Go to https://compliance.microsoft.com and sign in using the credentials for user account that has been assigned the appropriate eDiscovery permissions and is a member of the case.
In the left navigation pane of the Microsoft 365 compliance center, click Show all, and then click eDiscovery > Core.
On the Core eDiscovery page, select the case that you want to create an associated search, and then click Open case.
On the Home page for the case, click the Searches tab, and then click New search.
- In the New search wizard, type a name for the search, and an optional description that helps identify the search. The name of the search must be unique in your organization.
- On the Locationspage, choose the content locations that you want to search. You can search mailboxes, sites, and public folders.
Exchange mailboxes: Set the toggle to On and then click Choose users, groups, or teams to specify the mailboxes to place on hold. Use the search box to find user mailboxes and distribution groups (to place a hold on the mailboxes of group members) to place on hold.
On the Define your search conditions page, type a keyword query and add conditions to the search query if necessary. > If you need the completed mailbox proceed without any condition
Review the search settings (and edit if necessary), and then submit the search to start it.
After the search is completed, you can preview the search results. If necessary, click Refresh on the Searches page to display the search you created.
Export search results
Go to https://compliance.microsoft.com and sign in using the credentials for user account that has been assigned the appropriate eDiscovery permissions.
In the left navigation pane of the Microsoft 365 compliance center, click Show all, and then click eDiscovery > Core.
On the Core eDiscovery page, click the name of the case that you want to create the hold in.
On the Home page for the case, click the Searches tab.
On the Actions menu at the bottom of the flyout page, click Export results.
The workflow to export the results of a search associated with a Core eDiscovery case is that same as exporting the search results for a search on the Content search page. For step-by-step instructions, see Export content search results.
Note
When you export search results, you have the option to enable de-duplication so that only one copy of an email message is exported even though multiple instances of the same message might have been found in the mailboxes that were searched. For more information about de-duplication and how duplicate items are identified, see De-duplication in eDiscovery search results.
After you start the export, the search results are prepared for downloading, which means they are transferred to a Microsoft-provided Azure Storage location in the Microsoft cloud.
Click the Exports tab in the case to display the list of export jobs.
You may have to click Refresh to update the list of export jobs so that it shows the export job you created. Export jobs have the same name as the corresponding search with _Export appended to the search name.
Click the export job you created to display status information on the flyout page. This information includes the percentage of items that have been transferred to the Azure Storage location.
After all items have been transferred, click Download results to download the search results to your local computer. For more information downloading search results, see Step 2 in Export content search results
Download the search results
The next step is to download the search results from the Azure Storage location to your local computer.
1. On the Content search page in the Microsoft 365 compliance center, select the Exports tab
You may have to click Refresh to update the list of export jobs so that it shows the export job you created. Export jobs have the same name as the corresponding search with _Export appended to the search name.
2. Select the export job that you created in Step 1.
3. On the flyout page under Export key, click Copy to clipboard. You use this key in step 6 to download the search results.
Important
Because anyone can install and start the eDiscovery Export tool, and then use this key to download the search results, be sure to take precautions to protect this key just like you would protect passwords or other security-related information.
4. At the top of the flyout page, click Download results.
5. If you're prompted to install the eDiscovery Export Tool, click Install.
6. In the eDiscovery Export Tool, do the following:
a. Paste the export key that you copied in step 3 in the appropriate box.
b. Click Browse to specify the location where you want to download the search result files.
Important
Due to high network activity during download, you should download search results only to a location on an internal drive on your local computer. For the best download experience, follow these guidelines:
Don't download search results to a UNC path, a mapped network drive, an external USB drive, or a synched OneDrive for Business account.
Disable anti-virus scanning for the folder that you download the search result to.
Download search results to different folders for concurrent download jobs.
7. Click Start to download the search results to your computer.
The eDiscovery Export Tool displays status information about the export process, including an estimate of the number (and size) of the remaining items to be downloaded. When the export process is complete, you can access the files in the location where they were downloaded.
For more details you can refer
