Search for and delete email messages in your Office 365 organization

August 2, 2019 | by iaur | posted as Compliance, Exchange Online

Scenario: Admin needs to delete emails on certain folder on a certain time

Example: Delete items in the sent folder of admin@faceresionem.onmicrosoft.com sent on 7/12/2019

  • Get Targeted Collection & Folder ID of the Sent Folder from target user mailbox
  • Create a Content Search
    1. Go to https://protection.office.com.
    2. Sign in to Office 365 using the account and credentials that you used to run the script in Step 1.
    3. In the left pane of the Security & Compliance Center, click Search > Content search, and then click New 

.

  • On the New search page, type a name for the Content Search. This name has to be unique in your organization.

Query : folderid:07D918FDB06F1347B1CDCDBD245CB4630000000001090000 AND (sent:07/12/2019)

Location : Specific Location (admin@facerionem.onmicrosoft.com)

Search Name: Twerrwr

 reference on the search query: https://docs.microsoft.com/en-us/office365/securitycompliance/keyword-queries-and-search-conditions (folderid and sent:)

Preview:

To get the Search Names available

Get-ComplianceSearch

Use “Twerwrw” search preview and apply ComplianceSearchAction to purge the email accordingly

New-ComplianceSearchAction -SearchName “Twerwrw” -Purge -PurgeType SoftDelete

-PurgeType

The PurgeType parameter specifies how to remove items when the action is Purge. Valid values are:

  • SoftDelete: Purged items are recoverable by users until the deleted item retention period expires.
  • HardDelete: Purged items are marked for permanent removal from the mailbox and will be permanently removed the next time the mailbox is processed by the Managed Folder Assistant. If single item recovery is enabled on the mailbox, purged items will be permanently removed after the deleted item retention period expires.

From <https://docs.microsoft.com/en-us/powershell/module/exchange/policy-and-compliance-content-search/new-compliancesearchaction?view=exchange-ps>

To check the status of the purge action

Get-ComplianceSearchAction

References

https://docs.microsoft.com/en-us/office365/securitycompliance/use-content-search-for-targeted-collections#step-1-run-the-script-to-get-a-list-of-folders-for-a-mailbox-or-site

https://www.codetwo.com/admins-blog/new-compliancesearch-new-version-of-search-mailbox/

Feedback or Help?

Should you have one, click here

Boring Ads. Pardon me :)