Message tracking in Exchange Online can be performed graphically as well as in PowerShell. In this post I will show how to track messages with PowerShell. And you will get a script which you can use in your environment. Let’s jump in.
Prerequisites
If not already done, we need to install the Exchange Online Management Module and connect to Exchange Online.
Install-Module ExchangeOnlineManagement -Force -AllowClobber
Connect-ExchangeOnline
Message Tracking in PowerShell
Next, I’ll show you 4 examples of how you can perform message tracking for a mailbox to display the output either in the console, in a file, or in a separate window.
Get-MessageTrace -SenderAddress user@domain.com -StartDate 08/10/2022 -EndDate 08/20/2022 # Max. 10 Tage
Get-MessageTrace -SenderAddress user@domain.com -StartDate 08/10/2022 -EndDate 08/20/2022 | Out-GridView
Get-MessageTrace -SenderAddress user@domain.com -StartDate 08/10/2022 -EndDate 08/20/2022 | Out-File $home\trace.txt
Get-MessageTrace -SenderAddress user@domain.com -StartDate 08/10/2022 -EndDate 08/20/2022 | Export-Csv $home\trace.csv
To display all mails sent to a specific recipient this command can be used.
Get-MessageTrace -RecipientAddress user@domain.com -StartDate 08/10/2022 -EndDate 08/20/2022
You do not know exactly the sender or recipient address? No problem, we can work with wildcards.
Get-MessageTrace -RecipientAddress user@domain.com -StartDate 08/10/2022 -EndDate 08/20/2022 |
Where-Object SenderAddress -like "*.*udemy*"
Get-MessageTrace -SenderAddress user@domain.com -StartDate 08/10/2022 -EndDate 08/20/2022 |
Where-Object RecipientAddress -like "*win*"
Note that searching for e-mails is limited to 10 days in the past. However, there is a workaround which is called Historic Search.
Start-HistoricalSearch -ReportTitle "TestSearch" -StartDate 6/1/2022 -EndDate 8/1/2022 -ReportType MessageTrace `
-SenderAddress user@domain.com -NotifyAddress user@domain.com
Get-HistoricalSearch
I hope this overview was helpful for you.
Categories: Microsoft 365, PowerShell
My name is Patrick Gruenauer. From Austria.
SID-500.COM 
1 reply »