How to Export Office 365 Mailbox to PST Using eDiscovery, PowerShell & Outlook

Blog Overview: How to export Office 365 mailbox to PST completely depends on what you want to export and where mailbox is hosted. 

• Mailbox available in Outlook: Outlook desktop app is a good route. 
• Administrator-controlled searches and broader exports: Microsoft Purview eDiscovery is a fit. 
• PowerShell needs care because New-MailboxExportRequest is an on-premises Exchange cmdlet, not standard Exchange Online PST export command.

Right method is needed because export of mailbox is not about creation of .pst file. Users need to know that export has. Whether older emails are available to Outlook, how eDiscovery managers partially indexed items and how to verify final PST.

Can You Export an Office 365 Mailbox to PST?

Yes. users can export Microsoft 365 mailbox data to PST file, but method changes with situation the user is in.

If you want to export one mailbox through Outlook, process is simple. If you are administrator who is collecting data from one or more mailboxes, Microsoft Purview eDiscovery gives search and export controls. Users who work with Exchange Server on-premises, PowerShell has different mailbox export commands.

One important point to know before you start. Exchange Admin Center dont provide simple “Export mailbox to PST” button for exchange Online mailbox contents. Microsoft directs users towards Outlook or Microsoft Purview eDiscovery.

Quick Decision

Simple rule: Use Outlook when requirement is straightforward mailbox copy, use Purview when you requirement is controlled discovery and export. Do not treat an on-premises Exchange PowerShell cmdlet as an Exchange Online shortcut.

Select Right Export Method

Before clicking on anything, decide what you are trying to achieve. If task is, to get a mailbox in PST file,” Outlook is enough. On the other hand if requirement is to search many mailboxes, collect only relevant messages, and export the results, Microsoft Purview eDiscovery a match.  Microsoft describes eDiscovery as a method to identify, review, manage, and export Microsoft 365 content for investigations and legal cases.

If dealing with on-premises Exchange environment, Microsoft documents New-MailboxExportRequest and related mailbox export request cmdlets for on-premises Exchange only. Users can think of these three methods a three doors. Outlook is easy door, Purview is controlled door and Exchange Server PowerShell is administrator door for an on premises.

Export One Mailbox with Outlook

For single Microsoft 365 mailbox, Outlook is easiest option when mailbox is configured in desktop app. For New Outlook for Windows microsoft provides, Files > Open and Export.

To initiate export via New Outlook user need to have a Microsoft 365 subscription. This can be done without paid subscription is Classic Outlook and the process is:

• Open File.
• Select Open & Export.
• Choose Import/Export.

• Select Export to a file.
• Choose Outlook Data File (.pst).
• Select account or folders you wish to export.
• Make sure Include subfolders is selected when you need the mailbox hierarchy.

• Choose the save location and finish the export.

Outlook will create a copy of your selected data in PST format. Your data will remain in Outlook as export is just a copy and not a removal option.

Best For: One Mailbox, normal export, migration preparation, local archiving and creation of portable copy of mailbox information.

Why Export PST from Office 365 for Digital Forensics

Understanding data structures is as important as knowing how to retrieve them or transfer them to any platform. When we talk about mailbox exports in Microsoft 365, we’re referring to PST files (Personal Storage Table).

Exporting PST files from Office 365 is essential for forensic investigations that preserve email evidence’s authenticity and integrity.

A PST file is Microsoft Outlook’s native format for storing emails, calendar events, contacts, tasks, and more. It’s a structured and compact way to package mailbox content, which can be opened in forensic tools or Outlook itself for detailed analysis. For investigators, PST files are essential for conducting Outlook PST forensics, as they allow offline access to entire mailboxes without requiring a live Exchange connection.

Office 365 (now branded as Microsoft 365) uses Exchange Online to manage emails in the cloud. However, it doesn’t provide a simple GUI-based method to export mailboxes like desktop. This is why experts use PowerShell scripts and Microsoft’s Compliance Center methods, which provide that give you full access to download and preserve user mailbox data.

Why Do We Need to Export Office 365 to PST?

As we learn about both formats, we can see how both platforms are important. While exporting Office 365 mailbox to PST, it isn’t just a convenience, but it’s a necessity.

Why? It is so because cloud data is dynamic. Emails cannot be deleted or made inaccessible once the user account is removed or compromised. By transferring the mailbox content to a PST file, examiners will be able to freeze that data in time and uncover hidden evidence without it being misused or disappearing by someone. It is a critical requirement for maintaining evidence integrity.

Here are several scenarios where exporting mailboxes to PST becomes critical:

• Legal and Audit Purposes- As we discussed, email communications often serve as critical evidence. By exporting Microsoft 365 mailbox to PST, you can get the email data for legal review, and it is admissible in court as well.
• Hacked Admin Accounts- Imagine an Office 365 admin account being hacked. Attackers may manipulate or delete critical user data, including email communications. By having regular PST backups of sensitive mailboxes, organizations can restore emails and other vital communications that might have been compromised.
• Not Relying Solely on Microsoft for Data Control- Though Microsoft 365 provides cloud-based email services but many organizations prefer not to depend solely on Microsoft to manage their data. Exporting Office 365 mailboxes to PST gives businesses local control over email data. This can manage, backup, and secure their data independently from Microsoft cloud services.

How to Export PST from Office 365 Mailbox Using eDiscovery from Admin Portal

• Step 1. Log in to your Office 365 admin account and open the Microsoft 365 Admin Center panel.
• Step 2. From Admin Centers, click on “Security & Compliance” to access Office 365’s compliance and export tools.
• Step 3. Under the Security & Compliance, go to Permissions and add yourself to the eDiscovery Manager role.

• Step 4. Tick the box for eDiscovery Manager, then click Edit to assign important roles to the group.
• Step 5. Ensure roles like Case Management, Export, Hold, Preview, Review, and Compliance Search are assigned.
• Step 6. If the Export role isn’t listed, edit the role group and manually add it from available roles.

• Step 7. Now, go to More Resources, open Microsoft Purview, click “Content Search,” then hit “New Search.”

Note: Content Search may take 24 hours to appear if new permissions were recently added.

• Step 8. In the New Search wizard, enter a name and select mailbox locations for data export.

Note: Avoid selecting SharePoint or Public Folders unless needed, as they slow down exports.

• Step 9. Apply filters under Conditions to narrow search by keywords, date, sender, subject, or message properties.

Note: Leave filters blank to export the full mailbox without excluding any content.

• Step 10. Once filters are set, click “Submit” then “Done” to begin the content search operation.
• Step 11. Your search runs in the background. Check progress by going to the Search tab anytime.

• Step 12. When the search finishes, click Actions > Export Results to begin exporting Office 365 mailbox data.

• Step 13. Choose to include encrypted files if needed, and export with default settings for better compatibility.

Note: Disable “Deduplication” if you want all results in one PST file.

• Step 14. Go to the Export tab, select your search, and monitor the PST export progress in real-time.

• Step 15. Once export finishes, click “Download Results” and copy the Export Key for the next step.

• Step 16. The eDiscovery Export Tool opens. Paste the Export Key, choose a save location, and click Start to export.

Important: Use Edge for this step. Chrome/Firefox users must install the ClickOnce extension.

Exchange Online Export Office 365 Mailbox to PST Using PowerShell

PowerShell is a powerful tool for IT professionals and forensic investigators alike, especially when working with Exchange Online mailboxes. It allows deeper control, batch processing, automation, and scripting flexibility, which is essential when handling large-scale exports or preserving digital evidence systematically.

However, you cannot directly export an Office 365 mailbox to PST using PowerShell commands alone. Microsoft 365 no longer supports the New-MailboxExportRequest command, which was available only in on-premises Exchange servers, not in Exchange Online.

There are technically valid and workaround methods using PowerShell, often paired with eDiscovery or desktop-based Outlook. These are particularly useful in digital forensic environments, where scripting, consistency, and automated workflows are essential.
Let’s understand the method in detail:

Use PowerShell the Right Way

This is where Office 365 PST guides become confusing.

The command most often associated with direct mailbox-to-PST export is:

New-MailboxExportRequest

The problem is this is not Exchange Online mailbox export command.

Microsoft documents the mailbox export request family, including Get-MailboxExportRequest and Set-MailboxExportRequest, as on-premises Exchange only.

For on-premises Exchange environment, mailbox export request can look like this:

New-MailboxExportRequest `

  -Mailbox user@contoso.com `

  -FilePath “\\FileServer\PST\user.pst”

The exact permissions, path, and Exchange configuration should match on-premises environment. Microsoft notes that the Mailbox Import Export role is not assigned to role groups by default, so it must be assigned before cmdlet can be used.

For Exchange Online, article should not tell readers that the same cmdlet is their direct PST solution. Microsoft instead documents PowerShell interaction with Purview eDiscovery and its supported search/export workflows.

Important: Exchange Online and Exchange Server are not interchangeable environments. PowerShell command that works in on-premises Exchange should not automatically be presented as an Office 365 command.

That distinction alone can save hours of trial and error.

Export Office 365 Mailbox to PST Using Automated Software

There are various user concerns that they face while using this manual, and the complicated process poses a risk of data leakage. So, here is the best email forensic software for you. MailXaminer is for users who need deep, detailed, and defensible data collection from Office 365 mailboxes. This email forensics software is a complete package for any technical enthusiast or examiner who needs to analyze the data. So let’s discuss how the software will process Office 365 to PST export.

Detailed Explanation & Working Steps of Software to Export Office 365 Online Mailbox to PST

Step 1. Set up the software on your system and log in to the software.

Step 2. Create a new case and add the details, and save the details.

Step 3. Afterthat, option of Add Evidence option will be visible. Now choose Office 365 from the cloud option and click Next.

Step 4. Now, add the domain details. For this, you need to select the domain name first.

Step 5.  Next, the work selection window became visible. Then select email, and also provide a date filter.

Step 6. Next comes the credentials section. Here, you need to provide the details of your Office 365 domain and validate the permissions.

Step 7. Next, the software will fetch all the user mailboxes from the given account details.

Step 8. Select the mailbox that you want to export and validate the settings. Afterthat, start the ingestion.

Step 9. Then, complete data will show on the dashboard.

Step 10. Your data will be clearly visible as a evidence and you can deeply analyze the emails with different features of the software.

Step 11. Afterthat, simply export the selected mailbox by selecting the export options.

Step 12.  Select PST as the file format in which you want your data to be exported.

Step 13. Lastly, provide the export path to the software with the export basic settings and tap on the Export option to complete the process.

After the export of Office 365 files into PST mailbox for analysis of files, the investigator will typically proceed with several critical steps. The goal is to ensure that all evidence is properly preserved, analyzed, and interpreted by forensic protocols.

Now that we have uploaded the Office 365 mailbox files into Outlook PST, let us understand the next steps in the forensic investigation of these files.

Verify the Integrity of the PST File

You need to ensure that the exported PST mailbox has not been tampered with during the export process. After performing the above steps, you will get the option of generating a complete report of the case.

This helps to generate a cryptographic hash (e.g., MD5, SHA-1, or SHA) of the exported PST file to ensure the integrity. This software will allow you to export your generated report into multiple file formats to track the handling and movement of the PST file and its contents.

Conclusion

These steps can ensure that the investigator analyzes the PST file thoroughly and in compliance with forensic standards.

Exporting Office 365 mailboxes to PST is crucial for data security, legal compliance, and forensic investigations. While manual methods like eDiscovery, PowerShell, and Outlook exist, they can be complex and limited. For a faster, more secure, and more comprehensive solution, professional tools like MailXaminer ensure reliable, error-free mailbox export with advanced features.