Mailboxes in Microsoft 365 live on Exchange Online, which is convenient until you need a copy you can hold onto. Staff leave, accounts are closed, auditors ask for records, and sometimes a security incident forces a team to preserve messages quickly. In all of these cases, the PST file is still the most familiar way to package mailbox content for offline use.
A PST is simple to describe but easy to get wrong. The method you choose decides who can run the export, what ends up in the file and how far you can trust the result. This guide helps you pick a route first, then walks through each one and closes with checks that catch the most common mistakes.
Why the PST Format Is Still Popular
PST stands for Personal Storage Table, Outlook’s own data file. It stores copies of emails along with calendar entries, contacts and tasks. Because it is self-contained, you can:
Browse mail without a connection to the server
Carry mailbox content from one supported Outlook setup to another
Keep a local archive under your own control
Keep in mind that a PST is a snapshot. Its contents depend on the source mailbox, the method used and any filters applied, so it is not automatically a complete backup.
Decide Before You Export
Three questions will point you to the right method.
Whose mailbox is it? Your own, or several belonging to other people?
How much data is involved? One folder, or years of messages?
Could the result be questioned later? A casual archive needs little paperwork, while evidence needs a documented trail.
As a rough guide, a single mailbox already open in desktop Outlook calls for one of the Outlook methods. Collections across several accounts, or anything administrator-managed, belong in Microsoft Purview eDiscovery.
Route One: Microsoft Purview eDiscovery
Purview is built for authorized users who need to search cloud content and export the results. It fits compliance reviews, internal investigations and any situation where selected messages must be gathered from different mailboxes.
A warning for anyone following older instructions: Microsoft retired classic Content Search and classic eDiscovery (Standard) on May 26, 2025, and classic eDiscovery (Premium) on August 31, 2025. Tutorials built around the old Security & Compliance portal or the legacy export tool no longer match what you will see on screen.
Prerequisites
A license that supports eDiscovery export. Microsoft documents Enterprise E3 or E5, though your own tenant’s terms should be confirmed.
eDiscovery roles that include search and export permissions
Access to the case and the mailbox data
A defined scope covering mailboxes, dates and message types
The Process
Sign in at purview.microsoft.com with an authorized account, open eDiscovery and go to Cases.
Choose a case. Open an existing one or create a new case for this task.
Create a search. Select the Exchange Online mailboxes, then add keywords, senders, recipients or a date range if you need them. If the goal is to collect everything in scope, avoid adding filters by accident.
Run it and read the statistics. Make sure the expected mailboxes and messages appear. A surprisingly small result often points to criteria that are too tight.
Select Export. Name the export and choose the option that creates PSTs for messages.
Review the options. You will decide how to treat indexed and partially indexed items, whether to preserve the source folder structure, and how results are grouped when several sources are involved.
Track and download. Watch progress in Process manager, then download the packages and extract them.
Two Details That Cause Trouble
Partially indexed items may not have been fully tested against your search conditions. When completeness matters, ask the administrator or investigator in charge to decide how to handle them before you start.
The second detail is timing. Export packages expire 14 days after they are created, and expired packages are deleted automatically with no way to recover them. Download as soon as the export finishes.
Route Two: Classic Outlook
When the mailbox is already configured in the desktop app, classic Outlook is the fastest way to a PST and needs no administrator workflow.
Go to File, then Open & Export, then Import/Export.
Select Export to a file and then Outlook Data File (.pst).
Pick the account or folders, and enable Include subfolders if you want the folder hierarchy preserved.
Choose where to save the file and complete the wizard.
Outlook produces a copy and leaves the original mail where it is. This suits personal archiving, preparing for a migration, or creating a portable copy of one mailbox. One caution: only data that has synchronized to the desktop client can be exported, so check that older messages have downloaded first.
Route Three: New Outlook for Windows
The newer Outlook app has a built-in PST export too, but it requires a paid subscription on the account you are using.
Open New Outlook and select the Settings icon at the top right.
Choose Data files, then Export.
Click Get started and follow the wizard to select the mailbox or particular folders.
Save the PST to your chosen location and open it to confirm the right messages are inside.
Availability depends on version and account. If you do not see the option, fall back on classic Outlook or Purview.
What About PowerShell?
Many online guides suggest New-MailboxExportRequest, and that is misleading. The cmdlet applies to on-premises Exchange Server and is not a direct PST export method for Exchange Online. For an administrator-managed PST from Exchange Online, the supported path is the Purview eDiscovery workflow. PowerShell is still valuable for other Microsoft 365 administration and automation, just not as a replacement for the export itself.
Why Incomplete Exports Happen
A PST that opens fine can still be missing data. These are the usual causes:
Older emails are missing. Outlook has not finished synchronizing, so the messages were never on the device.
The Purview export button is unavailable. Roles, case permissions or license eligibility are lacking.
The file has fewer messages than expected. Mailbox scope, search filters, date range or partially indexed item settings may be too restrictive.
The export is very slow. The scope or data volume may be too large, so smaller batches can help.
The PST will not open. The download or extraction probably did not finish properly.
The Purview package is gone. The 14-day expiry has passed and a new export is needed.
A success message from the export process is not proof that the output is right. Always check the result against your purpose and scope.
Verifying the File You Created
Open the PST in a compatible Outlook application and work through this list:
Confirm that the expected mailbox and folders are present
Look at messages from several dates and folders
Open some attachments to be sure they work
Compare the contents with the source mailbox or the export reports
Store the file securely and keep the associated reports
For evidence, record how the data was collected and moved, and note a cryptographic hash such as SHA-256
Remember that a PST is not a full forensic record by itself. Legal or investigative use requires further preservation and documentation procedures.
When the Export Becomes Evidence
Cloud mail changes constantly. Accounts can be deleted or compromised, and messages can be edited or removed. A PST freezes a point in time that examiners can study offline, without a live connection to the server, which makes it useful for legal review, audits and incident response. If an admin account has been hijacked, earlier exports also give the organization something to compare against and restore from. Some businesses simply prefer to hold their own copies rather than rely on one provider.
Built-in tools can feel limiting at this stage. Licensing, permissions, expiring packages and filters that are easy to misconfigure add risk, and there is little support for documenting chain of custody. Specialized Email Forensics Software is designed for this situation. Tools of this kind usually connect to the cloud account, ingest selected mailboxes with date filters, let the examiner analyze the evidence and then save the output as a PST alongside a report. Many also generate hash values such as MD5, SHA-1 or SHA-256 to show the exported file has not changed since collection.
Final Thoughts
No single method wins in every case. Classic Outlook is the quick choice for a personal copy, New Outlook works where its export feature is offered, and Purview eDiscovery is the supported route for administrators and compliance teams. When the export may face scrutiny, add hash checks and thorough documentation regardless of the method.
Choose the route that matches your purpose, verify the output before relying on it, and keep your records. Those habits prevent most PST export problems.
