M365 Data Portability and Export

Data portability refers to the ability of customers to export their data from Microsoft 365 in a structured, commonly used format. This is mandated by regulations like GDPR (Article 20) and other data protection laws, which require that data controllers (organizations) can transfer personal data to another controller without hindrance. Microsoft 365 provides several built-in tools to facilitate this, but the responsibility for extracting and moving data lies with the tenant administrator.

Microsoft 365 data export is not a single button but a collection of tools and APIs. The primary methods are:

When an admin initiates a data export from the Microsoft Purview compliance portal:

To initiate a data export using PowerShell (Exchange Online module):

# Connect to Exchange Online
Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

# Create a compliance search
New-ComplianceSearch -Name "ExportAllMail" -ExchangeLocation All -ContentMatchQuery "received>01/01/2023"

# Start the search
Start-ComplianceSearch -Identity "ExportAllMail"

# Once completed, create an export action
New-ComplianceSearchAction -SearchName "ExportAllMail" -Export

# Check export status
Get-ComplianceSearchAction -Identity "ExportAllMail_Export"

For Microsoft Graph API:

GET https://graph.microsoft.com/v1.0/users/{user-id}/messages?$top=1000

Data portability also includes the ability to import data into another service. Microsoft provides tools to import .pst files into Exchange Online, but moving data to a non-Microsoft service is the customer's responsibility. Microsoft does not provide direct integration to migrate to Google Workspace or other providers, but they do provide open standards like IMAP for email and REST APIs for files.

A large European company receives a DSR from an employee who has left the company. The employee requests all personal data stored in Microsoft 365. The compliance team uses the Microsoft Purview compliance portal to create a content search for the employee's mailbox, OneDrive, and any SharePoint sites where the employee had access. They export the data to .pst and .csv files. The export includes emails, documents, and Teams chat messages. The team then reviews the data to redact any third-party personal data before delivering it to the employee. A common challenge is that the export includes data from shared mailboxes or distribution groups where the employee was a member, which may contain other individuals' data. To handle this, the team uses eDiscovery with advanced filtering. Performance-wise, exporting a mailbox with 50 GB of data takes about 2-4 hours. The 14-day download window is sufficient but requires careful scheduling.

A mid-sized company decides to move from Microsoft 365 to Google Workspace. They need to export all mailboxes, files, and Teams data. For mailboxes, they use the Exchange admin center to export each user's mailbox to .pst files. For OneDrive and SharePoint, they use the SharePoint Online Management Shell to download files via PowerShell. For Teams, they export channel messages from the associated group mailbox. The total data is 2 TB across 500 users. They run multiple export jobs in parallel (up to 10) to speed up the process. They encounter a problem: the .pst files for some users exceed 10 GB and are split into multiple files, complicating the import into Google Workspace. They use third-party migration tools to handle the splitting. The migration takes two weeks. Key lesson: start exports early and test one user first.

A company is involved in litigation and must preserve all data related to a specific project. They place a legal hold on the relevant mailboxes and SharePoint sites. Later, they need to export the preserved data for the legal team. They use eDiscovery instead of the standard export tool because eDiscovery allows them to export only the data on hold, not the entire mailbox. The export includes metadata like hold status. The legal team imports the .pst files into a review platform. A common mistake is using the standard export tool, which exports all data, including data not on hold, potentially violating data minimization principles.