Tracing emails in Microsoft 365 with PowerShell

• Author
• Recent Posts

Vignesh Mudliar

Vignesh has been working in the IT industry for the past 10 years. His main areas of focus are Microsoft 365, Exchange Online, PowerShell, Teams, SharePoint, Microsoft 365 Security, and GoLang. Follow his weblog.

Latest posts by Vignesh Mudliar (see all)

• Configure Quarantine Policies in Microsoft 365 - Fri, Aug 12 2022
• Data loss prevention policies (DLP) in Microsoft Teams - Mon, Jul 11 2022
• Configuring data loss prevention for email from the Compliance Center in Microsoft 365 - Fri, Dec 3 2021

Tracing message with Get-MessageTrace

This is the basic level of the message trace and can be run as follows: First, launch Exchange PowerShell v2 and then connect it to your Microsoft 365 tenant:

Connect-ExchangeOnline -UserPrincipalName <Admin email address>

Enter the password for this admin account in the next window that pops up.

Get-MessageTrace -RecipientAddress vignesh@M365tester.onmicrosoft.com -StartDate 4/21/2021 -EndDate 4/22/2021 | FL

A message trace example

Trace a specific message with Get-MessageTraceDetail

The Get-MessageTraceDetail command can be used to track a specific email. As seen here, the output is a bit more detailed. However, this command has the MessageTraceId and Recipientaddress attributes as mandatory.

Get-MessageTraceDetail -MessageTraceId f9b1b252-cd14-4f68-0286-08d904b784d1 -RecipientAddress vignesh@m365tester.onmicrosoft.com

Track a specific email with emaiGet MessageTraceDetail

Get-MessageTraceDetail -MessageTraceId f9b1b252-cd14-4f68-0286-08d904b784d1 -RecipientAddress vignesh@m365tester.onmicrosoft.com | FL

Track a specific email with emaiGet MessageTraceDetail 2

Extended message trace

You should also be familiar with the method of running an extended message trace via PowerShell. First, connect PowerShell to your Microsoft 365 tenant and then you can run an extended message trace with this command:

Start-HistoricalSearch -ReportTitle ExtendedMessageTrace -StartDate 4/1/2021 -EndDate 4/21/2021 -ReportType MessageTraceDetail -NotifyAddress <email address to be notified> -SenderAddress <email address> -RecipientAddress <email address>

To confirm that the search has been carried out, you can run Get-HistoricalSearch:

Search has been carried out

Once the report is generated, it will be sent to the notify address mailbox.

Conclusion

As Microsoft 365 evolves, the number of ways to track email keeps changing. Thus, whenever emails don't arrive in your users' inboxes, you should check what other options Microsoft provides to trace emails.