How to Do a Content Search in Office 365? A Detailed Guide

The classic Content search is about to retire soon. So, admins, investigators, and other stakeholders must retune their skills according to the new Microsoft Purview portal. Hence, I have created this guide to give you step-by-step instructions on how to do a content search in Office 365 using all the new parameters.

I will cover everything from what it is, where you will find it, who can perform it, and how you will run it.

So, let us start with a brief description and continue from there.

Table of Contents

• What is Content Search in Office 365, & How Is It Different From eDiscovery?
• Which Role Group Do I Need to Be Part of to Trigger a New Content Search?
• How to Perform Content Search the Classic Way in Microsoft 365?
• How to Perform a Content Search in Office 365 Using PowerShell?
• Conduct A New Content Search in Microsoft Purview Step by Step
• The Right Way to Save the Content Search Data Locally
• Conclusion

What is Content Search in Office 365, & How Is It Different From eDiscovery?

Content Search is a specialized tool in the Microsoft 365 Purview portal that allows admins and other authorized entities to find relevant information present in various Microsoft 365 services.

It is like a custom search engine for organizational data that can be designed for controlled export of data.

Content Search is an integral part of the broader eDiscovery mechanism. It plays a vital role in maintaining compliance, often working alongside policies like those for data loss prevention in Office 365 and addressing legal scenarios involving inter-employee email communication, data stored in OneDrive, and other relevant required information.

The major difference between eDiscovery and Content search is that in content search, we do not keep the result in hold.

Not everyone in the organization can access the eDiscovery / Content search feature. They must have specific roles assigned to them, so let us see what those roles are.

Which Role Group Do I Need to Be Part of to Trigger a New Content Search?

The primary role groups explicitly equipped to both perform Content Searches and get the results (preview/export) based on their default assigned roles are:

• eDiscovery Manager
• Data Investigator

More roles like Organization Management, Compliance Administrator, Compliance Data Administrator, and Security Operator can all initiate Content Searches. However, as they can’t export the results, it is not recommended to use these types of accounts.

How to Perform Content Search the Classic Way in Microsoft 365?

You will see that the steps to create and run a classic version of content search remain largely the same.

• On the Microsoft Purview portal page, you can see a Classic eDiscovery dropdown. (At left in the left navigation menu.)
• Expand Classic eDiscovery in the left navigation menu.
• Click Content Search under Classic eDiscovery.
• Click the + New search button.
• Enter Test Search Classic in the Name field.
• Enter Optional in the Description field.
• Click Next.
• Turn on the toggles for Exchange mailboxes to download all Office 365 online emails, SharePoint sites to get site data, and Exchange public folders.
• Click Next.
• Enter terms in the Keywords field.
• Click Next.
• Review the settings and click Submit.
• Click Done on the confirmation screen

How to Perform a Content Search in Office 365 Using PowerShell?

Use the account with any one of the following roles:

• Global Admin
• eDiscovery Manager
• eDiscovery Admin

Also, ensure that the account(s) on which you are performing the Content Search have the ‘Mail Recipients’ role assigned in Exchange Online.

You should also disconnect any existing remote PowerShell sessions.

To do that, use

Get-PSSession | Remove-PSSession; Disconnect-ExchangeOnline.

• Go to the official Microsoft page to get the sample scripts
• Save the script text as a .ps1 file (e.g., GetFolderSearchParameters.ps1).
• Open Windows PowerShell on your local computer.
• Navigate (change directory) to the folder where you saved the script file.
• Run the script using its filename (e.g., .\GetFolderSearchParameters.ps1).
• Enter the requested email address/site URL and your credentials when prompted by the script.
• Then, wait for it to show the results.

Conduct A New Content Search in Microsoft Purview Step by Step

Step 1. Log in to the Microsoft Purview portal(with the correct account)

Step 2. Use the sidebar to select Solutions > and in the fly-out menu, select eDiscovery.

Note: If you have used the eDiscovery feature before, you may see a shortcut icon on the sidebar itself.

Step 3. In the eDiscovery page, click on the Content Search option under the Cases.

Step 4. Then, select Create a search.

Step 5. Enter a unique name and optional description for the search, then Press Create.

Step 6. Inside the Data sources section, click either on the + icon > Add data sources or press the Add sources button directly to choose the content locations to search: you can include people, groups, sites, OneDrive, and Teams using name, alias, email, GUID, or URL. Remember to separate multiple entries with commas.

• On the Conditions page, configure your search query:
• Enter keywords (use Boolean operators like AND, OR, NOT if needed).
• Leave blank to find all content in selected locations.
• Optionally, use the keyword list (max 20 rows) for OR logic between keywords.
• Add conditions to narrow results (these are combined with keywords using AND logic).

• Then, click on the Run Query button.
• Toggle the Statistics radio button and mark the checkboxes next to all of the underlying options you wish to include in this content search.
• Finally, press the run query.

Once the processing part is done, you will see the results in the pane itself. Then, you can make a report for the search, review the sample files on the portal itself, or export the complete result for further analysis. However, while exporting these results, you might face technical issues and errors, which can take hours to fix. Switch to the modern way of exporting using a reliable yet effective software.

The Right Way to Save the Content Search Data Locally

You can easily export Office 365 data to PST or other file formats with the help of the SysTools Office 365 Export tool. It allows you to download Office 365 emails, along with contacts, calendar, and documents, in their native file formats. Download the free demo today!

Free Download Purchase Now

Associated Software Steps for Export – 

• Step 1. Install and run the software on a PC.
• Step 2. Choose the source and destination as Office 365 and Outlook.
• Step 3. Enable the required mailbox attributes such as emails, contacts, etc. Apply date filter if required.
• Step 4. Provide source admin credentials to log in and validate the destination.
• Step 5. Choose accounts to export and click on Start Export.

Conclusion

Now that you know how to do a content search in Office 365 yourself, I hope you will be able to get the data you are looking for. You can use a variety of ways to perform a search: which includes the new GUI web Purview portal and PowerShell commands. For the time being, you still have access to the classic version as well, but it is scheduled to retire in August 2025, so hurry up if you prefer that version.