How to list all inbound emails coming to a single address, except for emails from colleagues

T Crha 381 Reputation points
2023-05-18T08:16:12.7433333+00:00

Hello all,

I am sorry to ask via the Q and A here, but I didnt find this documented, and all of my attempts to do this didnt lead to a satisfactory outcome.

I have been asked by one of our users to list all emails, that were addressed to him, and arrived (in past 30 days), but exclude emails that were sent by his colleagues from the company (because the goal of this whole search is to find a particular email that came from external sender).

What so the best method here?

Get-MessageTrackingLog (but how to exclude the internal senders - according to internal domain?)

Get-HistoricalSearch (because of that 30 days timespan)

Or some sort if Compliance/Content search?

Every option has some limitations, so I am not sure which one to use and how exactly to desing the cmdlet....would anybody be so kind and paste the PS cmdlet which would list me what I need?

Thank you very much,

Tomas

Microsoft Exchange Online Management
Microsoft Exchange Online Management
Microsoft Exchange Online: A Microsoft email and calendaring hosted service.Management: The act or process of organizing, handling, directing or controlling something.
4,199 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Kael Yao-MSFT 37,496 Reputation points Microsoft Vendor
    2023-05-19T06:15:20.7366667+00:00

    Hi @T Crha

    If the requirement is to get external emails received within 30 days, you may need to use Historical Search (Enhanced summary report or Extended report in Exchange Admin Center).

    If the external sender's domain can be confirmed, you can specify it directly in the search.

    01

    If the sender domain is not confirmed, to me you may have to search for all receive emails then filter the results with applications like Excel to exclude internal senders.

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.