In the case an email should be found and removed from a large number of inboxes, you can find the email using Microsoft 365 Security and Compliance Search, then run an action to remove it.


The documentation states that this requires Exchange Powershell. My experience has been that the commands are not recognized within that module. Use the below connection.


Connect to the service - step 1

Connect-ExchangeOnline


Connect to the service - step 2

Connect-IPPSSession -UserPrincipalName <UPN>


Create the search

New-ComplianceSearch -Name "An Email Search" -ExchangeLocation All -ContentMatchQuery 'From:[email protected]'


Refine the search.

This example has a date range and subject specified in the query.

New-ComplianceSearch -Name "An Email Search" -ExchangeLocation All -ContentMatchQuery '(Received:6/26/2023..6/27/2023) AND (Subject:"An email not to be seen")'


This example searches specific folders in a specific mailbox.

New-ComplianceSearch -Name "An Email Search" -ExchangeLocation [email protected] -ContentMatchQuery "((folderid:3B927126EF666C45810642B802ECCF370000000001410000) and (folderid:3B927126EF666C45810642B802ECCF370000000001610000) and (folderid:3B927126EF666C45810642B802ECCF370000000001630000))"


Start the search; creating the search doesn't start it.

Start-ComplianceSearch -Identity "An Email Search"


Perform an action on the results; once you have the results, do something with it.

New-ComplianceSearchAction -SearchName "An Email Search" -Purge -PurgeType SoftDelete