Create a New Multi-Mailbox Search

  • Article

Applies to: Office 365 for enterprises, Live@edu

You create a new mailbox search by using the Exchange Control Panel. To search mailboxes and access the default discovery mailbox where search results are stored, you must be a member of the Discovery Management role group.

This topic explains the following:

  • Create and run a multi-mailbox search
  • What happens after you start the search?
  • View the search results
  1. Select Manage My Organization > Mail Control > Discovery > New.
  2. In the Keywords section, type the search query string. It consists of one or more keywords. You can use basic Boolean operators or Advance Query Syntax (AQS).
    • For a basic Boolean search, separate words with uppercase AND, OR, or NOT.
    • For any key words or clauses separated by AND, use parentheses around the clause. For example:
      (WordA AND WordB) OR WordC OR WordD
      (WordA OR WordB) AND (WordC OR WordD)
    • For multi-word phrases, use double quotation marks.
    • For wildcard searches, put an asterisk ( * ) after the word. Don't use an asterisk at the beginning or in the middle of words
      For more information, see Advanced Keyword Searches.
  3. To include messages that have attachments that are encrypted or have an unknown format, select Include items that can't be searched. For more information, see:
  4. To specify message types to search, click Select message types, and then select one of the following options:
    • Search all message types including ones that may not be listed below   Use this option to search any message type that may be in users' mailboxes. This includes message types that are affiliated with third-party messaging programs used by your organization.
    • Select the message types to search   Select one or more of the following message types: E-mail, meetings, tasks, notes, documents, journal, contacts, and instant messaging conversations. For more information, see Message Types for Multi-Mailbox Search.
  5. Click OK. If you don't specify which message types to search, only e-mail messages are searched.
  6. Expand the Messages To or From Specific E-Mail Addresses section. The fields in this section are optional. You can use them to narrow the scope of the search by specifying the sender or recipient of messages. In the following fields, you can use e-mail addresses, display names, or the name of a domain to search for items sent to or from anyone in the domain. For example, to find e-mail sent by anyone at Contoso University, type @contoso.edu in the From field.
    1. In the From field, specify the people who sent the e-mail messages that you want to search for. Separate multiple entries with a comma.
    2. In the To (including Cc and Bcc) field, specify the people who receive the e-mail message that you want to search for. Separate multiple entries with a comma.
  7. Expand the Date Range section.
    • Don't limit the search by date range   Selecting this option will search all messages, regardless of when they were sent. This is the default setting.
    • Limit the search by the following date range   Select the start date, end date, or both to search for e-mail sent during a specific date range. If you leave the end date undefined, the search will find the latest results every time that you restart it.
  8. Expand the Mailboxes to Search section. You must select one of the following settings to specify which mailboxes to search:
    • Search all mailboxes   If you select this option, you can also use the Message To or From Specific E-Mail Addresses section to narrow the scope of the search. If you specify people in the Message To or From Specific E-Mail Addresses section, the search will search all mailboxes but only find the e-mail messages that are sent to or from specific people and that meet the keyword criteria.
    • Search specific mailboxes or the mailboxes of members of distribution groups   If you select this option, click Add to display a list of the mailboxes and groups in your organization that you can search. The mailboxes and groups that you select are displayed in the list in this section.
      If you add a group to the list of mailboxes to search, the mailboxes of the current group members will be searched.
      Note   The Recoverable Items folder in a user’s mailbox is searched by default. If the user’s archive mailbox is enabled, it’s also included in the search.
  9. Expand the Search Name, Type, and Storage Location section. Configure the following settings:
    • *** ** Search name   This is used to name the search in the search list displayed in the Multi-Mailbox Search list. It is also used to name the folder in the mailbox where the search results are stored. This folder resides at the root level and contains the search log and the search. The search results are copies of the message types that are specified in the search. If no search results are found, the folder will be empty.
    • *** ** Results   Select one of the following search types:
      • Estimate the search results   This search type estimates how many hits meet the search criteria but it doesn't copy the results to the destination mailbox. Copying a large number of results can take a long time, so this option lets you quickly determine whether you need to refine the search criteria to narrow the results.
      • Copy the search results to the destination mailbox   This search type also displays the search estimates in the details pane, but it copies the results to the destination mailbox.
      If you choose to copy the search results, configure the following settings:
      • Enable deduplication    If you select this option a single copy of a message that meets the search criteria is copied to the folder where search results are stored. If you don't select this option, one copy of the message is saved in the subfolder for each mailbox in which the copy was found.
      Note   If you enable full logging, the CSV file that is attached to the search log contains an entry for each instance of a duplicate and identifies the source mailbox. This lets you identify all mailboxes that contain a duplicate message.
      • Enable full logging   If you don't select this check box, basic logging is used for the search. Basic logging includes information about the search and who performed it. This information appears in the body of an e-mail message that is sent to the mailbox where the search results are stored. This message and the results of the search are located in the folder that is named with the mailbox search name.
      Full logging includes information about all results that meet the search criteria. This information is contained in a CSV file that is attached to the search log that contains the basic logging information. For more information, see Multi-Mailbox Search Logging.
      • Select a mailbox in which to store the search results   Click Browse to select the destination mailbox to store the search results in. Search results can only be stored in a special mailbox type, which is called a discovery mailbox; so only discovery mailboxes are displayed in the list. For more information, see Select a Mailbox to Store Search Results.
    • **Send me an e-mail when the search is done   **For both search types, you can have a status e-mail message sent after the search is done running. This option is convenient if you have to search lots of mailboxes, expect a large number of search results, or have a long and complex query. This message contains information about the search results.
  10. When you're finished, review all the settings to verify the search parameters, and make sure that all required information is provided. Then click Save.
    The new mailbox search starts and is displayed in the Multi-Mailbox Search list. The status of the search is set to Estimate in progress or Search in progress, depending on the search type.

After the search starts, click Refresh to update the search status and the information in the details pane. When the search is finished, the status is reset, based on the outcome of the search. For both search types, information about the search is displayed in the details pane. This includes the search name, the date it ran and who ran it, the size of the search results, and the total number of items found. The details pane also includes the keyword statistics, which displays the total number of hits for each keyword in the query and the number of mailboxes these hits were found in.

If none of the search criteria are met, the search may have a status of Succeeded but return no results. When no search results are found, the size of the search results is displayed as zero, the number of items found is zero, and no keyword statistics are displayed.

View the search results

The search results vary depending on the type of search you run. For more information, see View Multi-Mailbox Search Results.

You can export multi-mailbox search results to an Outlook Data File (.pst). This lets you view and print the search results in Microsoft Office Outlook, or send them to other people. For more information, see Export Multi-Mailbox Search Results to an Outlook Data File (.pst).

For estimate-only searches

Because the search results aren't copied in an estimate-only search, the information in the details pane is the only results generated by the search. You can view these estimates in the details pane or in the optional e-mail message that is sent to you when the search is done running.

For search results copied to the destination mailbox

To view the search results for a search where the results were copied to the destination mailbox, in the Results field of the details pane, click Open. This opens the discovery mailbox where the mailbox search results are stored. The search log and search results are located in a folder with the search name.

The content and organization of search results are different depending on whether you enable deduplication or save all copies:

  • When deduplication is enabled and you save one copy, search results are copied to a sub-folder named Results <date and time>. There is no other sub-folder structure.
  • When deduplication isn't enabled and you save duplicate copies, each copy is saved in a subfolder for the mailbox in which it was found. These subfolders reside in the folder where the results of the search are stored in the destination mailbox.

Top of page