Share via

Get-QuarantineMessage only returns results for 1 day

Demari S 20 Reputation points
2024-05-22T20:24:10.2233333+00:00

When running any of the cmdlets below in Exchange Online, I receive results for no more than a few days.

This is the primary cmdlet which only returns results for 1 day in spite of the request for the last 30 days. I don't believe it has anything to do with there not being more than 1 days worth of results as I can change the date rate to end on May 14th and it will only provide results for May 14th compared to May 22th that is currently listed. Using the -PageSize parameter helps a bit but with a max limit of 1000, that only extends results to a day or 2.

Get-QuarantineMessage -PolicyName 'domains less than 14 days' -StartReceivedDate 04/23/2024 -EndReceivedDate 05/22/2024

Microsoft Exchange Online
Microsoft Exchange Online Management
Microsoft Exchange Online Management
Microsoft Exchange Online: A Microsoft email and calendaring hosted service.Management: The act or process of organizing, handling, directing or controlling something.
4,386 questions
PowerShell
PowerShell
A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
2,329 questions
0 comments
Accepted answer
  1. Rich Matheisen 45,906 Reputation points
    2024-05-23T03:08:12.35+00:00

    You need a loop to get a large number of messages. You can use the -PageSize parameter together with the -Page parameter. Increment the -Page value by one after each Get-QuarantineMessage and repeat the query as long as the number of message in the page is greater than zero.

    With a PageSize of 1000 and a Page starting at one and going up to 1000 you should be able to retrieve 1,000,000 messages.

    A more complete explanation of doing this can be found here: https://www.powershellgeek.com/2023/02/03/powershell-paging-in-microsoft-365/#:~:text=With%20this%20code%2C%20the%20Get-QuarantineMessage%20cmdlet%20will%20list,pick%20a%20particular%20message%20from%20a%20particular%20page.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Bruce Jing-MSFT 2,910 Reputation points Microsoft Vendor
    2024-05-23T09:02:27.2966667+00:00

    Hi，@Demari S

    Thanks for posting your question in the Microsoft Q&A forum.

    According to your description, when you run Get-QuarantineMessage it only returns one day's worth of results, using the -PageSize parameter just extends the results by a day or two.

    Regarding the issue with the Get-QuarantineMessage command, I have conducted tests, and the cmdlet you provided has no errors , but I am able to return results for a month.

    A screen shot of a computerDescription automatically generated

    I have a few questions to confirm:

    1. Can you view all quarantined emails in the Quarantine interface of Microsoft Defender?
    2. It is recommended to use Get-QuarantineMessage |export-csv -path .\quarantined.csv cmdlet to export all quarantined messages. Check whether the export result is the same as the PowerShell result.
    3. Do other administrators have the same problem? Do you  test it on other computers?