What Powershell Query can I Use to Add Email Addresses to an eDiscovery Search as Data Sources

Question

What Powershell Query can I Use to Add Email Addresses to an eDiscovery Search as Data Sources

Rich 0

Hi There,

I'm trying to figure out how to automate some eDiscovery work. I have a case established in Purview. Let's call it 'Test Case'. I also have a search preconfigured with KeyQL. I need to add the data sources. I need to add appx. 1900 email addresses to the search. I have all of them in a local text file. Can I use Powershell to script those 1900 email addresses as data sources, as the tenant has ten's of thousands of data sources?

For instance something along the lines of:

$case = Test Case

$search = Test Case Search Name

$addressFile = "C:\testcaseaddressfile.txt"

foreach ($address in (Get-Content $addressFile)) {

Something here with a Set which leverages the pre-existing case name and specified search name....

}

Chandra Boorla 14,510 Reputation points Microsoft External Staff Moderator

2025-06-25T19:03:51.03+00:00

@Rich

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

1 answer

Your answer

Chandra Boorla 14,510 Reputation points Microsoft External Staff Moderator

2025-06-25T19:03:51.03+00:00

@Rich

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Answer 1

Marcin Policht 49,640 MVP Volunteer Moderator

Install and connect to the Compliance Center:

Install-Module ExchangeOnlineManagement
Connect-IPPSSession

Next, you'll need to

Identify the case and search.
Load the email addresses from the text file.
Use the Set-ComplianceSearch cmdlet to update the search's data sources (email addresses in this case).
Set-ComplianceSearch's –ExchangeLocation parameter takes a string array of user identities (email addresses, usernames, etc.).

Note that there’s a 10,000 item limit per search, but fortunately that’s not a concern in your case (you have ~1900). In addition, the update overwrites the ExchangeLocation list—so each time you call Set-ComplianceSearch, it replaces the previous values unless you maintain a growing list in the script.

# Define variables
$caseName = "Test Case"
$searchName = "Test Case Search Name"
$addressFile = "C:\testcaseaddressfile.txt"

# Read all addresses from file
$emailAddresses = Get-Content -Path $addressFile

# Convert to array if not already
$emailArray = $emailAddresses | ForEach-Object { $_.Trim() }

# Update the compliance search
Set-ComplianceSearch -Identity $searchName -Case $caseName -ExchangeLocation $emailArray

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Chandra Boorla 14,510 Reputation points Microsoft External Staff Moderator

2025-06-23T21:35:50.45+00:00
@Rich

Yes, you can absolutely use PowerShell to automate the process of adding multiple email addresses as data sources to an existing eDiscovery search in Microsoft Purview.

Since you already have a case and a preconfigured search, and your list of email addresses is saved in a local .txt file, you can use the Add-ComplianceSearchAction cmdlet to add each address as a data source.

Below is a sample PowerShell script to help you get started:

# Connect to Microsoft Purview Compliance Center Connect-IPPSSession # Specify the case, search, and input file path $caseName = "Your Case Name" $searchName = "Your Search Name" $addressFile = "C:\path\to\email_addresses.txt" # Read non-empty email addresses from file $emailAddresses = Get-Content $addressFile | Where-Object { $_.Trim() -ne "" } foreach ($email in $emailAddresses) { $cleanEmail = $email.Trim() try { Add-ComplianceSearchAction -SearchName $searchName ` -AddExchangeLocation $cleanEmail ` -Case $caseName Write-Host "[SUCCESS] Added: $cleanEmail" -ForegroundColor Green } catch { Write-Warning "[ERROR] Failed to add $cleanEmail - $_" } # Optional: add delay to prevent throttling Start-Sleep -Milliseconds 500 }

Considerations:

Make sure you're using Core eDiscovery, not Advanced.

You’ll need the eDiscovery Manager or Administrator role.

You may want to add batching or delay logic if you run into throttling with a large number of addresses.

I hope this information helps. Please do let us know if you have any further queries.

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.

Thank you.
Rich 0 Reputation points

2025-06-24T12:49:48.75+00:00

What's interesting is none of these things worked for me. That being said, I might be missing a permission somewhere. The following did work for me, albeit slow:

Connect-ExchangeOnline;

Connect-IPPSSession

$addressFile = 'C:\testfile.txt'

$caseName - "Test Case Name"

$searchName = "Test Search Name"

foreach ($address in (Get-Content $addressFile)) {

Get-ComplianceSearch -Case $caseName -Identity $searchName | Set-ComplianceSearch -AddExchangeLocation $address -AddSharepointLocation $address -AllowNotFoundExchangeLocationsEnabled $true

}
Chandra Boorla 14,510 Reputation points Microsoft External Staff Moderator

2025-06-24T20:38:01.1266667+00:00

@Rich

Thanks for the update. It sounds like your immediate goal, adding data sources to the search, is now working, though with a slower workaround using Set-ComplianceSearch. That’s great progress!

Really appreciate you sharing the workaround, that’s incredibly helpful! This approach will definitely be useful for others who might encounter similar permission-related issues with Add-ComplianceSearchAction.

The fact that the original Add-ComplianceSearchAction approach didn’t work likely points to a permission or role assignment issue, as you suspected.

To confirm, Add-ComplianceSearchAction requires that your account has the appropriate roles assigned, typically through the eDiscovery Manager or eDiscovery Administrator role groups. Missing permissions (such as "Mailbox Search" or "Compliance Search") can silently prevent this cmdlet from completing successfully.

Since you're now successfully adding sources using Set-ComplianceSearch, the issue is effectively resolved from a functionality standpoint. However, if you'd like to improve performance, especially when working with large numbers of mailboxes, it's worth checking your role assignments so that you can take advantage of the faster Add-ComplianceSearchAction method. I hope this information helps. Please do let us know if you have any further queries.

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.

Thank you.

Share via

What Powershell Query can I Use to Add Email Addresses to an eDiscovery Search as Data Sources

1 answer

Your answer