How to download emails from M365 defender or MS Purview for analysis purposes as our SecOps team wants this capability to download emails and do their analysis on those emails which were delivered to end users?

Vinod Survase 4,721

Shaofan Lv-MSFT 6,915 Reputation points Microsoft Vendor

2023-10-13T02:44:49.67+00:00

Hi @Vinod Survase

Just wanted to check if the answer shared below helped. If it helped, then would request you to please "Accept the answer" as it would be helpful to others in the community as well.
Vinod Survase 4,721 Reputation points

2023-10-13T10:53:38.71+00:00

Hi Shaofan Lv-MSFT

Thanks for checking-in. The steps mentioned in the article does not match with M365 defender and but I was able to create the role group in MS Purview and assigned it to users but its not working as expected.

See my below reply to original message.
JamesTran-MSFT 36,531 Reputation points Microsoft Employee

2023-10-20T16:53:36.21+00:00

@Vinod Survase

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

2 answers

Andy David - MVP 144.4K Reputation points MVP

2023-10-12T10:46:22.8366667+00:00

You can add them to the required role:

https://video2.skills-academy.com/en-us/microsoft-365/security/office-365-security/mdo-email-entity-page?view=o365-worldwide#email-preview-and-download-for-cloud-mailboxes
Please sign in to rate this answer.
Vinod Survase 4,721 Reputation points

2023-10-13T10:40:13.4066667+00:00

Hi Andy David - MVP

Thanks for reply on this. I have created the role and added SecOps team members but still not working as expected.

Here is snap where the SecOps admin not able to see Download and Preview button as it shows greyed out.

Can you tell me what could be the reason or what else we need to do on this to get this done.

This is not working in M365 defender as well.
Sign in to comment
Shaofan Lv-MSFT 6,915 Reputation points Microsoft Vendor

2023-10-16T09:55:27.1233333+00:00

Hello @Vinod Survase

When I followed the steps below, everything worked fine. Could you provide a screenshot of this role group?

Create Email & collaboration role groups in the Microsoft 365 Defender portal

Or you could check to see if it is normal for now. It may take time to change.

Regards

Shaofan
Please sign in to rate this answer.
Vinod Survase 4,721 Reputation points

2023-10-16T11:40:04.6+00:00

Hi
Shaofan Lv-MSFT

Thanks for reply. I dont see the settings which is mentioned in the above link the one which you shared in our tenant inside Defender portal.

Vinod Survase 4,721 Reputation points

2023-10-16T11:42:23.6966667+00:00

Hi
Shaofan Lv-MSFT

I have created a role group in MS purview but its not working as expected so not sure why and where it is lacking.

Shaofan Lv-MSFT 6,915 Reputation points Microsoft Vendor

2023-10-17T01:56:35.28+00:00

This is a bit strange. If it does not work in the Purview portal, please remove the role group you created in the Purview portal and then re-create it in the Defender portal. Make sure not to miss any steps.

If you don't see the setting item, please click this link directly:
https://security.microsoft.com/emailandcollabpermissions

The same role groups and roles are available in the Defender portal and in the Purview compliance portal:

Defender portal: Permissions > Email & collaboration roles > Roles or directly at https://security.microsoft.com/emailandcollabpermissions

Purview compliance portal: Roles & Scopes > Permissions > Microsoft Purview solutions > Roles or directly at https://compliance.microsoft.com/compliancecenterpermissions

Shaofan Lv-MSFT 6,915 Reputation points Microsoft Vendor

2023-10-18T07:54:15.76+00:00

Hello @Vinod Survase
How's it going? Is it normal to recreate in Microsoft defender?
Sign in to comment