New-ComplianceSearch

Question

Hi All

i have a requirement to delete an email lets say the email subject is "Test Email" and the email was sent to all users on May 28, is the below syntax correct.

New-ComplianceSearch -Name "PurgeEmail" -ExchangeLocation "ALL" -ContentMatchQuery 'From:"user1@mydomain.com" AND subject:"Test Email" AND Received:"05/28/2024 00:00..05/28/2024 23:59"'

Start-ComplianceSearch -Identity "PurgeEmail"

How can i check if the search is completed from PowerShell?

If i need to delete email, is the below syntax correct? how can i know email deletion is completed?

New-ComplianceSearchAction -SearchName "PurgeEmail" -Purge -PurgeType SoftDelete -Force

Answer 1

Yes, see:

https://learn.microsoft.com/en-us/purview/ediscovery-search-for-and-delete-email-messages

New-ComplianceSearchAction -SearchName "Remove Phishing Message" -Purge -PurgeType SoftDelete

Note:

• How do you get status on the search and remove operation? Run the Get-ComplianceSearchAction to get the status on the delete operation. The object that is created when you run the New-ComplianceSearchAction cmdlet is named using this format: <name of Content Search>_Purge.
• What happens after you delete a message? A message that's deleted with the New-ComplianceSearchAction -Purge -PurgeType HardDelete command is moved to the Purges folder and can't be accessed by the user. After the message is moved to the Purges folder, the message is retained for the duration of the deleted item retention period if single item recovery is enabled for the mailbox. (In Microsoft 365, single item recovery is enabled by default when a new mailbox is created.) After the deleted item retention period expires, the message is marked for permanent deletion and will be purged from Microsoft 365 the next time the mailbox is processed by the Managed Folder assistant. If you use the New-ComplianceSearchAction -Purge -PurgeType SoftDelete command, messages are moved to the Deletions folder in the user's Recoverable Items folder. It isn't immediately purged from Microsoft 365. The user can recover messages in the Deleted Items folder for the duration based on the deleted item retention period configured for the mailbox. After this retention period expires (or if user purges the message before it expires), the message is moved to the Purges folder and can no longer be accessed by the user. Once in the Purges folder, the message is retained for the duration based on the deleted item retention period configured for the mailbox if single items recovery is enabled for the mailbox. (In Microsoft 365, single item recovery is enabled by default when a new mailbox is created.) After the deleted item retention period expires, the message is marked for permanent deletion and will be purged from Microsoft 365 the next time that the mailbox is processed by the Managed Folder assistant.

Answer 2

Hi,Rising Flight

Based on your question, I understand that you want to see if the command has completed in Power Shell.

With my tests, you can use command Get-ComplianceSearch -Identity  | Format-Table Name, Status to see the status.

If the search has already been completed, the status is completed.

The results are shown in the figure below.