How to Find Sensitive Data in Exchange Online Mailboxes

Someone sends a spreadsheet to payroll. A customer replies with personal information. A shared mailbox keeps years of attachments because nobody knows which messages still need to be there.

Even when a business has organized file shares, email can remain an overlooked store of sensitive information. Finding it is the first step toward deciding what should be retained, who should have access and what needs attention.

DataScope supports that review by scanning selected Exchange Online user and shared mailboxes for sensitive data in messages and supported attachments. Findings connect the sensitive pattern to its mailbox, folder and message, giving your team a practical starting point.

Choose the mailbox scope before scanning

Start with a business process. HR, accounting and customer support may each handle different categories of information and have different owners. Select a manageable group of mailboxes and agree on the purpose of the review.

• Which mailboxes are included, and who is responsible for them?
• Which sensitive data categories are relevant to the review?
• Who should receive findings and decide what happens next?
• What retention requirements or existing preservation instructions must the owner consider before cleanup?

Confirm the tenant permissions needed for your selected collection features. DataScope runs on your own server and connects to the Microsoft 365 sources you authorize. Read more about keeping the governance platform in your environment.

Review findings without creating another spreadsheet of sensitive values

A useful finding should help an owner locate and assess the message. It should not require copying a full personal record into a separate tracking sheet.

DataScope provides masked evidence and message context. Mailbox owner reports, when enabled, include links to open affected messages in Outlook. The owner can review the actual message in the source application and decide whether it still serves a business purpose.

Illustrative example: an accounting mailbox contains an old attachment with a supported payment data pattern. The owner follows the report’s Outlook link, reviews the business need and checks the applicable retention instructions. If cleanup is appropriate, the owner handles it in Outlook and records the follow up.

Ask who else can access the mailbox

Finding sensitive email answers what is stored. Reviewing mailbox delegates helps answer who has access around it.

When delegate collection is enabled, DataScope shows Full Access, Send As and Send on Behalf permissions. These permissions have different purposes and should be reviewed in that context. Sending on behalf of a mailbox should not be treated as equivalent to Full Access.

Connect the finding with the mailbox owner, review the business need for each delegation and route approved access changes to the appropriate administrator. Where audit collection is enabled and records are available, collected delegate and administrator activity can provide additional investigation context.

Let owners make decisions, then verify progress

DataScope does not move or delete customer email. Owners review and clean up messages in Outlook. A later scan shows which findings remain, helping the team distinguish an assigned task from a verified outcome.

1. Confirm that the finding belongs in the review scope.
2. Send the owner masked evidence and the message link.
3. Record the decision and route any access changes to IT.
4. Let the owner complete approved cleanup in Outlook.
5. Review the next scan and investigate findings that remain.

A repeatable process is more useful than an occasional mailbox cleanup with no record of what changed.

Keep collection limits visible

DataScope scans selected mailboxes, messages and supported attachments. Online archive mailboxes are not scanned. Encrypted email is shown as uninspected rather than treated as clean.

A review should record those gaps alongside its findings. No detected sensitive content in the scanned material does not establish that every message in the organization was inspected.

Make email part of your wider governance program

The Microsoft 365 add on also covers SharePoint and OneDrive discovery, sharing exposure and other governance features. Our Microsoft 365 data governance guide connects those areas.

For a small IT team, the practical starting point is one mailbox group, named owners and a clear review process. DataScope’s annual pricing includes support and updates; use the pricing calculator to estimate combined On Prem and Microsoft 365 coverage.