Question

During an incident, legal counsel asks you to preserve and later produce all email correspondence from a departed employee's mailbox for a specific 90-day window. You have already placed the mailbox on hold. You now need to run a targeted content search across that mailbox, review the items in place, and export the results as a PST for handoff to counsel. Which Microsoft Purview capability should you use to perform the search, review, and export workflow?

Accepted Answer

Microsoft Purview eDiscovery (Standard) — create a case, add the mailbox as a data source, run a content search with the date range, then export results

Answer

Microsoft Purview Audit (Premium) search filtered to the mailbox and MailItemsAccessed activity, then export the audit log to CSV

Answer

Microsoft Defender for Office 365 Threat Explorer, filtered by recipient and date range, then export the email list

Answer

Microsoft Graph activity logs query for the user's mailbox actions, exported to a Log Analytics workspace