Best approach to programmatically hard delete emails on Exchange Server

Question

I have a script that is able to extract the following information from a phishing incident on Defender 365:

Sender - The original sender of the phishing email

Subject - The subject of the phishing email

internetMessageId - The Internet message identifier of the phishing email

What I would like to know would be the best approach using an API (or some other automated way) to hard delete all the emails (on all user's inboxes) on an Exchange Server using any of the information retrieved in the previous step.

Thank you in advance!

Answer 1

The ability to do this with Graph is still on the roadmap and should be released soon:

https://www.microsoft.com/en-us/microsoft-365/roadmap?filters=&searchterms=93434

Alternatively, you can use the SCC powershell module:

https://learn.microsoft.com/en-us/microsoft-365/compliance/ediscovery-search-for-and-delete-email-messages?view=o365-worldwide

You can use Defender UI as well of course:

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/remediate-malicious-email-delivered-office-365?view=o365-worldwide

Answer 2

Hi Andy,

Thanks for your informative response, it's truly valuable. I've investigated the roadmap you've shared, and I'm excited to see Graph getting this functionality. It seems it will provide a very programmatically friendly way to handle these kinds of tasks in the future. However, for the time being, it seems I'll have to resort to other means, and your suggestion about the SCC PowerShell module looks interesting.

Speaking of the SCC PowerShell module, I had a few queries regarding its functionality. You mentioned that it could be used as an alternative for hard deleting emails on an Exchange Server. Considering the vast number of emails and mailboxes we might need to manage, especially during an incident like phishing, I'm wondering about a few things:

1. Does the SCC PowerShell module provide an option to search across all mailboxes? Will it be possible to execute such a comprehensive search?
2. When it comes to deleting emails, is there a cap or limit on the number of emails the SCC PowerShell module can hard delete? In case the phishing email was sent to a substantial number of mailboxes, we might end up with a situation where we must delete a large volume of emails.

Also, is there a way to control or specify the deletion to make it a 'Hard Delete'? As you probably know, in phishing incidents it's crucial that we not only delete the email from the user's inbox but also ensure it's removed from the 'Deleted Items' folder to prevent any accidental clicks.

I believe your expertise and guidance could provide more insight into how effectively the SCC PowerShell module can serve in such situations.

Thank you once again for your time and assistance. I'm looking forward to your response.

Answer 3

Hi Andy,

Thanks once again for your insights. There's another question that came to my mind about the SCC PowerShell module, and I was hoping you could provide an answer.

You've pointed out how this module can help with hard deleting phishing emails on Exchange Server. However, as our organization operates in a hybrid environment, we have both Office 365 and on-premises Exchange Server deployments.

So, I wanted to ask: does the SCC PowerShell module also support on-premises Exchange Server? Can we use it to search and hard delete phishing emails in an equivalent manner as we do in the cloud-based Exchange Server?

Answer 4

Hi, no it only works in Exchange Online.

For on-prem, you would use:

search-mailbox:

https://learn.microsoft.com/en-us/powershell/module/exchange/search-mailbox?view=exchange-ps

ALso, Here are the limits from that article.