Microsoft Purview eDiscovery: search statistics, partially indexed items and export errors

eDiscovery in the Microsoft Purview portal searches the indexes behind Exchange, SharePoint and OneDrive, so most failures come down to a location it can't resolve, a query that's too big, a tenant-wide job limit or items the index never fully read. In this post I'll match the errors Microsoft documents to their causes, walk through the fixes and show how to prove an export is complete.

Symptoms#

One or more of these appear when the search runs, when the export starts, or in the reports inside the downloaded package:

The compliance search contains the following invalid location(s): <mailbox identifier>. The location <mailbox identifier> is ambiguous.
Recipient not found
CS007
Internal server error (500) occurred
Your request can't be started because the maximum number of jobs for your organization are currently running.
Export failed with error type: 'FailedToExportItem'. Message: Item has been moved or deleted.
Export failed with error type: 'FailedToExportItem'. Message: Unable to retrieve item due to timeout after multiple retries.
This file wasn't exported because it doesn't exist anymore.
This search result was not downloaded as it is a folder or other artifact that can't be downloaded by itself, any items inside the folder or library will be downloaded.
The file name(s) would be too long for the destination folder.

A quieter symptom: the export holds a different number of items than the search statistics suggested.

Why it happens#

• Location problems. "Ambiguous" means the identifier you added is used by more than one object in Microsoft 365. "Recipient not found" usually means a new or changed recipient hasn't finished synchronizing.
• Oversized queries. CS007 can be transient, but both CS007 and the 500 error also appear when a query returns more results than the service can process, typically several wildcards across many locations.
• Job quota. An organization can run 50 search and export jobs at once. Exports take longest, so forgotten exports usually fill the quota.
• Index gaps. Partially indexed items are mailbox items and SharePoint or OneDrive documents the index couldn't fully read: unsupported or unreadable attachments, too many or too-large attachments, and files encrypted with non-Microsoft tools or with a sensitivity label that applies encryption. A keyword that appears only inside such a file can't match.
• Index lag. SharePoint and OneDrive results come from the SharePoint index. If a file is renamed, moved or deleted after the search but before the index catches up, the export can't find it. In mailboxes, temporary backup items created during mailbox archival can be searched but not exported.
• Export rules. Files restricted by a DLP action, sites locked with NoAccess, and files behind SharePoint access restrictions (unless the collecting user has direct access, for example as site owner) can show in statistics but are left out of the export.

How to fix it#

1. Confirm permissions and licensing#

Case users need eDiscovery permissions, normally through the eDiscovery Manager role group; members added as eDiscovery Administrators can see every case and export in the tenant. Microsoft's export guidance also expects the exporting account to have a Microsoft 365 E3 or E5 license, plus a SharePoint license for SharePoint content, or SharePoint items might not export as expected.

2. Fix location errors#

Connect to Security & Compliance PowerShell and look up the identifier from the message:

Connect-IPPSSession
Get-Recipient -Identity "jsmith@contoso.com" | Format-List Name,RecipientType,PrimarySmtpAddress

For an ambiguous location, find the duplicate or conflicting object that uses the same identifier, remove or correct it, and rerun the search. For "Recipient not found", no result means the object hasn't synchronized yet: wait about 30 minutes, check again, then retry.

3. Split oversized searches#

Retry once for CS007. If it fails again, or you get the 500 error, narrow the scope: add a date range, search fewer locations at a time and use fewer wildcards.

4. Free up job slots#

As an eDiscovery Administrator, list the exports that are still running:

$exports = @(Get-ComplianceSearchAction -Export -ResultSize Unlimited)
foreach ($case in Get-ComplianceCase | Where-Object { $_.Status -like "Active" }) {
    $exports += Get-ComplianceSearchAction -Export -Case $case.Name
}
$exports | Where-Object { "$($_.Results)" -notmatch "Export status: (Completed|none)" } |
    Sort-Object JobStartTime -Descending | Format-Table Name, JobStartTime, Status

Wait for some to finish, or remove the ones nobody needs with Remove-ComplianceSearchAction -Identity "<name>", then retry.

5. Decide how to handle partially indexed items#

The partially indexed setting on the search only affects statistics and previews; the export dialog makes the real decision. In eDiscovery › Cases › (your case) › Searches, open the search, select Export and pick one option:

• Indexed items that match your search query
• Indexed items that match your search query and partially indexed items that might not match query
• Partially indexed items that might not match query

To limit volume, also select Exclude partially indexed items in locations without search hits. It works per location: in a mailbox or site with at least one indexed hit, every partially indexed item is included, whatever path or property conditions your query has. To apply the query's conditions to those items, select Perform advanced indexing on partially indexed items.

6. Read the export reports#

• FailedToExportItem with "Item has been moved or deleted" or the timeout message: the item is a temporary backup from mailbox archival. Wait until the original items can be retrieved, then export again.
• "This file wasn't exported because it doesn't exist anymore", or File Not Found in trace.log: the index still lists a renamed, moved or deleted file. Request a reindex of the site or library and rerun the search if you need those files.
• The folder message in Skipped Items.csv is informational: the items inside the folder are exported.

7. Download and unzip cleanly#

Search exports expire 14 days after you create them, and an export that runs more than seven days is canceled automatically, so split very large jobs by date range or source. Use a current Microsoft Edge, allow pop-ups and automatic downloads for the Purview portal, and make sure your proxy or firewall allows the export endpoints. If the built-in Windows extractor fails with the "too long" message, use a tool such as 7-Zip or export again with the option to condense paths.

Verify the fix#

1. In Process manager, the export finishes with the expected number of locations and items.
2. PowerShell shows the searches as completed: Get-ComplianceSearch -Case "<case name>" | Format-Table Name,Status,Items,Size.
3. Export Warnings and Errors.csv is empty or only lists entries you can explain, and Skipped Items.csv only lists folders.
4. The item count in items.csv is close to the statistics. Expect some difference: statistics are an estimate, and versions, cloud attachments, conversation context and your partially indexed choice all change the total.

Prevent it next time#

• Run Generate statistics before big exports. With current statistics, the export only processes locations that have hits; settings.csv in the export report shows whether that optimization applied.
• Delete finished or abandoned exports so the 50-job quota stays free.
• Scope by date and location from the start, and record your partially indexed choice for each matter.
• eDiscovery access leaves a trail: exporting SharePoint items can record FileAccessed events, which you can review with an audit log search.
• Holds and retention decide what's still there to find; see retention policies, labels and litigation hold.

References#

• Resolve search errors in eDiscovery (Microsoft Learn)
• Export search results in eDiscovery (Microsoft Learn)
• Partially indexed items in eDiscovery (Microsoft Learn)