Last August I wrote about Microsoft’s intention to deprecate the Search-Mailbox cmdlet and remove it from Office 365. In January, Microsoft announced that it would remove Search-Mailbox and other legacy search tools on April 1, 2020. On March 27, Microsoft announced a 3-month delay in the retirement of the legacy tools by three months, but it’s unlikely that the new July 1, 2020 date will be extended again. The die is cast and there’s no going back.
One of the most common uses of Search-Mailbox is to remove email that you don’t want users to have in their mailboxes. These messages might be phishing attempts, contain malware or viruses, or maybe they’ve been sent in error and need to be recalled. Outlook’s celebrated inability to recall messages is one reason why other tools are needed when messages leak out when they shouldn’t, which is why Microsoft is working on a new message recall feature.
Search-Mailbox can only be used in PowerShell and its interface is clunky, especially when formatting queries. But it’s an effective tool. Office 365 content searches are the replacement, or more correctly, a combination of a content search (to find messages) followed by a content search purge action (to remove the messages). Microsoft has some good documentation to explain how the process works and to document some limitations.
The two most obvious limitations are that purge actions are confined to Exchange messages and you can only remove 10 items from a mailbox at one time. Given that we’re discussing how to replace Search-Mailbox, the first isn’t a problem, even if it points to a need for a tool to disinfect SharePoint Online, OneDrive for Business, Teams, etc. if malware penetrates. The second limitation is by design, and it’s there to stop unwary administrators wreaking havoc on mailboxes by running a purge for a search that returns large numbers of items.
The key thing to remember when considering how to purge bad messages using content searches is to use a laser-focused search to find the messages. Administrator-initiated purging should be a precision operation, and that means you must build a search to find the exact messages to remove instead of casting a net widely in the hope that the right messages are found.
The easiest way to build a focused content search is through the Compliance Center GUI. You won’t have to worry too much about the syntax to use as you can build the search by adding keywords and conditions. Even better, you can preview the search (Figure 1) to make sure that the right messages are found.
Once you know that your search is effective, you can concentrate on attaching a purge action to it. A search action is something that acts on the results of a search. When you preview search results (Figure 1), those results are generated by applying a preview action to the search.
Office 365 content searches support HardDelete and SoftDelete purge actions. As noted above, purges only work for Exchange Online.
The Managed Folder Assistant permanently removes items from the Purges or Deletions folder after all retention mechanisms keeping the item lapse:
Items are kept so that they remain available for eDiscovery. It’s important to remember this because a search will continue to find items in mailboxes even when they have been removed from user view by a purge. In other words, even after you run a content search and purge its results, the messages remain until anything holding them back is removed.
No button or other interface allows administrators to purge messages through the Compliance Center or any other Office 365 admin center. If you want to purge messages, you’ve got to do run the purge using PowerShell.
To make things easier, I wrote a script (you can fetch a copy from GitHub) to do the following:
Figure 2 shows an example of the search and purge script in action.
I’ve no doubt that the script can be improved to harden it for production usage. My point is to demonstrate the principle steps in creating a script to purge items from mailboxes using a content search and search action. Now it’s over to you to apply the real magic.
Search-Mailbox persists in on-premises Exchange, but now there’s a new sheriff for mailbox purging in town.