Sar Request advice in Microsoft 365

[maxrebo]

First time running one of these for a while, its all changed in 365 since i did the last one, just looking for advice on how to do this ocrrectly....

 

I go to : 

 

Microsoft Purview

eDiscovery Search

Create a case

Data source – "All people and groups" +  "All public folders"

add the email address for the SARS request

Under “Cases” > Statistics > Total Matches - is this the result of any communication for this email address?

We would then use the "Export" to pull off the results

 

What's the best procedure for searching student name? search as "Joe Bloggs" or "Joe+Bloggs" ?

 

Thanks in advance

[browolf]

I made this toolkit in python.   There's also the instructions on how to get the data out of purview using keyql 

 

browolf/Subject-Access-Requests-from-Microsoft-Copilot-365: Describes how to reliably extract and redact data from Microsoft Purview