Exchange Online
A Microsoft email and calendaring hosted service.
6,172 questions
You cannot run message trace by subject. You'll have to fetch all messages and filter them client-side instead.
How can I query email based on Subject in Exchange Online?
EnterpriseArchitect
6,041
Reputation points
Folks,
I need to be able to query the email that was sent in the past month (-30 days) with the subject "***Auto Reply:****".
How can I get the statistics as the Message trace (https://admin.exchange.microsoft.com/#/messagetrace) is not allowing me to enter the subject?
PowerShell can be used in this regard, but can only work in the past 10 days.
Thank you in advance.
Exchange Online
Exchange | Exchange Server | Management
7,920 questions
Exchange | Hybrid management
2,309 questions
Windows for business | Windows Server | User experience | PowerShell
Accepted answer
-
Vasil Michev 119.5K Reputation points MVP Volunteer Moderator2022-10-07T06:57:13.397+00:00 -
EnterpriseArchitect 6,041 Reputation points
2022-10-07T07:02:49.39+00:00 Yes, but even then, I must supply the Sender or Destination on the message trace.
I need to know which user in my domains sending Auto Reply in the past 30 days, to anyone. -
Vasil Michev 119.5K Reputation points MVP Volunteer Moderator
2022-10-07T08:06:43.123+00:00 You don't, you can run a "blanket" search just by covering startdate/enddate. Keep in mind you can only get 10 days on synchronous results, anything above that will run in the background and you'll have to download a CSV.
-
EnterpriseArchitect 6,041 Reputation points
2022-10-07T08:10:13.923+00:00 Hi @Vasil Michev , somehow
I cannot run the Message Trace: It is still asking for the sender and receiver address which is * or Any to Any.
-
EnterpriseArchitect 6,041 Reputation points
2022-10-07T08:15:09.913+00:00 I can't use the * expression in the Sender & recipient text field:
Prepare message trace reportFailed to request report
Error:
Error executing request. Invalid notification address or notification address not in accepted domains. -
Vasil Michev 119.5K Reputation points MVP Volunteer Moderator
2022-10-07T08:25:24.797+00:00 Sorry, the "blanket" search only applies to results up to 10 days, which you can fetch synchronously via the Get-MessageTrace cmdlet. For the asynchronous search, run via Start-HistoricalSearch, you do need to specify a sender or recipient, but you can work around it by using a domain value:
Start-HistoricalSearch -StartDate "08 Sep 2022" -EndDate "07 Oct 2022" -ReportTitle "test" -ReportType MessageTrace -SenderAddress *@domain.comStill not idea, as you have to repeat for each domain you use for mail flow, but that's the best you can get for messages over 10 days old.
-
EnterpriseArchitect 6,041 Reputation points
2022-10-07T08:50:30.67+00:00 Thank you @Vasil Michev , this makes more sense and I've never thought about this before.
So I assume I can specify more accepted email domains that I have ~87 domains so far in total.Like this:
Start-HistoricalSearch -StartDate "08 Sep 2022" -EndDate "07 Oct 2022" -ReportTitle "test" -ReportType MessageTrace -SenderAddress *@domain1.com, *@domain2.com, *@domain3.com -
Vasil Michev 119.5K Reputation points MVP Volunteer Moderator
2022-10-07T10:55:30.167+00:00 Just do them one at a time.
-
EnterpriseArchitect 6,041 Reputation points
2022-10-07T11:06:16.6+00:00 Thanks, @Vasil Michev for your help.
Sign in to comment -