You can create a saved search query from the email archive or from Management > Cloud applications protection. You can use a saved search query in retention rules or legal hold rules, or run it in the ...