Windows OS Hub
  • Windows Server
    • Windows Server 2022
    • Windows Server 2019
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2012
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Active Directory Domain Services (AD DS)
    • Group Policies
  • Windows Clients
    • Windows 11
    • Windows 10
    • Windows 8
    • Windows 7
    • Windows XP
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
    • KVM
  • PowerShell
  • Exchange
  • Cloud
    • Azure
    • Microsoft 365
    • Office 365
  • Linux
    • CentOS
    • RHEL
    • Ubuntu
  • Home
  • About

Windows OS Hub

  • Windows Server
    • Windows Server 2022
    • Windows Server 2019
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2012
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Active Directory Domain Services (AD DS)
    • Group Policies
  • Windows Clients
    • Windows 11
    • Windows 10
    • Windows 8
    • Windows 7
    • Windows XP
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
    • KVM
  • PowerShell
  • Exchange
  • Cloud
    • Azure
    • Microsoft 365
    • Office 365
  • Linux
    • CentOS
    • RHEL
    • Ubuntu

 Windows OS Hub / Microsoft 365 / Email Message Tracking in Microsoft 365 (Exchange Online)

December 21, 2021 ExchangeMicrosoft 365Office 365PowerShell

Email Message Tracking in Microsoft 365 (Exchange Online)

Like on-prem Exchange, the cloud Exchange Online has powerful built-in features to track email messages sent or received by users. Message tracking allows you to get full details on any email in your Exchange organization. Using a trace, you can tell whether your company received a specific email, if it was delivered to a user’s mailbox or a remote mail system, or it was filtered by antispam filters/transport rules. In this article, we’ll cover the basic ways to track (trace) sent or received emails in Exchange Online (Microsoft 365) using the Exchange Admin Center (EAC) and PowerShell.

Contents:
  • How to Trace a Message in the Exchange Admin Center?
  • Search Message Tracking Logs in Exchange Online (Microsoft 365) with PowerShell

How to Trace a Message in the Exchange Admin Center?

You can trace messages through the Exchange Admin Center web interface. Sign-in to the modern EAC portal (https://admin.exchange.microsoft.com) and go to Mail Flow -> Message Trace.

microsoft 365 message trace center

To search transport logs, your account must have one of these roles: Organization Management, Compliance Management, or Help Desk.

In the next window, some predefined message tracing options are available. To do a new search, click Start a trace.

Fill in the request fields. You can specify:

  • A sender and/or a recipient. In this case, I want to get information about all email messages sent to my company from the external domain gmail.com (*@gmail.com);
  • A search period. A report for the last 10 days will be generated interactively. If you want to search logs older than 10 days, will be sent to the specified email address;
  • In the Detailed Search Options, you can specify extra search criteria (Message ID, IP address, Delivery Status).

Click the Search button to start searching.

create new message trace report in Exchange Online EAC

You will see the information about all email messages meeting your criteria.

message trace search result in exchange admin center in microsoft 365

You can click any email and view detailed information. In this example, the email has been successfully delivered to the recipient’s mailbox (Status: The message was delivered to the recipient’s Inbox folder).

exchange online email report

The last 10 trace queries are automatically saved in the EAC console. You can save tracking queries you use often.

Search Message Tracking Logs in Exchange Online (Microsoft 365) with PowerShell

Get-MessageTrackingLog cmdlet used in the on-premises Exchange Server to search sent/received email messages in the MessageTracking transport logs. In Exchange Online, the Get-MessageTrace and Get-MessageTraceDetail cmdlets are used to track messages.

Connect to your Microsoft 365 tenant using the Exchange Online PowerShell module:

Connect-ExchangeOnline -UserPrincipalName maxbak@woshub.onmicrosoft.com -ShowProgress $true

If you run the Get-MessageTrace cmdlet without parameters, it returns information about all emails in your Microsoft 365 tenant for the last 48 hours. You can specify the date range for your search using -StartDate and -EndDate options. Let’s display the information about all messages sent to a user (RecipientAddress) for the last 5 days:

Get-MessageTrace -RecipientAddress maxmak@woshub.onmicrosoft.com -StartDate 12/17/21 -EndDate 12/21/21| select Received,SenderAddress,RecipientAddress, Subject,Size,Status|ft

Get-MessageTrace: tracking emails in Microsoft 365 with PowerShell

By default, the Get-MessageTrace returns a maximum of 1000 results, and it may take some time on large tenants.

You can search both RecipientAddress and SenderAddress fields in a single trace query.

Use the -Status option to search by the message delivery status (Failed, Pending, Delivered, Expanded, Quarantined, FilteredAsSpam).

To display detailed information on the found events, use a pipe with Get-MessageTraceDetail cmdlet:

Get-MessageTrace -SenderAddress maxbak@woshub.onmicrosoft.com -StartDate 12/19/21 -EndDate 12/21/21|Get-MessageTraceDetail|fl
Get-MessageTraceDetail - detailed tracking email status in Exchange Online with PowerShell

The following commands show information about the delivery status of the email message sent to multiple recipients.

Get the MessageID first for any of the recipients:

Get-MessageTrace -RecipientAddress maxbak@woshub.onmicrosoft.com|fl

getting MessageId from the Get-MessageTrace

Then copy the message ID and use it as an argument of the MessageID option:

Get-MessageTrace -MessageID '<PR3PR03MB666621C6A63FC01EBCE8C730F46F9@PR3PR03MB6666.eurprd03.prod.outlook.com>' | select Received, RecipientAddress, Subject, Status

create message delivery status report with powershell

As you can see, a summary message delivery status report appeared.

You can export MessageTrace output to a CSV file for further analysis in Excel:

Get-MessageTrace -SenderAddress maxbak@woshub.onmicrosoft.com|Export-Csv c:\ps\reports\m365_tracking_log.csv

Unlike the on-prem Get-MessageTrackingLog cmdlet that searches all available logs, Get-MessageTrace allows to search messages for the last 10 days only. If you want to get information about emails sent/delivered over 10 days ago, run historical queries using the Start-HistoricalSearch cmdlet.

When using Start-HistoricalSearch, specify the email address to send a report to in the NotifyAddress option:

Start-HistoricalSearch -ReportTitle "Trace2021-20-12" -ReportType MessageTrace -SenderAddress maxbak@woshub.onmicrosoft.com -StartDate 12/01/2021 -EndDate 07/18/2021 -NotifyAddress adele@woshub.onmicrosoft.com

You can get the message status for the historical trace requests using this command:

Get-HistoricalSearch

exchnage online (microsof 365) Get-HistoricalSearch

Exchange Online keeps transport logs for the last 90 days. If you specify a longer period, the following error message appears:

Invalid StartDate value. The StartDate can't be greater than 90 days from today.

0 comment
4
Facebook Twitter Google + Pinterest
previous post
Managing Active Directory Groups with PowerShell
next post
How to Reset SA Password on Microsoft SQL Server?

Related Reading

Using PowerShell Behind a Proxy Server

July 1, 2022

Checking Windows Activation Status on Active Directory Computers

June 27, 2022

Configuring Multiple VLAN Interfaces on Windows

June 24, 2022

How to Disable or Enable USB Drives in...

June 24, 2022

FAQ: Licensing Microsoft Exchange Server 2019/2016

June 14, 2022

Leave a Comment Cancel Reply

Categories

  • Active Directory
  • Group Policies
  • Exchange Server
  • Microsoft 365
  • Azure
  • Windows 11
  • Windows 10
  • Windows 7
  • Windows Server 2019
  • Windows Server 2016
  • Windows Server 2012 R2
  • PowerShell
  • VMWare
  • Hyper-V
  • MS Office

Recent Posts

  • Using PowerShell Behind a Proxy Server

    July 1, 2022
  • How to Access VMFS Datastore from Linux, Windows, or ESXi?

    July 1, 2022
  • How to Deploy Windows 10 (11) with PXE Network Boot?

    June 27, 2022
  • Checking Windows Activation Status on Active Directory Computers

    June 27, 2022
  • Configuring Multiple VLAN Interfaces on Windows

    June 24, 2022
  • How to Disable or Enable USB Drives in Windows using Group Policy?

    June 24, 2022
  • Adding Domain Users to the Local Administrators Group in Windows

    June 23, 2022
  • Viewing a Remote User’s Desktop Session with Shadow Mode in Windows

    June 23, 2022
  • How to Create a Wi-Fi Hotspot on your Windows PC?

    June 23, 2022
  • Configuring SSH Public Key Authentication on Windows

    June 15, 2022

Follow us

woshub.com

ad

  • Facebook
  • Twitter
  • RSS
Popular Posts
  • Outlook Keeps Asking for Password on Windows
  • Whitelist Domains and Email Addresses on Exchange Server and Microsoft 365
  • How to Cleanup, Truncate or Move Log Files in Exchange Server 2013/2016/2019?
  • Fix: Microsoft Outlook Search Not Working on Windows 10/11
  • Moving Exchange Mailboxes to Different Database
  • Export Exchange or Office 365 Global Address List (GAL) to CSV
  • How to Delete or Rename Default Mailbox Database in Exchange Server?
Footer Logo

@2014 - 2018 - Windows OS Hub. All about operating systems for sysadmins


Back To Top