Faster Exchange Online Message Trace via PowerShell

If you submit a message trace with a custom date via the¬†Exchange Online admin center, you’ll see this message:

information Your message trace has been submitted. An email message will be sent to you when it's available. You can also check under the pending and completed traces to see the progress of the trace.

From there, it can take anywhere from a few minutes to a few hours for your search results to be ready.

Or… You can pop over to PowerShell and, after connecting to Exchange Online, run your trace like this:

Get-MessageTrace -StartDate 3/22/2017 -EndDate 4/3/2017 -RecipientAddress -SenderAddress

…and get your search results almost instantly.

Even better, you can filter your search results by subject line, which you can’t do in the admin center:

Get-MessageTrace -StartDate 3/22/2017 -EndDate 4/3/2017 -RecipientAddress -SenderAddress | Where-Object {$_.Subject -eq “Good news, Joe!”}

And if that weren’t enough already, you can easily export the search results to a csv file by piping the output to “Export-CSV” like this:

Get-MessageTrace -StartDate 3/22/2017 -EndDate 4/3/2017 -RecipientAddress -SenderAddress | Export-CSV C:\folder\file.csv

Happy tracing!

Leave a Reply

Your email address will not be published. Required fields are marked *