How to export a Microsoft 365 mailbox to PST using Microsoft Purview

Need a PST copy of a Microsoft 365 mailbox for legal discovery, offboarding, migration, or a one-time archive? In 2026, the supported admin path is through Microsoft Purview eDiscovery—not the old Security & Compliance Center.

When a PST export makes sense

Exporting mailbox data to PST is still useful for specific scenarios: legal discovery, HR investigations, employee offboarding archives, tenant-to-tenant migration preparation, or a one-time mailbox handoff. However, PST files are portable copies of business data, so they should be treated as sensitive records.

Before exporting, confirm the business reason, approval, data scope, retention requirements, and where the PST will be stored. For ongoing backup, retention, or compliance review, a PST export is usually not the best long-term solution.

Prerequisites before you start

You need the right Microsoft 365 and Microsoft Purview access before you can export mailbox content.

Minimum prerequisites:

• A Microsoft 365 tenant with Exchange Online mailboxes.
• Access to Microsoft Purview at https://purview.microsoft.com.
• A user account assigned to the appropriate Microsoft Purview eDiscovery role group.
• The Export role in Purview; without it, the export/download option may not appear.
• A licensed mailbox or mailboxes included in the search. Licensing depends on your Microsoft 365 plan and the Purview/eDiscovery features used. If you buy Microsoft cloud licensing through the New Commerce Experience, confirm that the tenant has the required Exchange Online and Purview compliance capabilities assigned.
• A Windows workstation for downloading PST results, because the Microsoft eDiscovery export download experience may require Microsoft’s export tool/ClickOnce-style download flow. Use Microsoft Edge and allow required downloads/pop-ups.
• Enough encrypted local or network storage for the export.

Important: role changes can take time to apply. If you just added the Export role, sign out and back in, and allow time for Microsoft 365 permissions to refresh.

Assign eDiscovery and Export permissions in Microsoft Purview

Use least privilege. Do not use a Global Administrator account for routine exports if a scoped compliance role will do.

Typical process:

1. Sign in to Microsoft Purview: https://purview.microsoft.com.
2. Open the permissions/role groups area. Microsoft periodically updates navigation, but in the current Purview experience this is under settings or role groups for Microsoft Purview solutions.
3. Find the eDiscovery Manager role group.
4. Add the user, or preferably a Microsoft Entra ID security group, to the appropriate eDiscovery role group.
5. Confirm that the role group includes the Export role. The user must have export permission to download PST results.
6. Save the changes.
7. Wait for permissions to propagate, then sign out and sign back in.

For highly sensitive exports, consider a separate Microsoft Entra ID group for approved eDiscovery operators, protected with MFA, Conditional Access, and periodic access reviews.

Create a Purview eDiscovery search for the mailbox

After permissions are ready, create a search in Microsoft Purview eDiscovery.

General workflow:

1. Go to https://purview.microsoft.com.
2. Open eDiscovery.
3. Create a new case or use an existing approved case. Cases are recommended because they keep searches, exports, review activity, and audit context together.
4. Create a new search.
5. Choose the data locations. For a mailbox export, select Exchange mailboxes and specify the user mailboxes to include.
6. Add conditions such as date range, sender, recipient, subject keywords, message type, or other query criteria if you only need a subset of data.
7. Run the search.
8. Review the search estimate and preview results if your role allows it.

Avoid exporting all mailboxes without filters unless there is a clear legal or business requirement. Tenant-wide exports can produce very large PST files, expose unnecessary personal or confidential data, and create avoidable compliance risk.

Export the search results to PST

Once the search results are ready and validated, export them.

Typical export workflow:

1. Open the completed search in the eDiscovery case.
2. Choose Export or Export results.
3. Select the Exchange mailbox export options that match your requirement. For mailbox content, choose an option that exports Exchange results as PST files.
4. Decide whether to include unindexed items if they are required for your matter.
5. Choose whether to enable deduplication. Do not enable deduplication automatically; use it only when your legal or compliance process calls for a deduplicated result set.
6. Start the export.
7. When the export package is prepared, open the export/download area.
8. Copy the export key if prompted.
9. Download and run the Microsoft eDiscovery export tool if required.
10. Paste the export key, choose a secure destination folder, and start the download.
11. Confirm that the PST files downloaded successfully and that file sizes are reasonable for the expected mailbox content.

SharePoint and OneDrive results are not PST mailbox exports. If your search includes SharePoint, OneDrive, Teams files, or other workloads, those items may export in different formats. Public folder content should also be scoped deliberately rather than mixed into a mailbox export by accident.

Protect the exported PST files

A PST file can contain email, attachments, personal data, contracts, credentials, financial records, and regulated information. Treat it as sensitive data.

Recommended controls:

• Store PST files only in an approved encrypted location.
• Limit access to named users with a business need.
• Keep the export key and downloaded data separate where possible.
• Record who requested, approved, performed, accessed, and deleted the export.
• Use Microsoft Purview audit logs where available.
• Do not email PST files as attachments.
• Apply retention and deletion rules to the exported copy.
• Securely delete temporary export files when the matter is complete.
• If the PST is sent to legal counsel, a migration vendor, or another third party, use an approved secure transfer method.

Common troubleshooting tips

If the Export button is missing: verify that your account is in the correct Purview eDiscovery role group and has the Export role. Sign out and back in after permission changes.

If the search returns no results: check that the correct mailbox was selected, the mailbox still exists, the date range is correct, and the query syntax is not too restrictive.

If the export tool does not start: use a Windows workstation, try Microsoft Edge, allow downloads/pop-ups, and confirm that endpoint security software is not blocking the Microsoft download tool.

If the export key fails: copy the full key again from the Purview export page and make sure you are using the matching export job.

If the export is very large or slow: narrow the search by date, custodian, or keywords; export in smaller batches; and confirm that the destination has enough free space.

If results are incomplete: check whether unindexed, encrypted, protected, or retained items are in scope and whether the account has the required permissions to include them.

Alternatives to PST export

PST export is not always the right solution. Consider these alternatives:

• Microsoft Purview eDiscovery case review for investigations that do not require a portable PST copy.
• Exchange Online retention policies, retention labels, or litigation hold for preserving mailbox data in place.
• Microsoft 365 Backup or a third-party backup platform for operational recovery.
• Migration tools for tenant-to-tenant or mailbox migration projects.
• Shared mailbox conversion for some offboarding scenarios where the business still needs access to a former employee’s mailbox.

The best option depends on whether your goal is preservation, review, recovery, migration, or long-term archive.

Key takeaways

• In 2026, Microsoft 365 mailbox PST exports should be performed through Microsoft Purview eDiscovery, not the retired Security & Compliance Center workflow.
• The user performing the export needs the correct Purview eDiscovery permissions, including the Export role.
• Scope searches carefully; exporting every mailbox without filters is risky and can create compliance and data exposure issues.
• PST files must be protected, audited, encrypted, and deleted when no longer required.
• For backup, retention, or migration, a PST export may be less suitable than Microsoft 365 Backup, Purview retention, or a dedicated migration tool.

If you need help exporting mailbox data safely, validating Microsoft Purview permissions, or choosing between PST export, retention, backup, and migration options, IT Partner can assist with Microsoft 365 support, compliance configuration, backup and recovery, and mailbox migration planning.