Mailbox Content Search

With this feature you can search for content across all or selected mailboxes in your organization. You can configure the search criteria based on keywords or patterns, and schedule the search to be run at specified intervals.

Steps to perform search operation

1. Go to the Auditing and Monitoring tab and click on Content Search.
2. In the Select Mailbox field, use to select a mailbox you need to search.
3. Set the Search Criteria. Using , you can set multiple conditions.
4. Click Search.

Steps to save a search operation

After performing a search operation,

1. Click on the Save as New Profile option seen above the results table.
2. Provide a Profile Name, and Polling Interval to automate this search.
3. Click Save.

Note: RestAPI should be enabled to use this feature.

Steps to create a search profile

1. Go to the Settings tab.
2. Navigate to Configuration → Content Search Configuration → Content Search profiles in the left pane.
3. Click on Add Profile and on the Add New Profile page.
4. Provide a Profile Name, Select Mailboxes, add one or multiple Search Criteria(s), and select a Polling Interval.
5. Click on Advanced Options, if you want to configure email notification.
6. Select the Email alerts corresponding to this profile check box.
7. Select the Notification Template using the option.
8. From the Notify On drop-down, select when the admin should be notified.
• New Mails - When a new email matching the search criteria is found.
• Moved Mails - When an existing email matching the search criteria is moved from one parent folder to another parent folder.
• Deleted Mails - When an email matching the search criteria is deleted.

From the File Format dropdown, choose the file format for the attachment. It can be mailed as a CSV, HTML, PDF or XLSX file.

9. Choose the Include Event Details option, if the details on the result must also be included in the email.
10. Click Add.

Note: Azure China tenants can set alerts only for new emails as they do not support delta query for Microsoft Graph API.

Steps to Enable/Disable a Search Profile

1. Go to the Settings tab.
2. Navigate to Configuration → Content Search Configuration → Content Search profiles in the left pane.
3. Select the Microsoft 365 Tenant.
4. Click on the icon under the Actions column corresponding to the profile you need to enable. (Click on to disable).

Note: To enable/disable all the profiles in a single click: Select the check box in the top row to select all the profiles, and select Manage → Enable/Disable.

Modify a Search Profile

1. Go to the Settings tab.
2. Navigate to Configuration → Content Search Configuration → Content Search profiles in the left pane.
3. Select the Microsoft 365 Tenant.
4. Select the icon under the Actions column corresponding to the profile you need to edit.
5. Modify the fields you want.
6. Click Update.

A Confirm Action pop-up will appear. Click Yes if you want to modify the Search Profile.

Delete a Search Profile

1. Go to the Settings tab.
2. Navigate to Configuration → Content Search Configuration → Content Search profiles in the left pane.
3. Select the Microsoft 365 Tenant.
4. Select the icon under the Actions column corresponding to the profile you need to delete.
5. Select Yes in the pop-up that appears.

Note: To delete all the profiles in a single click: Select the check box in the top row to select all the profiles, and select Manage → Delete.