How to export content from EXO, Teams, SharePoint and ODB from M365 tenant via eDiscovery and any other options as I have tried Standard, Premium and Content search under the eDiscovery in Purview but its not giving correct info upon searching with certa?

Question

How to export content from EXO, Teams, SharePoint and ODB from M365 tenant via eDiscovery and any other options as I have tried Standard, Premium and Content search under the eDiscovery in Purview but its not giving correct info upon searching with certain keywords?

How to do this and what are ways for us to export with keywords and get the relevant data only?

Answer 1

Hi @Mytoast Admin
To export content from Exchange Online, Teams, SharePoint, and OneDrive for Business in Microsoft 365, there are three main tools available in Microsoft Purview: Content Search, eDiscovery (Standard), and eDiscovery (Premium).

1. Content Search: A good starting point for simple searches across mailboxes, Teams, SharePoint, and OneDrive. Use Keyword Query Language (KQL) to improve precision. Note that Teams chats are stored in mailboxes, not in the Teams app directly.
2. eDiscovery (Standard): Supports case-based search and export, but lacks analytics and review capabilities.
3. eDiscovery (Premium): Best for complex scenarios. Provides review sets, tagging, redaction, near-duplicate detection, and more. Ideal for legal or compliance investigations.

Keyword Tips: Use quotes for exact phrases ("project X"), Boolean operators (AND, OR), date filters, and kind: (e.g., kind:email) to refine.

Exporting:

• EXO data: PST or individual messages
• SP/ODB: Native format + CSV reports
• Teams data: Found in Exchange (user/group mailboxes)

Permissions: Ensure you have roles like eDiscovery Manager, Export, and Content Search in the Microsoft Purview portal.

Many issues stem from how keywords are entered. Even small issues can lead to no or incorrect matches. Try your query in Content Search first with a single user or small location to debug the search behavior. Filter by file name, modification date, or document type, rather than keyword in file content.

I hope this information helps. Please do let us know if you have any further queries.

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.

Thank you.