relevant records and evidence related to a case.

Can you run eDiscovery on a shared mailbox? ›

If you want to apply advanced features such as Microsoft Defender for Office 365, eDiscovery (Premium), or retention policies, the shared mailbox must be licensed for those features.

What is the difference between eDiscovery admin and manager? ›

The primary difference between an eDiscovery Manager and an eDiscovery Administrator is that an eDiscovery Administrator can access all cases that are listed on the eDiscovery cases page in the compliance portal. An eDiscovery manager can only access the cases they created or cases they are a member of.

What feature is included in M365 E5 but not E3? ›

Microsoft 365 E5 includes all the features in the E3 plan, with additional ones such as Advanced Threat Protection for security against business email compromise and PSTN conferencing to facilitate Skype for Business meetings.

What is the difference between EMS E3 and E5? ›

“What is the difference between EMS E3 and E5?” Enterprise Mobility Security E5 is an upgraded version of EMS E3, which includes all products offered by E3 along with some additional features. With E5, you can get the P2 versions of the Azure Active Directory, Azure Information Protection.

What is the difference between Office 365 E1 and F3? ›

One key difference between the Office 365 E1 and Microsoft 365 F3 plans is the inclusion of a 50GB Exchange Online mailbox and access to public folder mailboxes in the E1 plan, making it a more comprehensive solution for office workers who need more storage and collaboration capabilities.

Which role group need to be assigned manage in place eDiscovery? ›

If you want users to be able to use Exchange Server In-Place eDiscovery, you first need to add them to the Discovery Management role group. Members of the Discovery Management role group have Full Access mailbox permissions to the default discovery mailbox, which is called Discovery Search Mailbox.

Can you export to PST from Exchange Online? ›

Export mailbox items in PST file format

In the Exchange admin center, left-hand navigation pane, under compliance management, click the down-arrow icon (Export to a PST file), to export your search results to a PST file format.

How do I import a PST file into Exchange Online? ›

  1. Step 1: Copy the SAS URL and download AzCopy.
  2. Step 2: Upload your PST files to Microsoft 365.
  3. (Optional) Step 3: View a list of the PST files uploaded.
  4. Step 4: Create the PST Import mapping file.
  5. Step 5: Create a PST Import job.
  6. Step 6: Filter data and start the PST Import job.
Feb 21, 2023

How to export Office 365 mailboxes to PST files from Exchange Online? ›

Log in to your Microsoft 365 account and go to the Exchange Admin Center. Click Admin Center and then Security and Compliance. Use the Content Search eDiscovery tool to search and find the mailbox. On locating it, export it to a PST file.

What is the difference between Office 365 groups and SharePoint groups? ›

Microsoft 365 Groups give permission to all Microsoft 365 applications, including SharePoint Online (only 2 Groups: Owners and Members). SharePoint Groups give only permission to SharePoint content and the advantage is that the permissions are free configurable.

What is the difference between Office 365 group and SharePoint group? ›

An office 365 group encloses a sharepoint site collection, an inbox, a planner dashboard, a common calendar (in virtue of the inbox). The membership to this type of group is aligned to the membership to the underlying sharepoint site therefore a member of the group/inbox is also a member of the site.

What is the difference between m365 groups and security groups? ›

A Microsoft 365 group can have only users as its members, while a security group can have users, devices, groups and service principals as its members.

Can eDiscovery find deleted emails? ›

You can also use the GUI-based In-Place eDiscovery tool to find and export deleted items to a PST file. The user will use this PST file to restore the deleted messages to their mailbox.

What is mailbox search role in Exchange Online? ›

This management role enables administrators to search the content of one or more mailboxes in an organization. Mailbox Search is one of several built-in roles in the Role Based Access Control (RBAC) permissions model in Microsoft Exchange Online.

Does Exchange Online use autodiscover? ›

Exchange automatically creates at installation the virtual directory autodiscover in IIS, the frontend Client Access services web site that clients connect to. This allows Outlook to discover the Exchange mailbox settings so that users don't have to deal with manually configuring advanced settings.

How does autodiscover work in exchange? ›

The Exchange Autodiscover service provides an easy way for your client application to configure itself with minimal user input. Most users know their email address and password, and with those two pieces of information, you can retrieve all the other details you need to get up and running.

In which situations would Autodiscover be used? ›

Autodiscover is a service or feature that allows Outlook administrators to configure the user profile settings for Outlook 2007 and later. The advantage of this service is that it establishes the initial connections to Exchange user mailboxes, so users can access many features such as the offline address book.

What is Microsoft eDiscovery? ›

The Microsoft Purview eDiscovery (Premium) solution builds on the existing Microsoft eDiscovery and analytics capabilities. eDiscovery (Premium) provides an end-to-end workflow to preserve, collect, analyze, review, and export content that's responsive to your organization's internal and external investigations.

How does the eDiscovery process work? ›

eDiscovery processing prepares documents for review and production by extracting the relevant data and otherwise cleaning up the eDiscovery findings. It involves includes metadata extraction, cataloging and deduplication (ensuring that only one copy of each relevant document is presented).

What are the challenges in eDiscovery? ›

Ediscovery Collection Challenges

Think of whether discovery might involve recovering deleted data or collecting unique file types, and decide whether computer forensics specialists may need to be involved.

What is the role of eDiscovery Manager in Office 365? ›

eDiscovery Manager - An eDiscovery Manager can use eDiscovery search tools to search content locations in the organization, and perform various search-related actions such as preview and export search results.

Does Microsoft 365 business premium include eDiscovery? ›

With both the Microsoft 365 and Office 365 E3 subscriptions a user can be assigned the E3 license. With that license, the user may place eDiscovery holds on mailboxes and sites. Once your organization has the subscription and the related eDiscovery licensing, it is fairly simple to grant access to Core eDiscovery.

How do I prepare for eDiscovery? ›

Here are the steps you should take now:
  1. Know Where Your Data Is. Start by creating a detailed map of data within your company. ...
  2. Set Up an eDiscovery Team. ...
  3. Outline Procedures. ...
  4. Choose a Comprehensive Platform. ...
  5. Create a Consistent Review Team. ...
  6. Set Up a Document Repository.
Dec 8, 2020

How do I retrieve data from Microsoft Exchange? ›

Manual procedure to export email to Excel:
  1. Open MS Excel.
  2. Click on Data ->Get Data-> From Other Sources → From Microsoft Exchange.
  3. Input your Microsoft exchange server email address.
  4. Select Microsoft account tab and sign-in to your microsoft exchange server using your MS exchange server credentials and click on connect.
Jan 28, 2021

How do I install Microsoft eDiscovery export tool? ›

Install and run the eDiscovery Export Tool
  1. Select Download results on the flyout page of an export in Content Search or an eDiscovery case.
  2. You'll be prompted with a confirmation to launch the tool, select Open. If the eDiscovery Export Tool isn't installed, you'll be prompted with a Security Warning.
  3. Select Install.
Feb 21, 2023


1. 15 Office 365 Exchange Online Complience Management In Place eDiscovery & Hold Arabic by Remon Abu
(Remon Abuelezz)
2. Exchange Lecture 28:In place ediscovery and hold exchange 2016
3. 20345-2 Demo 13 Configuring In-Place eDiscovery
(Bryan OConnor)
4. Office 365 Labs – Exchange Online compliance features (In-Place Archive, In-Place Hold, eDiscovery)
5. Steps to Configure eDiscovery & In Place Hold in O365
(DigiSol IT Classes)
6. in place eDiscovery & hold
(Learning 365)
Top Articles
Latest Posts
Article information

Author: Zonia Mosciski DO

Last Updated: 02/07/2023

Views: 5385

Rating: 4 / 5 (51 voted)

Reviews: 90% of readers found this page helpful

Author information

Name: Zonia Mosciski DO

Birthday: 1996-05-16

Address: Suite 228 919 Deana Ford, Lake Meridithberg, NE 60017-4257

Phone: +2613987384138

Job: Chief Retail Officer

Hobby: Tai chi, Dowsing, Poi, Letterboxing, Watching movies, Video gaming, Singing

Introduction: My name is Zonia Mosciski DO, I am a enchanting, joyous, lovely, successful, hilarious, tender, outstanding person who loves writing and wants to share my knowledge and understanding with you.