How do you detect PST exports via eDiscovery in Microsoft 365?

What makes PST export activity stand out in Microsoft 365

PST exports are a strong signal because they turn investigative access into a portable file that can be copied, staged, or moved outside the tenant. In Microsoft 365, the key distinction is whether the export fits a normal investigation pattern or looks like bulk collection. Focus on the request’s timing, the mailbox scope, and whether the case context explains why that data needed to be exported at all.

Normal work usually has a narrow purpose, a defined case owner, and a believable reason to collect specific mailboxes. Suspicious activity is broader: searches spanning many users, repeated export attempts, or exports that create mail data without an obvious investigative justification. That is why export telemetry should be read as part of the full chain, not as a standalone event.

For practical detection, compare the eDiscovery requestor, the case name, and the export job to expected incident or legal-hold activity. A one-off export by a known investigator may be routine, while an export initiated by an account that rarely performs case work, or outside working patterns, deserves closer review. Pair the export record with audit logs and downstream file handling so you can see whether the resulting PST was copied to unapproved storage.

Which signals usually matter most

The most useful indicators are scope, repetition, and destination. Broad searches across many mailboxes, exports that collect a large volume of mail, and exports followed by unusual file movement all increase concern. The same is true when the search terms are not aligned to a documented matter or when the export job appears to exceed the normal bounds of the case.

Review whether the activity came from a user who is authorised for eDiscovery and whether that authorisation matches the specific case. If the requestor is not part of the expected legal, compliance, or investigation workflow, treat the export as higher risk even if the tenant technically allowed it. This is especially important where export permissions are broad but operational need is narrow.

Microsoft 365 audit and eDiscovery records are most valuable when you correlate them with identity and mailbox context. If the same account is also involved in unusual sign-ins, elevated permissions, or other administrative actions, that broader pattern can help separate routine case work from potential data staging. For tenant hardening and audit visibility, see the Microsoft 365 Security Guide.

How to separate legitimate case work from exfiltration

Legitimate exports usually leave a clean explanation trail: the case is active, the search is targeted, the export is time-bounded, and the resulting files stay inside approved handling. Exfiltration tends to look less disciplined. It may involve broad mailbox selection, exports with no obvious business need, and file movement that jumps from Microsoft 365 into personal drives, unmanaged endpoints, or external transfer paths.

That is why the best test is not just “was an export run?” but “did the export behave like the case that supposedly justified it?” If the answer is no, the activity deserves escalation, even before you prove abuse. The telemetry should also be compared with the organisation’s normal eDiscovery cadence, because genuine investigation teams often have repeatable patterns that can be baselined over time.

When you need a broader view of how mail, files, tokens, and cloud data leave a tenant, anchor the investigation in exfiltration patterns rather than treating PST export as a standalone event. The Data Exfiltration Guide is useful for connecting export activity to collection, staging, transfer, and destination telemetry.

Risk and Threat Considerations

PST exports can convert a permitted investigation capability into a bulk data removal path. The risk is highest when export permissions are too broad, audit review is delayed, or exported files can be moved to unmanaged locations without detection. In that situation, the tenant may show a legitimate eDiscovery action while the real objective is copy-out of sensitive mail data.

Failure mechanism: An authorised or compromised user runs broad searches, exports mailbox content, and then stages the resulting PST outside approved controls, where standard mailbox monitoring no longer follows the data.

Impact: Confidential mail, attachments, and message history can be removed from Microsoft 365, increasing the chance of data breach, insider misuse, regulatory exposure, and delayed containment.

Practitioner Guidance

What to verify: Confirm that each export maps to an active case, an authorised requestor, and a narrowly scoped search. If the export cannot be tied to a real investigative purpose, treat it as suspicious even when the platform allowed it.

What to measure: Track export volume, mailbox count, repeat exports by the same user, and the time from export to file movement. A pattern of broad scope plus rapid downstream file transfer is more actionable than any single event.

Decision rule: If the export is larger than the case justification, or if the resulting PST is found in an unapproved location, prioritise containment and review of the account’s broader activity before assuming the export was legitimate.

Practitioner takeaway: The detection problem is really a workflow problem, match the export to the case first, then treat any mismatch in scope, authorisation, or file handling as the strongest warning sign.

Related resources from NHI Mgmt Group

• How do you detect new federated domains being added in Microsoft 365?
• How do you detect activity performed by terminated users in Microsoft 365?
• How do you detect Microsoft 365 activity from anonymous or suspicious IP addresses?
• How do you detect suspicious OAuth app file download activity in Microsoft 365?