Office 365 Search and Delete mail using Powershell

A neat feature of Exchange is the ability to run up a search across mailboxes within an organization from Powershell using the Search-Mailbox cmdlet and delete inappropriate or harmful messages using the -DeleteContent parameter. Fortunately these features exist in Office 365 if you are an Exchange Online Administrator

While administrators can use the Multi-Mailbox search feature in the Exchange control panel UI to locate mail, you  may discover you are unable to remove messages directly without some PowerShell magic.

The below script requires you add your admin account to the “Discovery Management” role from Roles & Auditing on the Exchange Control Panel (ECP).

#Every mailbox within the Organisation

#ARGS
[string]$decision = "n"

Write-Host "This script requires the `"Discovery Management`" Exchange Role-Group PLUS `"Mailbox Import Export`" Role assigned to your Exchange onlineAdmin Account `nPlease add it before proceeding:"
Write-Host "`n`nEnter Administration Credentials"

$LiveCred = Get-Credential

#Pass Creds to Outlook.com and generate PS Session
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $LiveCred -Authentication Basic -AllowRedirection
#Import PS Session/Grab MSOL Cmdlets
Import-PSSession $Session

$Subject = Read-Host "Please Enter a Message Subject to be deleted from ALL mailboxes:"

$decision = Read-Host "Are you sure youi want to delete messages with the subject " $Subject " (Y/N)?"

if ($decision -eq "y")
	{
	Write-Host "Deleting" $Subject
	Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery "subject:$Subject" -DeleteContent -Confirm
	}
else
	{
	Write-Host "Nothing deleted"
	}
Remove-PSSession

Write-Host "Connection to MSOL closed"

Warning: Use the above script with caution; When using the DeleteContent parameter, messages are permanently deleted from the user’s mailbox and cannot be recovered. (It could also take some time to run over a big Office365 Tenant)

See related Office 365 help article here:  here: http://help.outlook.com/en-ca/140/gg315525.aspx

-Patrick


One thought on “Office 365 Search and Delete mail using Powershell

  1. There’s a new option for this task that can be done even on non-exchange systems, or against PST files: PowerMapi.
    PowerMapi is a powershell module compiled in .NET that provides a set of cmdlets to do mapi things.

    Here’s a true example of how searching and deleting items in mailbox can be done:

    import-module PowerMapiLoader
    $sess=new-MapiSession OutlookProfileName
    $inbox=get-MapiFolder $sess Inbox
    $toDelete=search-MapiItems $inbox “PR_SUBJECT -has check this out! -and PR_MESSAGE_DELIVERY_TIME -btw 12/1/2016::1/1/2017”
    $toDelete | %{ remove-MapiItem $inbox $_ }

    Consider the simplicity of the search string and the -btw (between) operator for the date range!

    One could review the search results before deleting by outputting the $toDelete variable. Since this is MAPI, outlook does not need to be running and other mailboxes can be opened (as long as permissions allow) and searched as well.

    Take a look at the list of cmdlets here: http://powermapi.com/cmdlets

Leave a Reply to PowerMapi Cancel reply

Your email address will not be published.