Question

A legal hold request requires you to locate and preserve all email messages containing the phrase "Project Halcyon" that were sent or received by a user who left the organization three weeks ago. The user's Microsoft 365 account has been disabled but not deleted, and the license was removed. As the SOC analyst supporting the legal team, which Microsoft Purview action lets you search the former employee's mailbox content and preserve the results without restoring the license?

Accepted Answer

Run a Purview eDiscovery content search scoped to the inactive mailbox using the keyword "Project Halcyon", then place the results on hold.

Answer

Use Purview Audit (Standard) to query MailItemsAccessed events filtered by the user's UPN and export the matching messages.

Answer

Reassign a license to the disabled account so the mailbox becomes active again before running a content search.

Answer

Create a Microsoft Graph activity log query for the user's mailbox and download the messages that match the keyword.