How to search and delete email from users mailboxes in office 365

Before proceeding on this task you have To create and run a Content Search, you have to be a member of the

eDiscovery Manager

Compliance Search management role.

To delete messages, you have to be a member of the

Organization Management role group or

Be assigned the Search And Purge management role

Open "Microsoft Exchange Online Powershell Module" with run as admin permission  and first you have to Connect to Security and Compliance via PowerShell

Connect-IPPSSession -UserPrincipalName Nawaz@mydomain.com

and then run the commands below to create the compliance Search and save the result in a veriable ($Search).

$Search=New-ComplianceSearch -Name "RemovePhishingMessage" -ExchangeLocation All -ContentMatchQuery '(Received:4/13/2020..4/14/2020) AND (Subject:"Subject of the email")'



Now you must Start the complainceSearch with the following command


Start-ComplianceSearch -Identity $Search.Identity



You can confirm the status of the complianceSearch with the following command



PS C:\Users\Nawaz> Get-ComplianceSearch ""RemovePhishingMessage

It will show the status like, not started, inprogress, completed.

If completed, you can run the following command which will show you the number of items found through the compliance search, as mentioned in our case is 32.



PS C:\Users\Nawaz> get-ComplianceSearch "RemovePhishingMessage" | fl                                          



RunspaceId                            : 4bef9a2a-4a98-46a4-8e57-f593a43b1

Language                              :

StatusMailRecipients                  : {}

LogLevel                              : Suppressed

IncludeUnindexedItems                 : True

ContentMatchQuery        : (Received:07/09/2020..07/10/2020) AND (Subject:" Notice Password")

SearchType                            : EstimateSearch

HoldNames                             : {}

SearchNames                           : {}

RefinerNames                          : {}

Region                                :

Refiners                              :

Items                                 : 32

Size                                  : 2911505

UnindexedItems                        : 28319

UnindexedSize                         : 79987919058

SuccessResults                        : {Location: abit@mydomain.com, Item count: 7, Total size: 608342,

                                        Location: MUI@mydomain.com, Item count: 4, Total size: 324402,

                                        Location: Mash@mydomain.com, Item count: 3, Total size: 316067,

                                        Location: Irfa@mydomain.com, Item count: 3, Total size: 299224,

                                        Location: Moh@mydomain.com, Item count: 3, Total size: 298679,

                                        Location: athed@mydomain.com, Item count: 3, Total size: 285691,

                                        Location: Nawaz@mydomain.com, Item count: 3, Total size: 280505,

                                        Location: Shahzad.Khurram@mydomain.com, Item count: 6, Total size: 259699,



Run the command below if you want to soft delete the emails.

New-ComplianceSearchAction -SearchName "RemovePhishingMessage" -Purge -PurgeType SoftDelete

Run the command below if you want to hard delete the emails. 

New-ComplianceSearchAction -SearchName "RemovePhishingMessage" -Purge -PurgeType HardDelete

To show the status of all search

Get-ComplianceSearchAction 

to confirm the status.

Get-ComplianceSearchAction -Identity "FromAl_purge" | Format-Table Searchname, JobStartTime, JobProgress, Status