--- title: "Delete Email from All Office 365 Mailboxes: Step-by-Step" description: "Use Security and Compliance PowerShell cmdlets to search and delete email from all Office 365 mailboxes and prevent attacks." canonical: "https://adamtheautomator.com/office-365-delete-email/" --- # Delete Email from All Office 365 Mailboxes: Step-by-Step > Use Security and Compliance PowerShell cmdlets to search and delete email from all Office 365 mailboxes and prevent attacks. Source: https://adamtheautomator.com/office-365-delete-email/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Delete Email from All Office 365 Mailboxes: Step-by-Step](https://adamtheautomator.com/wp-content/uploads/2020/07/keyboard-155722_1280.jpg) # Delete Email from All Office 365 Mailboxes: Step-by-Step [![](https://secure.gravatar.com/avatar/9a14f10ff1b1ec7d790d34f5b559e4d3de2d31b172e6ef266dfd8b479174d97b?s=192&d=mm&r=g)June Castillote](https://adamtheautomator.com/author/june/)2 July 20206 min. read Categories: [Cloud](/category/cloud/) Tags:[Office 365](/tag/office-365/) Table of Contents * [Requirements](#h-requirements) * [Gathering Information About the Message to Delete](#h-gathering-information-about-the-message-to-delete) * [Creating and Running the Office 365 Email Content Search](#h-creating-and-running-the-office-365-email-content-search) * [Previewing the Search Results (Optional)](#h-previewing-the-search-results-optional) * [Delete Email From All Mailboxes In Office 365](#h-deleting-the-messages) * [Conclusion](#h-conclusion) * [Further Reading](#h-further-reading) It is no secret that mail hygiene solutions are not 100% effective. Malicious messages still make their way through without being detected from time to time. In those times, you need to know how to find and delete email from all mailboxes in Office 365. Not a reader? Watch this related video tutorial! **_Not seeing the video? Make sure your ad blocker is disabled._** If you are an [Office 365](https://adamtheautomator.com/tag/office-365/) admin, you would be familiar with the situation described above. Spam or Phishing attacks are considered as critical security incidents. Needless to say, email admins must act quickly to minimize the potential threat to the users and the infrastructure. You can click around in the Office 365 Security and Compliance portal to run a content search, but, to delete those contents, you need to use PowerShell. So, if you’ll end up using PowerShell anyway, why not do everything in PowerShell, right? In this article, you will learn how to use the Security and Compliance PowerShell cmdlets to search and delete malicious messages from all Office 365 mailboxes. ## Requirements Since this article is essentially a _How-To_, there are some requirements if you plan to follow along. * Your admin account must have enough _[Office 365 permissions](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/permissions-in-the-security-and-compliance-center?view=o365-worldwide)_ to search mailboxes and delete messages. – **Permission required to search mailboxes**: The account must be a member of the _eDiscovery Manager_ role group or be assigned the _Compliance Search_ management role. – **Permission required to delete messages**: The account must be a member of the _Organization Management_ role group or be assigned the _Search And Purge_ management role – **Permission required to preview messages**: The account must be a member of the _eDiscovery Manager_ role group or be assigned the _Preview_ management role * PowerShell must be connected to the _[Office 365 Security & Compliance Center PowerShell](https://docs.microsoft.com/en-us/powershell/exchange/office-365-scc/office-365-scc-powershell?view=exchange-ps)_. Follow this link to _[connect without MFA](https://docs.microsoft.com/en-us/powershell/exchange/office-365-scc/connect-to-scc-powershell/connect-to-scc-powershell?view=exchange-ps)_, or this link to _[connect with MFA](https://docs.microsoft.com/en-us/powershell/exchange/office-365-scc/connect-to-scc-powershell/mfa-connect-to-scc-powershell?view=exchange-ps)_. ## Gathering Information About the Message to Delete Before you start creating the content search for the message that needs to be deleted, you must gather all the pertinent information about the message first. Not unless all information is provided to you already. Knowing as many details about the message as possible would help you decide how to formulate the search query. For example, some of the most basic information you need to get are: * What is the sender’s email address? * What is the message subject? * Are there file attachments, and what are the filenames? * What’s the date of the first reported occurrence? * Who are the recipients? In most cases, one or two of the information listed above should be sufficient to formulate a search query. Then, it is up to you to determine which of these search parameters would be most applicable. ## Creating and Running the Office 365 Email Content Search When you’re satisfied that you have all the information you need about the message, it is time to fire up [PowerShell](https://adamtheautomator.com/tag/powershell/) and start creating the content search. Suppose the spam/phishing message to delete has the following properties: * **Subject**: You must change your bank password now * **Sent**: 05/12/2020 Using the [`New-ComplianceSearch`](https://docs.microsoft.com/en-us/powershell/module/exchange/policy-and-compliance-content-search/new-compliancesearch?view=exchange-ps), the message properties listed above will be used to create a search query. The key to keeping the search results as accurate as possible depends on the adequately formulated search criteria. The `New-ComplianceSearch` cmdlet comes with several parameters and switches. However, to create a mailbox content search, these are the parameters that will be used. * `Name` – This accepts the name that will be assigned to the content search object. This can be any name, you don’t need to put too much thought into it. * `ExchangeLocation` – This accepts that Exchange location that will be targeted by the search. This can be a group or a mailbox. In this article, the value to use is _All_ to make sure to target all mailboxes in the search. * `ContentMatchQuery` – This parameter is the main factor that will determine the search results’ accuracy. The query format that is accepted is in the form of a KQL or [_Keyword Query Language_](https://docs.microsoft.com/en-us/sharepoint/dev/general-development/keyword-query-language-kql-syntax-reference). To create the content search, copy the code below and paste it into your PowerShell console. Make sure to change the parameter values as appropriate to your situation. In this example, the name of the search is _Phish1_, the query combines the subject and sent property values. ```powershell New-ComplianceSearch ` -Name Phish1 ` -ExchangeLocation All ` -ContentMatchQuery 'subject:"You must change your bank password now" AND sent:05/12/2020' ``` > _Visit the [Keyword queries and search conditions for Content Search](https://docs.microsoft.com/en-us/microsoft-365/compliance/keyword-queries-and-search-conditions?view=o365-worldwide) page to learn more about using keywords in content search._ When you run the code above in PowerShell, you should see a similar output as demonstrated below. ![Delete Email From All Mailboxes In Office 365 : Creating a new content search](https://adamtheautomator.com/content/images/2020/05/New-ComplianceSearch.gif) Delete Email From All Mailboxes In Office 365 : Creating a new content search At this point, the content search job has been created, but the search hasn’t been triggered yet according to the status (_NotStarted)._ To start the content search, use the `Start-ComplianceSearch` cmdlet. You need to supply the cmdlet with the parameter `-Identity` and specify the name of the content search job that you created. To start the Office 365 email content search, copy the code below and paste it into your PowerShell console. ```powershell Start-ComplianceSearch -Identity Phish1 ``` After running the code above, there will be no output on the screen. What you need to do next is to monitor the status of the search. To monitor the search status, use the code below in PowerShell. ```powershell Get-ComplianceSearch -Identity Phish1 ``` When you run the code above, you should see a similar output as below. In the output below, it shows that the content search job status is _Completed_. ![Getting the content search status](https://adamtheautomator.com/content/images/2020/05/Get-ComplianceSearch.gif) Getting the content search status You’ll notice from the output above that the returned properties are limited and it does not show you the number of found matches. You can run the command below to get all the properties of the content search result. ```powershell Get-ComplianceSearch -Identity Phish1 | Format-List * ``` After running the command above, you would see a similar result, as shown below. In this case, there are 16 items that matched the search criteria. ![Content search results](https://adamtheautomator.com/content/images/2020/05/Untitled---2020-05-12T194629.230.png) Content search results ## Previewing the Search Results (Optional) Previewing the search results is an optional step, but recommended if you’re the type who’d rather err on the side of caution. You wouldn’t want to delete the wrong message from all mailboxes, would you? So far, you’ve used the `New-ComplianceSearch`, `Start-ComplianceSearch`  and `Get-ComplianceSearch` cmdlets to create, run, and monitor the content search. Now, to be able to preview the search results, you will need to use the `New-ComplianceSearchAction` cmdlet. To preview the search results, you now need to create a preview action using the command below. ```powershell New-ComplianceSearchAction -SearchName Phish1 -Preview ``` As you can see in the output below, the preview job has been created with the name _Phish1\_Preview,_ and the job is automatically started. ![Phish1\_Preview](https://adamtheautomator.com/content/images/2020/05/New-ComplianceSearchAction.gif) Phish1\_Preview And when the creation of the preview is completed, you can get the results preview by running the command below to show the results on the screen. ```powershell (Get-ComplianceSearchAction Phish1_Preview | Select-Object -ExpandProperty Results) -split "," ``` And once you run the command above, you would get an output similar to the image shown below. ![Previewing the search results](https://adamtheautomator.com/content/images/2020/05/Untitled---2020-05-12T194657.608.png) Previewing the search results Let’s admit it, the results, as shown above, is ugly. However, you can export the results to a TXT if you prefer. Or, if you want a better-formatted report, you can _[download the content search report from the Security and Compliance Center](https://docs.microsoft.com/en-us/microsoft-365/compliance/export-a-content-search-report?view=o365-worldwide#step-2-download-the-report)_ portal. > _Note: The Preview action does not expose the contents of the messages. It only shows the details of the message matching the search criteria and not what’s inside of each message._ ## Delete Email From All Mailboxes In Office 365 Now for the final act; running the Office 365 delete email action. Suppose that you’re already satisfied with the search results. You’re now ready to run the message deletion process. To delete the messages that matched the search criteria, you need to create a purge job using the `New-ComplianceSearchAction` cmdlet with the `-Purge` switch and `-PurgeType` parameter. The code to create the purge job is shown below. Copy the code and paste in PowerShell to run it. ```powershell New-ComplianceSearchAction -SearchName Phish1 -Purge -PurgeType SoftDelete ``` Note that the `-PurgeType SoftDelete` parameter/value would remove the messages and put them in the Deletions folder inside the Recoverable Items folder in the mailbox. This means that the message would still be recoverable if necessarry. After running the code above, the purge job will be created and started. ![Create the message purge job](https://adamtheautomator.com/content/images/2020/05/Purge_Message.gif) Create the message purge job As you can see on the image below, the purge job is created with the name _Phish1\_Purge,_ and it automatically started. ![Purge job is created and started](https://adamtheautomator.com/content/images/2020/05/Untitled---2020-05-12T194728.717.png) Purge job is created and started When the purge is complete, you can view the final result using the command below. ```powershell Get-ComplianceSearchAction -Identity Phish1_Purge | Format-List ``` You would be presented with similar output, as shown below. In this example, there were 16 messages deleted, and none failed. ![Message purge job is complete](https://adamtheautomator.com/content/images/2020/05/Untitled---2020-05-12T194741.732.png) Message purge job is complete And that’s it. You have successfully deleted the spam/phishing messages from all Office 365 mailbox. ## Conclusion In this article, you learned how to use the Security and Compliance PowerShell [cmdlets](https://adamtheautomator.com/powershell-whatif/) to search and delete messages from all mailboxes in Office 365. You’ve learned how to put together the details of the message to delete for refining search criteria. Refining the search criteria helps ensure that the results will be at the highest accuracy. You also learned how to create and start the content searches, create a preview of the results, and ultimately purge the messages that matched the search criteria. Perhaps the best thing about all this is that you never had to leave PowerShell to accomplish these tasks! With the knowledge you gained from this article, perhaps you can automate the entire search and delete workflow so that even your first-line agents can easily execute it. Maybe then, you will not have to be woken up from your much-needed sleep anymore. ## Further Reading * **_[Search for and delete email messages](https://docs.microsoft.com/en-us/microsoft-365/compliance/search-for-and-delete-messages-in-your-organization?view=o365-worldwide)_** * **_[Permissions in the Security & Compliance Center](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/permissions-in-the-security-and-compliance-center?view=o365-worldwide)_** * **_[Keyword queries and search conditions for Content Search](https://docs.microsoft.com/en-us/microsoft-365/compliance/keyword-queries-and-search-conditions?view=o365-worldwide)_** * **_[How To Find And Delete An Email From All Mailboxes In Office 365](https://techsnips.io/snips/how-to-find-and-delete-an-email-from-all-mailboxes-in-office-365/)_** Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Foffice-365-delete-email%2F&text=Delete%20Email%20from%20All%20Office%20365%20Mailboxes%3A%20Step-by-Step)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Foffice-365-delete-email%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Foffice-365-delete-email%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2020/07/microsoft_office_logo_press_image_1200x800-100751542-large.jpg) ### [Connect Azure AD to Office 365: Install Azure AD Connect](/connect-azure-ad-to-office-365/) Discover how to connect Azure AD to Office 365, install Azure AD Connect, and enable directory synchronization for your tenancy. ![](https://adamtheautomator.com/wp-content/uploads/2020/07/key-2114293_1280.jpg) ### [Enable MFA in Office 365: A Hands-On, Step-by-Step Guide](/office-365-mfa/) Learn how to set up and enable multi-factor authentication (MFA) in Office 365 with this comprehensive, hands-on tutorial. ![](https://adamtheautomator.com/wp-content/uploads/2020/04/How-to-Restore-an-Office-365-Mailbox-for-Free.jpg) ### [Restore Office 365 Mailbox for Free: A Detailed Guide](/restore-mailbox-office-365/) Learn how to restore Office 365 mailboxes without expensive software in this comprehensive, step-by-step tutorial. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)