1. Prerequisite: eDiscovery Permissions
By default, Global Administrators cannot preview or read user emails. You must explicitly grant yourself the eDiscovery Administrator role before doing this work.
- Go to Microsoft Purview > Settings (gear icon bottom left).
- Select Roles and scopes > Permissions (or Role Groups).
- Find and click on eDiscovery Manager.
- Click Edit and add your admin account specifically to the eDiscovery Administrator section.
- Save the changes.
The Microsoft Waiting Game
Permission changes take anywhere from 15 to 60 minutes to propagate. If the "Sample" button is greyed out, or you get an error viewing emails, you just need to wait a bit longer.
2. Full Data Takeout (The "Google Takeout" Equivalent)
Follow these steps to export 100% of a user's Mailbox, Calendar, Contacts, and OneDrive files.
Select Data Sources
In your eDiscovery search, click Add sources. Search for the user and toggle ON Exchange mailboxes and SharePoint sites / OneDrive accounts.
Clear Conditions & Run
Delete all conditions in the Condition Builder. By having NO conditions, you target 100% of the data. Check the box for Include partially indexed items, then click Run query.
Configure Export Settings
Once statistics load, click Export. Choose the following critical settings:
- Output options: All items, including unrecognized formats (captures everything).
- Export Exchange content as: One PST file for each mailbox.
- Max PST / ZIP size: Leave at 10 GB (See Best Practices).
Download the Data
Go to the Exports tab. Once the job completes, copy the Export Key. Click download to launch the eDiscovery Export Tool (Requires MS Edge), paste the key, and select a local folder.
3. Specific Email Search (e.g., Migration Errors)
When troubleshooting specific emails (like failed Google Workspace migrations), use unique identifiers to find the exact culprits.
Using KQL (Keyword Query Language)
If you have a log with a Source URI or Message ID, paste it into the search box using the InternetMessageId property.
InternetMessageId:"<BN8PR15MB...prod.outlook.com>" OR InternetMessageId:"<BN8PR15MB...prod.outlook.com>"
Previewing the Results
- Run the query. Ensure your Statistics show the correct number of matches.
- Change the query results view from Statistics to Sample.
- Click Run query again. A new Sample tab will appear where you can preview the email bodies and see the exact file attachments (e.g., .exe, password-protected zips) causing issues.
4. Best Practices: PST Sizes
When exporting large users (e.g., 30GB+ of data), you will see an option to increase the "Max PST package size". Do not increase this past 10GB or 25GB maximum.
Keep it at 10GB
Microsoft will safely split a 37GB mailbox into four separate PST files. This prevents network timeouts during download, prevents file corruption, and ensures Outlook won't crash when trying to open the file locally.
Avoid 50GB PSTs
The PST file architecture is fragile. A single 40GB+ PST file has a very high chance of corrupting during transit. Even if it survives, attaching a 40GB PST to the Outlook desktop app will cause severe application lag.