You must have the Search and Purge role or the Preview role assigned within the Microsoft Defender portal.
If the email has already been permanently deleted or moved to a location unreachable by the automated investigation tools, the download option may be disabled. microsoft 365 defender download email greyed out
The fix usually involves adjusting specific administrative permissions or checking the current state of the email within the system. Why the Download Button is Greyed Out You must have the Search and Purge role
The ability to download emails for forensic analysis is restricted to prevent unauthorized data exfiltration. Even if you are a Global Admin, you might not have the specific "Action" rights required for this task. Why the Download Button is Greyed Out The
If you are trying to investigate a suspicious message and find the "Download Email" button greyed out in Microsoft 365 Defender (now Microsoft Defender for Office 365), you aren't alone. This is a common hurdle for security analysts.
Standard administrative roles often lack the "Manual Actions" permissions needed to interact with the raw email file.
Some organizations disable email downloads entirely via tenant-level security policies to comply with strict data privacy laws (like GDPR). How to Fix the Greyed Out Download Email Option