3.5.2. Content Search in eDiscovery

💡 First Principle: Some investigation questions are about content rather than activity: where else does this phishing message sit? Which mailboxes received the leaked document? Is the stolen data set anywhere else in the tenant? Content search answers them by querying the indexed content of mailboxes, sites, and chats with keywords and conditions.

Content search lives in Microsoft Purview eDiscovery. Classic eDiscovery experiences retired in August 2025; in the current experience, searches are created inside eDiscovery cases (a default content search case is available). A search has three parts:

• Data sources: Exchange mailboxes (including mailboxes behind Teams and Microsoft 365 Groups), SharePoint sites, OneDrive accounts, and Teams. You can target specific users, groups, or sites, or search everything.
• Query: a keyword query language (KQL, the Keyword Query Language, not Kusto) expression with Boolean operators (AND, OR, NOT, NEAR) and property restrictions such as subject:, from:, sent>=, filename:, plus a keyword list that reports per-keyword statistics.
• Conditions: properties such as date ranges, senders, file types, and message kinds, combined with the query using AND logic.

After running, a search reports statistics (item counts and the locations with the most hits), supports preview, and can export results for analysis. For security incidents, the classic follow-on is a purge: using Security & Compliance PowerShell, New-ComplianceSearchAction -Purge -PurgeType SoftDelete or HardDelete removes matched email from mailboxes (up to 10 items per mailbox per action, across at most 50,000 mailboxes per search). The procedure works in any tenant, but only on Exchange Online mailboxes and public folders, and it needs Exchange Online PowerShell module 3.9.0 or later connected with Connect-IPPSSession -EnableSearchOnlySession. Tenants with Defender for Office 365 Plan 2 should remediate through Threat Explorer (3.2.1) instead, which can act on any delivered message, malicious or not, and the Purview portal's new eDiscovery experience and Data Security Investigations offer purge workflows. Searching needs eDiscovery Manager (or Compliance Search); purging needs Search And Purge, and keeping the two roles separate means no one person can both find and destroy evidence.

Permissions: running searches and exporting requires the eDiscovery Manager role group (or equivalent roles); purging requires the Search And Purge role. Searches can't reach on-premises mailboxes in hybrid deployments.

⚠️ Exam Trap: "Find every mailbox that contains a confidential spreadsheet emailed outside the company last week" is Content search (query by file name or content and date). "Find who opened that spreadsheet in SharePoint" is the audit log. The two answer different questions and are frequently offered as distractors for each other.

Reflection Question: Why does Microsoft separate the permission to search content from the permission to purge it? What risk would combining them create?