A PST file is an Outlook data file, formally a Personal Storage Table, that holds a user's messages and other Outlook items such as contacts, appointments and tasks. It lives on a disk, often a laptop. For security and compliance teams that means email can exist outside the mailbox, where central retention and search may not reach it.
What does a PST file contain?
Microsoft's open specification, MS-PST, describes the Outlook Personal Folders file format. A file represents a message store holding an arbitrary hierarchy of folders, which contain messages, which can contain attachments. In plain terms it is a portable container for a mailbox, in a single file you can copy, email or put on a USB stick.
Microsoft's support documentation says people use these files to back up messages or to store older items locally so their mailbox stays small. It also says that if you use a POP or IMAP account, all of your Outlook information is stored in an Outlook data file.
Why is it a security and compliance concern?
The risk comes from where the data sits, not from the format.
Data outside central control. Years of mail with contracts, customer details and credentials in attachments can sit in a file on one laptop. If that laptop is lost or compromised, the mailbox protections your organization applied do not follow the file.
Search gaps. Microsoft notes that by default, classic Outlook's search tools search only the current mailbox. Additional data files on the computer are not searched unless the user changes the scope to All Mailboxes. A central search or legal hold may miss data that a user's local search also misses.
Retention mismatch. If policy says delete after a set period, a local archive can keep the same mail indefinitely.
Portability. Because a PST is a normal file, it moves through file shares, sync folders and removable media with no special step.
Tooling direction. Microsoft's page says it plans to add bulk import of mail, calendar and contacts from a PST into a mailbox, and after that has no further investments planned. That suggests the format is something to migrate away from rather than build on, though you should read the current page for the exact status.
A constructed example
A legal team receives a hold notice covering a former employee's communications. The mailbox is preserved. The employee had also archived eight years of mail into a PST on a desktop that was later reimaged. The archive was never in scope because nobody knew it existed. Finding it before disposal would have taken minutes. Finding it after would not be possible.
How to check or apply this
- Inventory PST files on managed endpoints with your endpoint management or file discovery tooling, and record owner, size and last modified date.
- Decide the policy: forbid new PST files, or allow them only with an owner and an expiry.
- Migrate valuable archives into the mailbox or a managed archive, then remove the local copies.
- Make sure endpoint disk encryption is on, so a lost laptop does not expose archives.
- Include local data files in legal hold and discovery procedures.
- Block PST files at email gateways and file shares if your policy forbids moving them around.
- Add PST discovery to offboarding so a departing employee's archives are collected or deleted deliberately.
What should you tell users?
Most people create archives with good intentions: a mailbox size limit, a wish to keep old projects, a fear of losing mail. Banning PST files without an alternative just makes them hide the files better. Offer a place for long-term mail that is searchable and under retention policy, and explain the reason in one paragraph: archives on a laptop are invisible to legal hold and lost with the laptop.
Give a deadline and help with the move. A short guided migration for the biggest archives usually clears most of the problem.
Quick check
Is a PST file the same as my mailbox?
Not exactly. A mailbox lives on a server, while a PST is a file on a disk. With POP or IMAP accounts, though, Outlook keeps your data in a data file, so the PST is the primary copy.
Does Outlook search PST files by default?
Microsoft says classic Outlook searches only the current mailbox by default. Other data files are searched only if the user changes the search scope.
Sources
- Microsoft Learn: MS-PST, Outlook Personal Folders (.pst) File Format, fetched 18 October 2026.
- Microsoft Support: Introduction to Outlook Data Files (.pst and .ost), fetched 18 October 2026.
Last reviewed: 18 October 2026.
