Before
proceeding on this task you have To create and run a Content Search, you have
to be a member of the
eDiscovery Manager
Compliance Search management role.
To delete messages, you have to be a member of
the
Organization Management role group or
Be
assigned the Search And Purge management role
Open "Microsoft Exchange Online Powershell Module" with run as admin permission and first you have to Connect
to Security and Compliance via PowerShell
Connect-IPPSSession -UserPrincipalName Nawaz@mydomain.com
and then run the commands below to create the compliance Search and save the result in a veriable ($Search).
$Search=New-ComplianceSearch -Name "RemovePhishingMessage"
-ExchangeLocation All -ContentMatchQuery '(Received:4/13/2020..4/14/2020)
AND (Subject:"Subject of the email")'
Now
you must Start the complainceSearch with the following command
Start-ComplianceSearch -Identity $Search.Identity
You
can confirm the status of the complianceSearch with the following command
PS C:\Users\Nawaz>
Get-ComplianceSearch ""RemovePhishingMessage
It
will show the status like, not started, inprogress, completed.
If
completed, you can run the following command which will show you the number of
items found through the compliance search, as mentioned in our case is 32.
PS C:\Users\Nawaz> get-ComplianceSearch "
RemovePhishingMessage"
| fl
RunspaceId
:
4bef9a2a-4a98-46a4-8e57-f593a43b1
Language
:
StatusMailRecipients
: {}
LogLevel
: Suppressed
IncludeUnindexedItems
: True
ContentMatchQuery
: (Received:07/09/2020..07/10/2020) AND (Subject:" Notice
Password")
SearchType
: EstimateSearch
HoldNames
: {}
SearchNames
: {}
RefinerNames
: {}
Region
:
Refiners
:
Items : 32
Size : 2911505
UnindexedItems
: 28319
UnindexedSize
: 79987919058
SuccessResults
: {Location: abit@mydomain.com,
Item count: 7, Total size: 608342,
Location: MUI@mydomain.com, Item count: 4, Total size: 324402,
Location: Mash@mydomain.com, Item count: 3,
Total size: 316067,
Location: Irfa@mydomain.com, Item count: 3, Total size: 299224,
Location: Moh@mydomain.com, Item count: 3, Total size: 298679,
Location: ath
ed@mydomain.com,
Item count: 3, Total size: 285691,
Location: Nawaz@mydomain.com, Item count: 3, Total size: 280505,
Location: Shahzad.Khurram@mydomain.com, Item count:
6, Total size: 259699,
Run
the command below if you want to soft delete the emails.
New-ComplianceSearchAction -SearchName "RemovePhishingMessage" -Purge -PurgeType SoftDelete
Run the command below if you want to hard delete the
emails.
New-ComplianceSearchAction -SearchName "RemovePhishingMessage" -Purge -PurgeType HardDelete
To show the status of all search
Get-ComplianceSearchAction
to confirm the status.
Get-ComplianceSearchAction -Identity "FromAl_purge" | Format-Table Searchname, JobStartTime, JobProgress, Status