Recall email messages from Exchange Online with Powershell
I was looking for some good documentation online on how to recall emails from user inboxes.
First, import and connect to the relevant Powershell modules and environments:
Install-Module ExchangeOnlineManagement Import-Module ExchangeOnlineManagement Connect-IPPSSession -UserPrincipalName XXX # Change this value to your account with Global Admin or Compliance Admin permissions
Next, create a new Compliance Search by defining your scope and query. For this example, I'm going to keep it simple by targeting all Exchange content and a subject line search:
# Change the subject line to the emails' subject line in question New-ComplianceSearch -Name "New search" -ExchangeLocation All -ContentMatchQuery '(Subject:"Spammy email subject line")' | Start-ComplianceSearch
Depending on the size of your tenant, this may take a while, maybe a few hours. You can check the status of the search by running
After the search status says 'Completed', the following command to purge and delete all instances of the email from your tenant:
New-ComplianceSearchAction -SearchName "New search" -Purge -PurgeType HardDelete
This command may take a while too, depending on the size of your tenant. You can check the status of the search action with the command
That's it! You can see your results in the Microsoft Compliance center and a full audit log will be available through the portal.