Exporting PST files from Microsoft 365 In-place Archive

Overview

The In-Place Archive is a popular feature of M365 where old mails for end users are held. Mails are pushed to the In-place archive either via retention policies, or manually when a user's mailbox quota is reached.

To extract the contents of the In-place archive, a two step process has to be followed,

a. Fire Search requests

b. Export the search results.

c. Once the Exported PST files are available, then can be downloaded to an OneDrive from where they can be copied to a Vaultastic Store.

The steps for uploading the contents from the in-place archive for selected or all users to a Vaultastic Open / Deep store is as documented below

Step 1: Create a Content Search

Create a New Search

- Log in to the Microsoft 365 Admin portal.

- Navigate to Microsoft Purview > eDiscovery > Cases.

- Go to the Searches tab

- Click on Create a Search to create a new search.

Fill Search Details

Search Name: Enter a unique name (Required).
Search Description: (Optional) Describe the purpose or scope of the search.
For example, the search name can be "Vaultastic - In-place Archive Data Size".
Select Create to create the new search and start your queries to find relevant data for the case.

Add data sources to searches

To add data sources to a created content search, on the Query tab of the search, click on Add sources

A Search for sources pop-up will be displayed.

The left side of the pop-up displays the Filter options. Update the filter as follows

In the Scope items by section, keep the default option (Highlighted as 1.3)
In the Show for section, keep the default option (Highlighted as 1.4)
In Locations to include, select Mailboxes only (Highlighted as 1.5)
On the right side of the pop-up(Highlighted as 1.6), you can search for all the users for whom you want to extract the mail. You can select multiple users.
Click on the Manage button (highlighted as 1.7)

In the Manage Sources pop-up, confirm Mailbox selection for the filtered users

Click Save (highlighted as 1.8)

Add the query

Navigate to the Query tab
Select Condition builder
Click Add conditions

Select Date in first field
Select Before as the condition
Select a date from which data will be found in the inplace archive
Click Run query

After you select Run query, the Choose search results flyout pane will appear.
Select Statistics
Select Run query to immediately run the query.

Step 2: Monitor the status of the search using the Process manager information

The Process manager for each area displays information about processes performed in that area.

For the search, the process type will be Generate Statistics. The Status column will show the current status of the process.

Note: Depending on the size of data, this step may take a few days.

Step 3: Review Statistics and fire the Export using the Statistics dashboard

Once the status of the search query is complete, go to the Statistics tab and view the statistics and fire the Export.
Click on the Export button

In the "Export Name" field, enter a name for your export
You can add a description in the "Export Description" field to provide details about the export.
In Select Items to include in your export, select Indexed items that match your search query
In Select folder items, select Only include items that match search query

Under the Export Type section, select Export Items with Item Report
Under the Export Format section, choose Create PSTs for Messages.
Customize how the export package is structured by selecting the following options:
- Organize data from different locations into separate folders or PST files.
- Include the folder and path of the source for better navigation.
- Condense paths to fit within the 259-character limit, truncating the subfolder or file name as necessary.
- Assign each item a user-friendly name for easier identification.
- Click Export and confirm with OK.

Step 4: Monitor the status of the export using the Process manager information