Multi-Mailbox Searches

  • Article

Applies to: Office 365 for enterprises, Live@edu

Use Multi-Mailbox Search in the Exchange Control Panel to search the mailboxes in your organization for e-mail and other message types that contain specific keywords. You can estimate the search results or copy them to a mailbox that you have specified so that you can review, organize, and export them if necessary. Discovery searches users' primary mailbox and archive mailbox.

To search mailboxes, you must be a member of the Discovery Management role group. To learn how to do this, see Give Users Access to Multi-Mailbox Search. For more information about role groups, see Administrator Role Groups in Exchange Online.

What can you use Multi-Mailbox Search for?

Multi-Mailbox Search is an efficient way to search for e-mail messages and other electronic communication sent and received by people in your organization, and to manage the results of the search.

For example, a legal case may require copies of relevant electronic communication or documents that have been sent or received by people in your organization. Searching for documents and exchanging them with opposing legal counsel before a trial is known as legal discovery. Multi-Mailbox Search can make preparation for legal discovery a lot easier.

In schools or businesses, a messaging administrator or compliance officer might be asked to search for e-mail messages that contain inappropriate content. Collecting this information frequently involves searching through large volumes of e-mail that are located in mailboxes throughout an organization. By using Multi-Mailbox Search, you can perform such searches more efficiently.

Administrators can use Multi-Mailbox Search to find and recover messages that users have accidently or maliciously purged from their mailbox. Administrators can also use the search functionality to search for and delete inappropriate or potentially harmful e-mail messages sent to multiple mailboxes across their organization. For more information, see the following:

The Recoverable Items folder

During a multi-mailbox search, the Recoverable Items folder is searched by default. The Recoverable Items folder, called the dumpster in previous versions of Microsoft Exchange, retains items that are permanently deleted by the user. The retention period for items is 14 days. When the retention period for an item expires, the item is permanently removed from Exchange Online. For more information about the Recoverable Items folder, see:

In the Exchange Control Panel, select Manage My Organization > Mail Control > Discovery > New. A mailbox search consists of the following components:

  • Keywords   Use basic Boolean operators to search for e-mail messages that contain keywords. You can also build more complex search queries by using Advanced Query Syntax (AQS). This lets you to narrow the scope by searching for keywords in specific components of an e-mail message, such as the subject line, To: and From: fields, message body, or attachments. For more information, see Advanced Keyword Searches.
  • **Include items that can't be searched   **You can include items in the search results that can't be indexed for a mailbox search in the search results. This includes unrecognized message types and messages that contain attachments that are encrypted or have an unrecognized format. For more information, see Include Unsearchable Items in the Search Results.
  • Select message types…   In addition to e-mail messages, you can search for keywords in other message types, such as meetings, documents, tasks, and instant messaging conversations.
  • Messages To or From Specific E-Mail Addresses   Narrow the scope of the search by searching for messages sent or received by specific people only. You can also search for messages to or from any person in a specific domain.
  • Date Range   Specify a date range when the messages that you want to find were sent or received.
  • Mailboxes to Search   You select exactly which mailboxes you want to search. You can also search the mailboxes of members of a group.
    Note As previously mentioned, the Recoverable Items folder in a user’s mailbox is searched by default. If the user’s archive mailbox is enabled, it’s also included in the search.
  • Search Name, Type, and Storage Location   There are two types of searches:
    • Estimate the search results   This search type estimates how many hits meet the search criteria but it doesn't copy the results to the mailbox where the search results are stored. This lets you quickly determine whether you need to refine the search criteria to narrow the results.
    • Copy the search results   This search type also displays the search estimates in the details pane, but it copies the results to a destination mailbox. For searches that have a large number of hits, this can take a long time.
      Search results consist of copies of the message types that meet the search criteria. They are stored in a folder in the destination mailbox that is named with the search name you provide and are organized in subfolders for each user mailbox that contains results that meet the search criteria.
      You also have the option to save only one copy of duplicate messages in the search results. This is called deduplication. If you don't select this option, one copy for each mailbox that contains the message is saved.

How do you review the search results?

When the search is finished, use Microsoft Outlook or Outlook Web App to access the mailbox where the search results are stored, and review, organize, and export the search results. For more information, see: