You can use PowerShell to delete an email sent by a specific user from all mailboxes in Microsoft 365. This is useful for cases of misinformation, security, or compliance requirements. This guide will walk you through the steps using Exchange Online PowerShell.
Requirements
To perform this task, you need the following permissions:
- Compliance Search and Mail Recipients management permissions
- A user account with Global Admin or Compliance Admin roles
Step-by-Step Guide
1. Connect to Exchange Online with the PowerShell Module
First, you need to install and connect to the Exchange Online PowerShell module.
1.Install the Exchange Online PowerShell V2 Module (if not already installed):
Install-Module -Name ExchangeOnlineManagement
If running script disable because execution policy output restricted.We can enable execution policy.This output must be unrestricted.
Get-ExecutionPolicy (control)
Output : restricted
Set-ExecutionPolicy -ExecutionPolicy Unrestricted
Output : Unrestricted
2.After installing, connect to Exchange Online by running:
Connect-ExchangeOnline -UserPrincipalName admin@domain.com
2. Define the Email to Be Deleted with a Search
To identify the email to be deleted, create a search. This step uses the sender’s address and subject line of the email.
Run the following command to start a content search to locate the email:
Alternative search-1 ( from and subject)
New-ComplianceSearch -Name "DeleteEmailSearch1" -ExchangeLocation All -ContentMatchQuery 'from:user@domain.com AND subject:"Email Subject"'| Start-ComplianceSearch
Alternative search-2 (date)
New-ComplianceSearch -Name "DeleteEmailSearch2" -ExchangeLocation all -ContentMatchQuery 'sent>=12/25/2024 AND sent<=12/25/2024 AND subject:"financial report"' | Start-ComplianceSearch
Alternative search-3 (body)
New-ComplianceSearch -Name "DeleteEmailSearch3" -ExchangeLocation All -ContentMatchQuery "body:Hello Mr.Dummy" | Start-ComplianceSearch
-Name: The name you give your search.
-ExchangeLocation: Use “All” to search across all Exchange mailboxes.
-ContentMatchQuery: The query to locate the email, specifying the sender and subject.
3.Use the Search Results to Delete the Email
Once the search completes, use New-ComplianceSearchAction to delete the email based on the search results.
Run the following command to delete the email using “SoftDelete”:
New-ComplianceSearchAction -SearchName "DeleteEmailSearch" -Purge -PurgeType SoftDelete
SearchName: The name of the search you created (“DeleteEmailSearch”).
-PurgeType: SoftDelete removes the email but makes it recoverable; HardDelete permanently removes it.
4.Verify the Deletion
After the deletion process completes, verify the email is removed from all mailboxes by checking the status of the search action.
Get-ComplianceSearchAction -SearchName "DeleteEmailSearch"