How to do a content search in Microsoft 365

The Microsoft 365 content search feature for Exchange Online helps you keep an eye on the content of emails sent and received. Though the Microsoft 365 Security & Compliance Center has this capability, it falls short in some areas.

For example, you can’t do pattern-based searches to identify credit card numbers, social security numbers, and other personally identifiable information that follow a regular pattern. You also can’t schedule automatic content searches; they need to be done manually every time.

How is M365 Security Plus a better option?

M365 Security Plus, a Microsoft 365 auditing, monitoring, alerting, and content search tool, helps you create schedules that run automatically at set intervals and sends email reports on the search performed. Besides this, you also have an instant search option for finding specific content across all mailboxes in your organization. It supports keyword-, attribute-, and pattern-based searches that save a lot of time. To perform an instant search operation:

1. Go to the Content Search tab under the Security & Protection section.
2. Navigate to Content Search Profiles > Mail Content Profiles > Instant Search.
3. Select the mailbox in which you want to perform the search operation.
4. Set as many Search Criteria as required. You can use the AND and OR operations to append your criteria.
5. Click Search.

Steps to create a content search profile

If you want M365 Security Plus to perform a mailbox content search at regular intervals and share the search results via email, you need to create a search profile as given below.

1. Go to the Settings tab.
2. Navigate to Configuration > Content Search Configuration > Content Search Profiles.
3. Click Add Profile.
4. Enter a suitable Profile Name.
5. Choose a Microsoft 365 Service from the drop-down.
6. Select the mailboxes in which you would like to perform the search.
7. Set your Search Criteria and Polling Interval.
8. Under Advanced Options, select the Email alerts corresponding to this profile check box.
9. Select a suitable Notification Template, File Format, and time interval.
10. Select the Include event details check box if you want to receive a detailed note about the errors, if any.
11. Click Add.

Read more about the Microsoft 365 content search feature here.