Microsoft 365 does not provide a native command to list users who created local .pst files because these files reside on client devices, not in the cloud. To identify such activity, administrators must use Endpoint DLP policies or PowerShell scripts that scan for specific file extensions on managed endpoints. This approach ensures accurate detection of local data storage outside the secure Exchange Online environment.
Understanding the Technical Limitation
The core issue with tracking .pst creation lies in the architecture of Microsoft 365. A .pst (Personal Storage Table) file is a local data format used by Outlook Desktop clients. When a user creates a .pst file, it is stored on their physical hard drive or network share, entirely outside the jurisdiction of Exchange Online servers. Consequently, server-side audit logs do not capture this event because no data ever touches the Microsoft cloud infrastructure during the creation process.
Attempting to query Exchange Online Audit Logs for a "PST Creation" event will yield no results. The system simply has no record of the action. Therefore, any solution must shift focus from server-side logging to client-side monitoring. Administrators need tools that can see what is happening on the endpoint device itself. This requires leveraging Microsoft Defender for Office 365 or Microsoft Intune, which have visibility into the file system of managed devices.
Method 1: Using Endpoint DLP Policies
The most robust and supported method for detecting .pst files is through Data Loss Prevention (DLP) policies within the Microsoft Purview compliance portal. This feature allows you to define conditions based on file types and locations. By creating a policy that looks for the .pst extension on local drives, you can generate alerts when such files are detected or created.
- Navigate to the Microsoft Purview compliance portal and select Data loss prevention from the left-hand menu.
- Click on Policies and then select Create policy.
- Choose Custom as the policy type and give it a descriptive name, such as "Detect Local PST Files".
- In the Conditions step, under "More resources", click File type. Add
.pstto the list of file types to monitor. - Under "Locations", ensure that Endpoints is selected. This tells the system to scan devices rather than just SharePoint or OneDrive.
- In the Actions step, choose Block access if you want to prevent the file from being saved, or Alert only if you merely want to log the event. For detection purposes, "Alert only" is recommended initially.
- Complete the wizard and publish the policy. It may take up to 24 hours for the policy to propagate to all managed endpoints.
Once active, whenever a user attempts to create or save a .pst file on a managed device, the DLP agent will trigger an alert. You can view these incidents in the Incidents & alerts section of the compliance portal, which will include the username, device name, and file path.
Method 2: Using Intune Compliance Policies
If your organization uses Microsoft Intune for device management, you can enforce restrictions that prevent the creation of .pst files altogether. While this does not provide a historical list of past creations, it stops future occurrences and provides logs of blocked actions.
You can configure a Configuration Profile in Intune that sets registry keys or folder permissions to restrict write access to common directories where Outlook might attempt to save PSTs. Alternatively, using Endpoint Security settings, you can enable specific DLP integrations that report violations back to the Intune dashboard. This method is particularly effective in environments where strict control over local data storage is required.
Method 3: PowerShell Scripting for Managed Devices
For organizations that require a one-time audit rather than continuous monitoring, a PowerShell script executed via Intune or Group Policy Object (GPO) can search local drives for existing .pst files. This script runs on the device and outputs a report containing the file paths and associated user profiles.
The following example demonstrates how to search the default user profile directory for .pst files:
$searchPath = "$env:USERPROFILE\Documents"
$files = Get-ChildItem -Path $searchPath -Recurse -Filter "*.pst" -ErrorAction SilentlyContinue
foreach ($file in $files) {
Write-Output "User: $env:USERNAME | Path: $($file.FullName)"
}This script should be deployed as a scheduled task or a startup script. The output can be redirected to a central log server or uploaded to Azure Blob Storage for analysis. Note that this method only detects files present at the time of execution and does not track real-time creation events.
Best Practices for Migration
Relying on local .pst files is generally discouraged in modern Microsoft 365 environments due to security risks and lack of backup integration. Instead, organizations should encourage the use of OST (Offline Outlook Data File) files, which are automatically synchronized with Exchange Online and included in standard backup procedures. If users need to archive emails, consider using Exchange Online Archiving or Microsoft 365 Retention Policies instead of manual PST exports.
For users who frequently switch between devices, ensuring they are using modern authentication and proper sync settings helps maintain data integrity without resorting to local storage solutions. If you need assistance with configuring out-of-office rules or adding accounts securely, refer to our guide on Setting Weekly Out-of-Office in Microsoft Outlook for related configuration tips.
Frequently Asked Questions
Can I use Exchange Online Audit Logs to find PST creation?
No, Exchange Online Audit Logs cannot detect PST creation because the files are stored locally on user devices and never interact with the Exchange server during creation. You must use endpoint-based tools like DLP or Intune to monitor local file system activities.
Does Microsoft 365 backup local .pst files?
No, Microsoft 365 does not back up local .pst files. These files are considered personal data on the client device. If the device fails or the file is deleted, the data is lost unless the user has performed a separate backup on their local machine or network drive.
How long does it take for a DLP policy to start working?
After publishing a DLP policy, it typically takes between 15 minutes to 24 hours for the policy to propagate to all managed endpoints. During this time, new incidents may not be captured until the DLP agent on the device receives the updated policy definitions.
What is the difference between a PST and an OST file?
A PST file is a local archive stored on the user's hard drive and is not synced with the server, while an OST file is a cached copy of the mailbox on the server that synchronizes automatically with Exchange Online. OST files are safer and included in server-side backups, whereas PST files are not.
Can I block .pst file creation entirely?
Yes, you can block .pst file creation by configuring a DLP policy action to "Block access" when a .pst file is detected. Additionally, Intune configuration profiles can restrict write permissions to folders commonly used for PST storage, effectively preventing users from saving new files in those locations.