Carrying out Exchange Online Content Deletion

We all dread to experience it, yet it's happened. Some at your company has unfortunately been laid off, and they've decided to voice their unhappiness in a global email to everybody in the business! You've got your friendly CEO on the phone demanding you sort this out right now and get rid of that email. Well, what do you do?

Hopefully, this guide can shed some light on this and help you purge that email from every Exchange Online mailbox. 

First off, you're going to need to make sure you have the Exchange Online PowerShell module installed. You can do this by typing this into PowerShell.

Install-Module ExchangeOnlineManagement -Scope CurrentUser

After you've done this, connect to a Security & Compliance PowerShell session.

Connect-IPPSSession -UserPrincipalName {Office 365 Global Admin UPN}

We're now going to create a new Security & Compliance Case and start the email search.

New-ComplianceSearch -Name {Descriptive Name for the Search} -ExchangeLocation All -ContentMatchQuery 'from:"Disgruntled Employee" AND subject:"I hate you all"'

Then, start the search.

Start-ComplianceSearch -Identity {Descriptive Name for the Search}

Now we're going to want to get those search results and figure out how much content we're deleting.

Get-ComplianceSearch -Identity {Descriptive Name for the Search} | Format-List

Once you're happy with your result, PURGE THOSE EMAILS!

New-ComplianceSearchAction -SearchName {Descriptive Name for the Search} -Purge -PurgeType SoftDelete

You can check on the progress of your email deletion by carring out the following.

Get-ComplianceSearchAction -Identity [Descriptive Name for the Search}_Purge

Make sure you include the "_Purge" in the identity parameter.

And that's it! You've successfully carried out a Security & Compliance search and purge.