John Yassa's Blog

Home » Microsoft Office 365 » How to do In-place eDiscovery in new O365?

How to do In-place eDiscovery in new O365?

In this post we will also  describe how we can do eDiscovery in new Office 365

1- Log on to with O365 Administrator credentials

2- At the tabs at the top hit on Admin and select Exchange


3- In Exchange admin center select Permissions > admin roles

                        Double click Discovery Management
Under Roles Click on Add and Select Mailbox Import Export
Under Member, Add yourself as a Member and Click Save. 



4- Now click on compliance management and select in-place eDiscovery & hold


5- Now you can start creating search request as below


6- Select the mailboxes you want to search


7- In the next screen if options are greyed out as below it means you do not have proper permissions. Revisit the step for adding permissions. If proper permissions have been added sign out and sign in back



8- In the filed provide the text you want to search. You can use Boolean expression like OR and AND to make robust query

9- Once you have specified the search attributes hit on Next

10- You can do a in place hold of the search items.(Note, this option will be greyed out if you have selected all mailboxes during the mailbox selection process) and hit on finish


11- You can estimate the result search or you can export the results to PST , below we will show how to export the result as PST


12- After pressing the export button , you will find some application running on your local laptop


13- Fill in the the location of the PST and then press on Start



14- Fill in your your Office 365 admin user and press on OK


15- Press close and browse to the location of the exported files , you should see 3 files (TEXT – Excel – PST ) as below



This PST contain the result of the search

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: