What should be checked in the Extended Message Trace to determine whether the email has been blocked and the reason for it?

Question

How can I verify whether an email has been blocked and the reason behind it by examining the Extended Message Trace?

The EMT has been generated and downloaded using: https://learn.microsoft.com/en-us/exchange/monitoring/trace-an-email-message/message-trace-modern-eac#extended-reports

However, I'm not sure what to pay attention to or how to pay attention to it.

I would greatly appreciate any assistance you may be able to provide.

Thanks.

Answer 1

I would recommend using the Explorer in Defender instead. Much more useful and informative

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/message-trace-scc?view=o365-worldwide

Do you have access to that?

https://security.microsoft.com/threatexplorerv3https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/mdo-email-entity-page?view=o365-worldwide

You can then search by sender or receiver etc... then open email entity and it shows why a message was blocked or allowed.

Much better than Exchange Message Tracing