This guide will walk you through formatting your O-365 live email searches to get the best results.
How The Different Inputs Work:
Received Date: A date range in which you would like to search user(s) inboxes.
Sender: The user that composed and sent the email, this is an email address input.
Recipients: The user that received the email (does not include bcc), this an email address input.
Subject: By default this input will search all input words as OR operators. Meaning if you searched for "Managed Methods" the results would contain all emails with subjects containing "Managed" OR "Methods". To search exact subjects, you can simply enter "AND" (all caps) between the words you'd like to search for.
This search would return only email Subjects that contained both Managed, and Methods.
Searches cannot be explicit, meaning this search would return any subjects containing BOTH words, but not ONLY those two words.
Has word(s): Similar to subjects this field will treat spaces as OR operators. They can be changed in the same way as subjects, by adding an AND between words you would like to add.
Results here would include words found in both the subject, and the body of the email.
Mailbox(s): This field will limit the search to a single user. This will drastically improve the search times, and should be used whenever possible. It must contain a user within your domain.
Search In: Denotes which part of the users outlook to search, Inboxes will search all of the users inboxes, sent will search in sent, etc.
Email Size: Will let you filter emails based on their size.
Has Attachments: Will allow you to only show results with attachments on the email.