Bulk delete emails from exchange online shared mailbox.

Question

Hi,

I have issues bulk deleting emails from a shared mailbox which is used to store only logs and other reports no longer needed. To my surprise, it is not as easy as I thougth. We need to get rid of hundreds of thousands of emails.

Obviously outlook can't handle this. I tried to archive emails with it in the given mailbox by setting up citerias, but did not do anything, no error messages, nothing happened. Freezes when it has to deal wiht large sum of emails.

I tried these from powershell after connecting to EO and compliance center scc:

Starting a New Compliance search and then purge the results :New-ComplianceSearchAction -SearchName "Remove Phishing Message" -Purge -PurgeType SoftDelete/Hardelete. Nothing happens, no error messages, does not delete anything.

Deprecated search-mailbox command: Search-Mailbox mailbox1 -SearchQuery {Received:"1/1/2020..12/31/2022"} -DeleteContent. It is waiting for a while then returns the error:

ConvertFrom-Json : Invalid JSON primitive: .
At C:\Users\user1\AppData\Local\Temp\tmpEXO_atsy5x51.aez\tmpEXO_atsy5x51.aez.psm1:623 char:35
+ ... etailsToPSObject = ConvertFrom-Json $ErrorObject.ErrorDetails.Message
+                        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [ConvertFrom-Json], ArgumentException
    + FullyQualifiedErrorId : System.ArgumentException,Microsoft.PowerShell.Commands.ConvertFromJsonCommand

the New-MailboxSearch command does not even has syntaxes to delete results. Now I am really confused if it is even possible to mass/bulk delete emails from a shared (or any other type) mailbox, or I need to completely delete it and recreate it? Any clues would be appreciated.

Answer 1

Hi @Tóth Gábor ,

I tried testing in my lab tenant and can vertify that the Search-Mailbox cmdlet can still work despite of the warning messages:

Search-Mailbox shared1 -SearchQuery {Received:"2021/8/10..2021/12/30"} -EstimateResultOnly
Search-Mailbox shared1 -SearchQuery {Received:"2021/8/10..2021/12/30"} -DeleteContent

As mentioned by Vasil, please try adjusting the timespan in your command and check how it goes.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Search-Mailbox should be your best bet here, as the alternative compliance search cmdlet only allows for 10 deletions at a time. I'd suggest limiting the timespan to something like a week to limit down the number of matches found, then you can slowly start increasing it.

One note though, Search-Mailbox will detect and process items in both the "main" mailbox as well as the RecoverableItems subtree, where deleted items end up. Consider using the -SearchDumpster:$false switch, or disabling single-item recovery on the mailbox (Set-Mailbox shared -SingleItemRecoveryEnabled $false)

Also, consider stamping a retention policy on the mailbox, so it periodically purges older messages (without the need for user intervention). Either the "classic" Exchange MRM policies or the "new" retention policies in the compliance center would do.

Answer 3

I recommend a tool:Bulk Delete Mail for Exchange

http://www.taysoon.com/search-and-delete-mails-13.html