Export search results in eDiscovery

After you run a search associated with an eDiscovery (preview) case, you can export the search results. When you export search results, you download mailbox items in PST files or as individual messages. When you export content from SharePoint and OneDrive sites, you export copies of native Office documents and other documents. When you export items, you prepare the items for download depending on the export options that you define. You can monitor the export's progress and download the results from the Process manager page. Larger exports might take longer to complete.

To learn more about new eDiscovery export enhancements and the retirement of the Microsoft Office 365 eDiscovery Export Tool, check out the following video:

Export search results

To export search results, complete the following steps:

1. Go to the Microsoft Purview portal and sign in with the credentials for a user account assigned eDiscovery permissions.

2. Select the eDiscovery solution card, then select Cases.

3. Select a case, then select the Searches tab. Select a search query to export.

4. In the search query, select Export.

5. On the Export flyout pane, configure export options.

6. Enter a name for the export in Export name. This field is required.

7. In Export description, enter an optional description for the export.

8. In Tenant-wide source configuration options, configure the organization-wide source "All people and groups" to include one or more user or content types:

   • "All people and groups" should include unlicensed and on-premises users
   • "All people and groups" should include guest users
   • "All people and groups" should include shared Teams channels
   • "All people and groups" should include departed users

9. In the Select items to include in your export, select one of the following options:

   • Indexed items that match your search query: This option exports only the indexed items that matched the query.

   • Indexed items that match your search query and partially indexed items that might not match query: This option exports only the indexed items that matched the query and the partially indexed or unindexed items that might not completely match the query.

   • Partially indexed items that might not match query: This option exports only the partially indexed or unindexed items that might not completely match the query.

     For these options including partially indexed items, you can scope the partially indexed items further by selecting Exclude partially indexed items in locations without search hits. With this option selected, only partially indexed items from ___location where there is already an indexed hit are returned. Additionally, you can use the option to perform advanced indexing on partially indexed items. Learn more about advanced indexing in eDiscovery.

10. In the OneDrive and SharePoint items section, select from the following document options:

    • Select document versions: Specify how many versions of SharePoint documents to export. Values are Latest version only, Recent 10 versions, Recent 100 versions, All versions.
    • Select folder items: Export items inside subfolders of a matched folder. Choose Only include items that match search query or All items in folder (even if they don't match search query).
    • Select items in lists and attachments (list expansion): Export files attached to SharePoint lists and their child items. Choose All items in SharePoint list if any item matches search query. If applicable, select Include list attachments.

11. In the Messages and related items from mailboxes and Exchange Online section, select one or more of the following options:

    • Organize conversation into HTML transcript: Contextual chat messages are threaded into HTML transcripts for ease of review and handling.

    • Include Teams and Viva Engage conversations: Include messages posted within a 12-hour window before and after each responsive item.

    • Access links (cloud attachments) in messages: Collect items from links to SharePoint or OneDrive.

      Important

      Including cloud attachments increases the size and quantity of your exported results.

      When searching for emails or other mailbox content that might include cloud attachments, the cloud attachment link to a storage ___location in SharePoint or OneDrive should be considered as attachments of the message file rather than separate documents.

      This behavior is similar to how a search returns emails with embedded local attachments, these attachments are retrieved as if they're part of the emails. Any compliance boundaries for SharePoint or OneDrive aren't reflected in the collection of cloud attachments included in responsive messages.

    • Select a version for access links. Values are Latest version only, Recent 10 versions, Recent 100 versions, All versions.

      Important

      If you have versions as shared feature enabled, this retrieves the version of the document when it was shared.

12. In the Export type section, choose one of the following options:

    • Export items report only: Only the summary and item report are created. The various options for organizing data, folder and path structure, condensing paths, and other structures are hidden.
    • Export items with items report: Items are exported with the item report. Other export format options are available with this option in the Export format section.

13. In the Export format section, choose one of the following options:

    • Create PSTs for messages: This option creates .pst files for messages.
    • Create .msg files for messages: This option creates .msg files for messages.

14. In the Package size settings section, configure the maximum export package size the export process creates.

    1. If you select Create PSTs for messages in the previous step, set the maximum PST package size to 1 GB, 2 GB, 5 GB (default), or 10 GB.
    2. Set the maximum .zip package size to 2 GB, 10 GB (default), 20 GB, or 40 GB. The maximum .zip package size needs to be the same or greater than the maximum PST package size to contain the PST files in .zip packages when downloaded.

15. Select one or more of the following output package options. For details for each option, see Export package options.

    • Organize data from different locations into separate folders or PSTs: This option organizes data into separate folders for each data ___location. When exporting mailbox content, items from the primary mailbox and any associated archive mailboxes (including multiple archives) merge into a single PST file, even if this export option is selected.
    • Include folder and path of the source: This option includes the original folder and folder path structure for items.
    • Condense paths to fit within 256 characters: This option condenses the folder path for each item to 256 characters or less.
    • Give each item a friendly name: This option creates a friendly name for each item.

16. Select Export.

17. When the export process starts, a confirmation dialog appears. Select OK to continue.

For more information about export files types and item.csv report fields, see Document metadata fields in eDiscovery.

Export package options

The export package options control how content is packaged in downloadable export packages. Depending on your needs and the post-export process an eDiscovery user needs to perform, you can adjust these options as needed.

Organize data from different locations into separate folders or PSTs

This setting controls whether exported content is grouped by its original source. This grouping includes specific mailboxes or specific OneDrive or SharePoint sites, or combines these items into a single container.

For Exchange Mailbox items

• Selected: Each mailbox’s content is exported into a separate PST file named after the mailbox (for example, john.doe@contoso.com.pst).
• Not selected: All mailbox content across the selected data sources is merged into a single PST file (for example, exchange.pst), subject to the maximum PST size limit. If the combined data exceeds this limit, extra PSTs are created.

For OneDrive and SharePoint items

• Selected: Content is exported into separate folders per site. Each folder is named after the site and all files from that site are placed in each folder to preserve site-level organization.
• Not selected: All content is exported into a single folder regardless of the originating site. Use the items.csv to understand the original source ___location and other relevant metadata for the item.

Include folder and path of the source

This setting determines whether the export preserves the original folder structure from the source. The source is the folder where items reside in an Exchange mailbox or OneDrive and SharePoint site.

For Exchange Mailbox items

• Selected: The exported PST retains the full folder hierarchy from the mailbox. For example, if a message is located in Inbox > Legal > Q2, this exact path is preserved inside the PST. This structure helps reviewers understand the original context and organization of the content.
• Not selected: All messages are flattened into the root of the PST file, with no folder structure retained. While the messages are still exported, the original ___location within the mailbox is lost in the content itself. To find the original path of the item, review the items.csv in process report.

In both cases, the export process creates one PST file per mailbox if you select the Organize data from different locations into separate folders or PSTs option. The Include folder and path of the source option only affects the internal folder structure within each PST.

For OneDrive and SharePoint items

• Selected: Files are exported with the full folder path preserved. For example, if a file is stored in Department > Legal > Contracts > Proposal.docx, the entire path is recreated in the export package for this file. This structure mirrors the original site structure in which the file resides.
• Not selected: All files from a site are placed directly into a single folder for that site, without any subfolders. For example, if a file is stored in Department > Legal > Contracts > Proposal.docx, the path is SharePoint > Items > Proposal.docx. This structure flattens the folder hierarchy and might mix files from different folders. To find the original folder structure of the item, review the items.csv in process report.

Condense paths to fit within 259 characters limit

This setting helps prevent unzipping errors caused by long file paths during export, especially when exporting content from OneDrive and SharePoint sites where items are deeply nested inside many layers of folders.

OneDrive and SharePoint sites might have deeply nested folder structures and long file names. When exporting content with the option to preserve folder and path structure selected, the resulting file paths can exceed the Windows file system limit of 259 characters. This limit can lead to the following error message when unzipping the export package:

The file name(s) would be too long for the destination folder. You can shorten the file name and try again.

To help avoid this issue, use this option as needed:

• Selected: The export process automatically truncates folder paths - by shortening folder names or collapsing intermediate folders - so that the total path length for each file stays within the 259-character limit. This setting helps ensure that the export package can be unzipped and accessed without errors.
• Not selected: The full original folder path is preserved. While this setting maintains the most accurate representation of the source structure, it increases the risk of hitting the path length limit - especially for deeply nested OneDrive and SharePoint items.

Give each item a friendly name

This setting controls whether the export item uses its original friendly name or the unique GUID generated by eDiscovery.

For Exchange Mailbox items

When exporting as a .msg file:

• Selected: Exported .msg file uses the subject of the email.
• Not selected: Exported .msg file uses a system-generated GUID.

For OneDrive and SharePoint items

• Selected: Files are exported using the original file names. For example, a file named Q2_Budget_Plan.docx in SharePoint is exported with the exact same name in the export package.

  • If multiple files have the same name and the folder structure isn't preserved (the Include folder and path of the source option isn't selected), this situation might lead to file name collisions in the export folder. If this happens, the suffix is appended to the collided file names to differentiate the files.

  • When exporting versions, friendly names include version suffixes to distinguish between versions of the file. For example, Project Plan.docx, Project Plan_v1.docx, and Project Plan_v2.docx.

• Not selected: Files are exported using system-generated identifiers. This approach ensures uniqueness and avoids naming conflicts. For example, Project Plan.docx might be named b7f3a9c2-4e1e-4c9a-9f3e-2a1d8e7f9c1a.docx in the export package. Use the items.csv in process report to correlate the original title and other relevant metadata for the file.

View the export process status

To view the progress of the export in the Process manager, select Process manager and the Export process. You can track the process status and download export packages.

The Overview tab shows a progress bar that displays the current status, number of locations, and number of items for the export. An estimated completion and current elapsed time are displayed in hours, minutes, and seconds. The Overview tab also contains the following export information:

• Name: The name of the export.
• Completed: The UTC date and time the export process completed.
• Duration: The duration of the export process.
• Status: The current status of the export process.
• Process type: The Export process type value.
• Created: The UTC date and time the export was created.
• Created by: The user who created the export.

The Settings tab displays a summary of the export options you selected for the export process.

Viewing completed exports from a search

To view a list and details about completed exports from a search, select the Exports tab in a case. On the Exports tab, you see the following details for each export process:

• Export name: The name of the export.
• Status: The current status of the export process.
• Review set name: The name of the review set from which the export was created (when the export is created from a review set).
• Search name: The name of the search from which the export was created (when the export is created from a search).
• Created: The UTC date and time the export was created.
• Completed: The UTC date and time the export was completed.
• Duration: The duration of the export process.
• Created by: The user that created the export process.

To delete an export created from a search, complete the following steps:

1. In a case, select the Exports tab.
2. Select a completed export from a previous search. In progress exports can't be deleted.
3. Select the ellipsis by the export name, then select Delete.
4. On the Delete export dialog, select Yes.

Export packages

After the export process completes, you can download export packages. The Export packages section on the Overview tab lists the export packages and shows the package name and size. To download a package, select the package and select Download packages.

Best practices for downloading export packages

To ensure a smooth download experience, consider the following best practices:

• Allow pop-ups from Microsoft Purview: The download process triggers a pop-up window. Make sure your browser is configured to allow pop-ups from the Microsoft Purview site. For example, see instructions on how to configure pop-ups on Microsoft Edge.
• Check your browser's automatic download settings: If the Automatic Downloads setting is configured to Ask or Block, it might prevent multiple files from downloading simultaneously. For export package downloads, configure this setting to Allow or adjust permissions for the Microsoft Purview portal site. For the Microsoft Edge browser, go to Settings > Privacy, search, and services > Site permissions > All permissions > Automatic downloads and confirm that the site is Allowed to automatically download multiple files.
• Set your preferred download ___location: By default, export packages save to your browser’s default download folder. If you want to choose where files are saved, update your browser settings to prompt for a download ___location each time. See instruction for changing the downloads folder ___location in Microsoft Edge.
• Check your organization's network configuration: Ensure that your organization allows downloads from Microsoft Purview by verifying that all required endpoints and IP addresses are allowlisted. This verification includes enabling access to the Microsoft Purview export service and associated Azure storage endpoints. If your organization uses network security tools such as Zscaler, Microsoft Defender for Endpoint (MDE), or other proxy/firewall solutions, make sure these tools are configured to allow traffic to the export endpoints. For optimal performance and to avoid download interruptions, consider using a local drive (not a network share), and test your connection throughput to Azure endpoints. For detailed allowlist guidance, see Microsoft 365 URLs and IP address ranges.
• Enable parallel downloading in your browser settings: Use parallel downloading to improve download speeds for large eDiscovery export packages. For example, edge://flags in Microsoft Edge. This feature can significantly reduce wait times by allowing simultaneous file chunk downloads. This setting is also available for other chromium-based browsers.
• Use a download manager: A download manager can improve the reliability and speed of large file downloads. A download manager allows you to resume interrupted downloads and manage network fluctuations, which is especially helpful when downloading large export packages.