Message Trace issue

Question

I’m experiencing an issue with message trace in exchange online where emails that are confirmed as delivered and visible in user mailboxes are not appearing in trace results

I’ve run powershell commands like get-messagetrace and get-messagetracedetail within a 24-hour window, but the results are empty or incomplete, which is impacting our ability to audit mail flow and troubleshoot delivery

Answer 1

If the message was delivered, get the MessageID from its headers, then run a message trace based on said MessageID:

Get-MessageTraceV2 -MessageId "<******@lor1-app135558.prod.linkedin.com>"

Make sure to extend the date range via StartDate/EndDate parameters as well. If that doesn't produce any results either, best open a support case, as it's likely a backend issue.

Answer 2

Message trace in Exchange Online has several built‑in limitations and behaviors that can explain missing or incomplete results, even when messages are clearly delivered and visible in user mailboxes.

Key points and checks:

1. Time window and data availability

• Message trace data is not real‑time. It can take 10–60 minutes after a message is sent before it appears in trace data.
• Get-MessageTrace and Get-MessageTraceDetail only search data for the last 10 days. If the time range is older than 10 days, Get-MessageTraceDetail returns an error and no results.
• For data older than 10 days, message trace must be done via historical search (Start-HistoricalSearch / Get-HistoricalSearch), not Get-MessageTrace.

2. UI vs. PowerShell behavior

• In the Exchange admin center (EAC) and Microsoft 365 admin tools, the default message trace search is the last 48 hours for all messages. Narrowing the search by date range, sender, and recipient is required to reliably find specific messages.
• For messages more than 7 days old in the UI, results are only available as a downloadable .csv from a historical trace. These traces can take up to an hour to complete.

3. Practical troubleshooting steps

Use the EAC message trace to validate what PowerShell is missing:

1. Open the message trace tool:
   • In the Microsoft 365 admin center, go to Admin → Exchange → mail flow → message trace.
2. Run a scoped trace for a known message:
   • Set Date range to tightly cover the send time (for example, a 1–2 hour window).
   • Use Add sender and/or Add recipient to specify the exact addresses.
   • Select Search.
3. Check the STATUS column:
   • Delivered messages should show Delivered.
   • Select a message and then Details to see the event history and the “How to fix it” guidance if there were issues.
4. If the message is older than 7 days:
   • In the message trace tool, select View pending or completed traces to see historical searches and download the .csv.

If the message appears in the EAC trace but not in Get-MessageTrace / Get-MessageTraceDetail:

• Confirm the StartDate/EndDate in PowerShell exactly match (or slightly extend) the time window used in the EAC.
• Ensure the message is within the last 10 days; otherwise, use historical search instead of Get-MessageTraceDetail.
• Simplify the PowerShell filters (for example, search only by recipient and time window) to avoid timeouts or overly restrictive criteria.

4. Known causes of empty or incomplete results

• Searching too soon after the message was sent (data not yet ingested; wait up to an hour).
• Using Get-MessageTraceDetail for messages older than 10 days (returns no results by design).
• Overly broad or complex searches causing timeouts; the guidance is to simplify search criteria.
• Expecting interactive results for messages older than 7 days in the UI instead of using the historical trace .csv.

If, after aligning the time window, narrowing criteria, and respecting the 10‑day and 7‑day boundaries, messages still appear in user mailboxes but never in any message trace (EAC, historical search, or PowerShell), this indicates a service‑side issue. In that case, collect examples (message IDs, timestamps, senders/recipients) and open a support ticket via the Microsoft 365 admin center so backend message trace data can be checked.

---

References:

• Trace an email message in Exchange Online
• Find and fix email delivery issues as a Microsoft 365 for business admin
• Get-MessageTraceDetail