Export search results in eDiscovery (preview)

After a search associated with a Discovery (preview) case is successfully run, you can export the search results. When you export search results, mailbox items are downloaded in PST files or as individual messages. When you export content from SharePoint and OneDrive sites, copies of native Office documents and other documents are exported. When you export items, the items are prepared for download depending on the export options that you define. You can monitor the export's progress and download the results from the Process manager page. Larger exports might take longer to complete.

Tip

Get started with Microsoft Copilot for Security to explore new ways to work smarter and faster using the power of AI. Learn more about Microsoft Copilot for Security in Microsoft Purview.

Export search results

Tip

Do you prefer an interactive configuration guide experience? Check out the Export data guide.

To export search results, complete the following steps:

1. Go to the Microsoft Purview portal and sign in using the credentials for a user account assigned eDiscovery permissions.

2. Select the eDiscovery solution card and then select Cases.

3. Select a case, then select the Searches tab. Select a search query to export.

4. In the search query, select Export.

5. On the Export flyout pane, configure export options.

6. Enter a name for the export in Export name. This field is required.

7. In Export description, enter an optional description for the export.

8. In the Select items to include in your export, select one of the following options:

   • Indexed items that match your search query
   • Indexed items that match your search query and partially indexed items that may not match query
   • Partially indexed items that may not match query

9. In the OneDrive and SharePoint items section, select from the following document options:

   • Select document versions Specify how many versions of SharePoint documents to export. Values are Latest version only, Recent 10 versions, Recent 100 versions, All versions.
   • Select folder items: Export items inside subfolders of a matched folder. Choose Only include items that match search query or All items in folder (even if they don't match search query).
   • Select items in lists and attachments (list expansion): Export files attached to SharePoint lists and their child items. Choose Only list items that match search query or All items in SharePoint list if any item matches search query. If applicable, select Include list attachments.

10. In the Messages and related items from mailboxes and Exchange Online section, select one or more of the following options:

    • Include Teams and Yammer conversations: Collect up to 12 hours of related conversations when a message matches a search.

    • Organize conversation into HTML transcript: Contextual chat messages are threaded into HTML transcripts for ease of review and handling.

    • Access links (cloud attachments) in messages: Collect items from links to SharePoint or OneDrive

      Important

      Including cloud attachments increases the size and quantity of your exported results.

    • Select a version for access links. Values are Latest version only, Recent 10 versions, Recent 100 versions, All versions.

      Important

      If you have versions as shared feature enabled, this retrieves the version of the document when it was shared.

11. In the Export type section, choose one of the following options:

    • Export items report only
    • Export items only
    • Export items with items report

12. In the Export format section, choose one of the following options:

    • Create PSTs for messages
    • Create .msg files for messages
    • Create .eml files for messages

13. Select one or more of the following output package options:

    • Organize data from different locations into separate folders or PSTs
    • Include folder and path of the source
    • Condense paths to fit within 256 characters
    • Give each item a friendly name

14. Select Export.

15. When your export process is started, a confirmation dialog is displayed. Select OK to continue.

View the export process status

To view the progress of the export in the Process manager, select Process manager and the Export process to track the process status and to download export packages.

The Overview tab shows a progress bar that displays the current status, number of locations, and number of items for the export. An estimated completion and current elapsed time are displayed in hours, minutes, and seconds. The Overview tab also contains the following export information:

• Name: The name of the export.
• Completed: The UTC date and time the export process was completed.
• Duration: The duration of the export process.
• Status: The current status of the export process.
• Process type: The Export process type value is displayed.
• Created: The UTC date and time the export was created.
• Created by: The user that created the export.

The Settings tab displays a summary of the export options you selected for the export process.

Export packages

After the export process is complete, export packages are available to download. The export packages are listed in the Export packages section on the Overview tab and include the package name and size. To download a package, select the package and select Download packages.