

For instance, here’s how to find all the messages delivered to my tenant from in the last week. You can also run a wildcard search against sender addresses. However, Get-MessageTrace can run searches like this (the example finds any message sent to a address in the defined period): Get-MessageTrace -RecipientAddress -StartDate 3-June-2022 -EndDate 10-June-2022 -Status Delivered The Get-MessageTrackingLog cmdlet doesn’t support wildcard searches against the SenderAddress and RecipientAddress parameters. Message Tracing for Wildcard Values or Partial Matches The message trace finds two messages: Get-MessageTrace -RecipientAddress -StartDate (Get-Date).AddHours(-1) -EndDate (Get-Date) | fl In this case, we look for messages sent to two mailboxes, one of which is a recipient on the payroll email. In other words, any message sent to any one of the recipients is included in the results. When you do this the condition is an “or” not an “and”. You can specify multiple recipient SMTP addresses by separating the recipient addresses with a comma. Get-MessageTrace -RecipientAddress -StartDate (Get-Date).AddHours(-1) -EndDate (Get-Date) | Format-List Here we search for Chris Bishop (a CC address), and the search succeeds: Searching by recipient works no matter what kind of recipient (TO, CC, or BCC) a message recipient is. Tracing Messages by Recipient Email Address 10:24:27 Deliver The message was successfully delivered. 10:24:23 Submit The message was submitted. 10:24:23 Receive Message received by: .com Get-MessageTraceDetail -MessageTraceId 1b312cde-f274-409e-7350-08da4b948d74 -RecipientAddress Event Detail Get-MessageTrace doesn’t show the message trace identifier unless you ask for it: Get-MessageTrace -SenderAddress -StartDate (Get-Date).AddHours(-1) -EndDate (Get-Date) | Format-table MessageTraceId, SUbject, RecipientAddressġb312cde-f274-409e-7350-08da4b948d74 Attention: May Payroll Details Attention: May Payroll Details Attention: May Payroll Details we can run Get-MessageTraceDetail to discover what happened to a message. To see more detail about the steps in processing, we need the message trace identifier. Get-MessageTrace -SenderAddress -StartDate (Get-Date).AddHours(-1) -EndDate (Get-Date) -Status Delivered Other status values include Failed, Pending, and Quarantined. For instance, this command only returns messages that have been successfully delivered. You can add the Status parameter to the search to return messages with a certain processing status. This information doesn’t give the same insight as the Get-MessageTrackingLog cmdlet delivers in terms of how the Exchange transport system processed the message. Received Sender Address Recipient Address Subject Get-MessageTrace -SenderAddress -StartDate (Get-Date).AddHours(-1) -EndDate (Get-Date) To begin, we can find the message sent by the user by including their primary SMTP address in the Sender parameter. The results returned by any search depend on the criteria used to find items. Figure 1 shows my example: Figure 1: A message that we want to trace Exchange Online Message Trace by Sender Email Address Paul’s article used an email about a payroll report sent to three recipients as its test case. Another point is that it takes a couple of minutes after a message is sent before Exchange Online can trace its progress. After that, the Start-HistoricalSearch cmdlet must be used. One big thing to remember is that Get-MessageTrace can return information about messages for up to ten days after they’re sent. And while you can run a message trace through the Exchange admin center GUI, running traces through PowerShell allows you to pipe the results to other cmdlets, create reports, and so on (here’s an example of using message trace to create a report for management about external email). A different technique is needed to run Exchange Online message traces and find messages in the cloud where the Get-MessageTrace cmdlet does the heavy lifting. That article focuses on the Get-MessageTrackingLog cmdlet that doesn’t exist in Exchange Online. Ten years ago, Paul Cunningham described how to search Exchange Server message tracking logs with PowerShell to find details of emails logged as they pass through the transport service. Message Tracing for Wildcard Values or Partial Matches.



Tracing Messages by Recipient Email Address.Exchange Online Message Trace by Sender Email Address.
