How to do content search in Microsoft 365

The Microsoft 365 content search feature for Exchange Online helps you keep an eye on the content of emails sent and received. Though the Microsoft 365 Security & Compliance Center has this capability, it falls short in some areas.

For example, you can’t do pattern-based searches to identify credit card numbers, social security numbers, and other personally identifiable information that follow a regular pattern. You also cannot schedule automatic content searches; they need to be done manually every time.

How is M365 Security Plus a better option?

M365 Security Plus, a Microsoft 365 auditing, monitoring, alerting, and content search tool, helps you create schedules that run automatically at set intervals and sends email reports on the search performed. Additionally, you also have an instant search option for finding specific content across all mailboxes in your organization. It supports keyword-, attribute-, and pattern-based searches that save a substantial amount of time.

M365 Security Plus' mailbox content search allows you to:

• Search multiple mailboxes: Search across all or selected mailboxes in your Microsoft 365 setup in a single click.
• Perform condition-based searches: Set multiple conditions to filter out the emails you don’t need to view. Eg: Emails that have the term 'Free download' in the Subject and has attachments.
• Configure rule-based filters: Create rules to identify specific emails. Eg: Emails read by users with the term 'Free download' in the Subject and has attachments.

  

• Perform pattern-based searches: Use RegEx and commonly used phrases to identify emails with personal information.
• Automate searches: Create search profiles to look through mailboxes at specified intervals automatically.
• Create alerts: Configure detailed email alerts about automated search results.

Steps to perform search operation

To perform an instant search operation:

1. Login to M365 Security Plus, click the Auditing & Monitoring dropdown, and select Security & Protection.
2. Navigate to Content Search > Content Search Profiles > Mail Content Profiles > Instant Search.
3. Select the mailbox in which you want to perform the search operation.
4. You can set as many Search Criteria as required. Click the <+> icon to add more conditions. For the successive conditions, use the leftmost drop-down list to decide the logical operator (AND and OR) and define the way in which your search criteria is processed.
5. Click Search.

Steps to create a content search profile

If you want M365 Security Plus to perform a mailbox content search at regular intervals and share the search results via email, you need to create a search profile as given below.

1. Click the Settings tab and navigate to Configuration > Content Search Configuration > Content Search Profiles.
2. Click Add Profile.
3. Enter a suitable Profile Name.
4. Choose a Microsoft 365 Service from the drop-down.
5. Select the mailboxes in which you would like to perform the search.
6. Set your Search Criteria and Polling Interval.
7. Under Advanced Options, select the Email alerts corresponding to this profile check box.
8. Select a suitable Notification Template, File Format, and Time interval.
9. Select the Include event details check box if you want to receive a detailed note about the errors, if there are any.
10. Click Add.

Highlights of M365 Security Plus

• Schedule your search for content across all Microsoft 365 mailboxes in your organization
• Keep tabs on even the most granular user activities in your Microsoft 365 environment.
• Configure alert profiles in M365 Security Plus to notify you of specific activities that take place outside of business hours or occur at unusual frequencies.
• Delegate granular permissions to technicians without elevating their Microsoft 365 privileges and create custom roles with any combination of reporting, management, and auditing tasks.
• Monitor the health and performance of Microsoft 365 features and endpoints around the clock.