Deleting Dangerous or Objectionable Content from Exchange Mailboxes

When a malicious or inappropriate email has already reached user mailboxes, the question is no longer how to prevent it. The question is how to remove it without making the situation worse.

That distinction matters.

A phishing email may have reached hundreds of users. A sensitive document may have been sent to the wrong distribution list. An inappropriate message may need to be removed as part of an HR investigation. Or a message that was originally considered safe may later be reclassified as malware or phishing.

Microsoft 365 provides several ways to deal with these situations, but they are not interchangeable.

For malicious email, Microsoft Defender for Office 365 Threat Explorer and email remediation should generally be the starting point. Microsoft Purview eDiscovery and Compliance Search provide a different workflow that is useful when you need to search for and remove specific content, particularly for compliance or data-spillage incidents. On-premises Exchange has its own tooling, including Search-Mailbox.

There is also an important limitation with the Purview purge workflow: New-ComplianceSearchAction -Purge removes a maximum of 10 items per mailbox per run. It is an incident-response mechanism, not a mailbox-cleanup tool. Microsoft explicitly documents this limitation.

Start by establishing what actually happened

Before deleting anything, establish the scope of the incident.

At a minimum, determine:

• What message are you trying to remove?
• Was it actually delivered to mailboxes?
• Which users received it?
• Is the message still present?
• Is it in Inbox, Junk, Deleted Items, Recoverable Items or quarantine?
• Has Microsoft Defender already detected and removed it?
• Is the incident part of an ongoing phishing or malware campaign?
• Is the incident also a compliance, privacy or HR matter?
• Are any affected mailboxes subject to a hold?

This last point is particularly important. A security incident and a compliance investigation can overlap, but they are not the same thing.

You should also check whether Zero-hour Auto Purge (ZAP) has already acted. Defender for Office 365 can retrospectively identify messages as spam, phishing or malware and remove them from cloud mailboxes.

If Defender has already remediated the message, manually deleting the same content may add little value and can complicate the investigation.

For phishing and malware, start with Defender Threat Explorer

If the problem is a malicious email that was delivered to Microsoft 365 mailboxes, Threat Explorer in Microsoft Defender for Office 365 is usually the tool to look at first.

Threat Explorer lets security teams investigate messages and take remediation actions against them. Depending on the situation, actions include:

• Move to Junk
• Move to Deleted Items
• Soft delete
• Hard delete

Microsoft also provides tracking through the Action Center, including remediation status and the number of messages affected.

Why this is different from Compliance Search

This is an important distinction.

The New-ComplianceSearchAction -Purge workflow has a maximum of 10 items per mailbox per execution. Defender’s email remediation workflow is designed specifically for security operations and supports large-scale remediation.

That makes Defender the appropriate place to start when the problem is:

“We have a malicious email campaign in user mailboxes and need to remove the messages.”

It also provides tracking through the Defender Action Center rather than leaving you with a PowerShell command that you have to document separately.

Remediation limits in Defender do change, so check the current documentation for the maximum message count supported by the Take action workflow in your tenant before planning a large operation.

Check the latest delivery location

Threat Explorer can show where a message currently resides, including locations such as:

• Inbox
• Junk
• Deleted Items
• Recoverable Items
• Quarantine

This matters because you don’t want to assume that a message is still sitting in the Inbox when another control has already moved or deleted it.

ZAP may have already dealt with the message

Zero-hour Auto Purge is worth checking before starting a manual cleanup.

ZAP is designed to retrospectively act on messages that were delivered before Microsoft determined that they were malicious, spam or phishing.

For example, the sequence might be:

1. The phishing email passes through filtering.
2. The message is delivered.
3. Microsoft receives additional threat intelligence.
4. Defender changes the verdict.
5. ZAP identifies previously delivered copies.
6. The messages are automatically remediated.

If that has happened, your job may be more about confirming the scope and documenting the incident than manually removing every copy.

Use Purview search and purge when you need a controlled content search

There are situations where Defender remediation isn’t the whole answer.

Examples include:

• Sensitive information sent to the wrong recipients
• A message that violates an internal policy
• A specific message that needs to be located across mailboxes
• Data-spillage investigations
• Compliance or eDiscovery work
• Situations where you need to build a precise search query before removal

For these situations, Microsoft Purview eDiscovery and the Compliance Search PowerShell workflow can be appropriate.

The connection requirements changed

This catches people out, particularly anyone running an older script.

Since late September 2025, the eDiscovery cmdlets require:

• Exchange Online PowerShell module version 3.9.0 or later
• The -EnableSearchOnlySession switch on Connect-IPPSSession

Connect-IPPSSession -EnableSearchOnlySession

Despite the name, this switch is part of the current connection requirement for the search and purge workflow, not a restriction that prevents purge actions.

There is one more thing worth knowing if you are automating any of this: these cmdlets remain incompatible with certificate-based authentication. A script that authenticates with a certificate will not be able to run them.

If you are working from an existing runbook that connects with Connect-IPPSSession and no switch, it will need updating.

Build the search

Start with a narrow query.

New-ComplianceSearch `
    -Name "Remove-Phishing-September2026" `
    -ExchangeLocation All `
    -ContentMatchQuery 'Subject:"Password Reset" AND From:"alerts@contoso.com"'

The search itself is not the deletion.

Run it:

Start-ComplianceSearch -Identity "Remove-Phishing-September2026"

Then check the result:

Get-ComplianceSearch -Identity "Remove-Phishing-September2026" |
    Format-List Name,Status,Items,Size

Before purging, make sure the result actually represents the message you intend to remove.

The 10-item purge limit is important

This is one of the most important limitations to understand.

The following command:

New-ComplianceSearchAction `
    -SearchName "Remove-Phishing-September2026" `
    -Purge `
    -PurgeType SoftDelete

does not mean:

Delete every matching message from every mailbox.

Microsoft currently limits this purge action to 10 items per mailbox per run. Microsoft explicitly states that the capability is intended as an incident-response tool and isn’t intended to clean up user mailboxes.

So imagine a phishing message reached one mailbox 11 times.

The purge can remove 10 of them.

One remains.

If you simply see that the purge action completed successfully and stop there, you could incorrectly conclude that the mailbox has been cleaned up.

That is why the search needs to be repeated.

The purge-and-verify process

The basic process is:

1. Create the search.
2. Run the search.
3. Validate the results.
4. Run the purge.
5. Allow the purge action to complete.
6. Re-run the search.
7. Check how many matching messages remain.
8. If appropriate, remove the previous purge action and create another purge action.
9. Repeat until the remaining results are understood.

Microsoft specifically documents removing the previous purge action before running another purge against the same search.

There is also a Microsoft Graph eDiscovery purge capability that allows up to 100 items per location, but that is a different API and still has its own limits. It does not turn eDiscovery purge into a general mailbox-cleanup mechanism.

Soft delete versus hard delete

The purge type matters.

Microsoft documents the distinction between soft and hard deletion and how deleted items interact with Recoverable Items and retention.

For a Compliance Search purge:

New-ComplianceSearchAction `
    -SearchName "Remove-Phishing-September2026" `
    -Purge `
    -PurgeType SoftDelete

or:

New-ComplianceSearchAction `
    -SearchName "Remove-Phishing-September2026" `
    -Purge `
    -PurgeType HardDelete

Don’t treat HardDelete as simply “delete it harder”.

The decision depends on the incident and the organisation’s retention, legal and security requirements.

For a suspected malware campaign, security may want rapid removal from user visibility. For a legal or compliance matter, however, the preservation requirements may be more important than making the message disappear.

Holds can change what deletion actually means

A mailbox subject to a hold needs special attention.

A purge action can remove an item from the user’s normal view without necessarily destroying the underlying retained copy.

Microsoft’s current eDiscovery documentation explains that deleted content can be preserved when a mailbox is subject to applicable holds.

Before performing a destructive action, determine:

• Is the mailbox on Litigation Hold?
• Is there an eDiscovery hold?
• Are retention policies or retention labels involved?
• Is the message subject to a regulatory or legal preservation requirement?
• Does the security team need the message removed from user view while legal needs a preserved copy?

Security remediation and evidence preservation may need to happen at the same time.

On-premises Exchange is different

If you’re managing Exchange Server 2016, Exchange Server 2019 or Exchange Server Subscription Edition, Search-Mailbox remains available.

It is important to be explicit about this because the command is often copied from older Exchange articles and presented as though it still works in Exchange Online.

It does not exist in Exchange Online.

Microsoft’s current documentation lists Search-Mailbox as an Exchange Server cmdlet.

For example:

Search-Mailbox `
    -Identity "user@contoso.com" `
    -SearchQuery 'Subject:"Suspicious Invoice"' `
    -LogOnly

Once the search has been validated, an administrator can use -DeleteContent:

Search-Mailbox `
    -Identity "user@contoso.com" `
    -SearchQuery 'Subject:"Suspicious Invoice"' `
    -DeleteContent

Microsoft documents that Search-Mailbox can return up to 10,000 results per mailbox when a search query is specified. It also supports copying search results to another mailbox before deletion.

That is considerably different from the 10-item-per-mailbox limit of the modern Compliance Search purge cmdlet.

Why the distinction matters

There was a genuine capability change between the old and new approaches.

Search-Mailbox was a mailbox-management tool with features such as:

• Searching an individual mailbox
• Searching multiple mailboxes
• Logging results
• Copying results to another mailbox
• Deleting matching content

The Exchange Online service does not provide that cmdlet.

For cloud mailboxes, Microsoft instead directs administrators toward Purview eDiscovery and Defender remediation depending on the scenario.

Proving that the cleanup actually worked

A successful PowerShell command is not the same thing as proving that the incident has been resolved.

Get-ComplianceSearchAction can tell you about the purge action and its result, but it isn’t a complete report of every affected mailbox and every message.

For example:

Get-ComplianceSearchAction |
    Format-List Name,Status,JobEndTime,Results

Use that as part of the operational record, but don’t stop there.

Re-run the search

The simplest validation is to run the original search again.

Start-ComplianceSearch -Identity "Remove-Phishing-September2026"

Then inspect the result:

Get-ComplianceSearch -Identity "Remove-Phishing-September2026" |
    Format-List Name,Status,Items,Size

If matching messages remain, determine why.

They may be:

• Outside the scope of the search
• Unindexed
• Already in Recoverable Items
• Protected by a hold
• Not remediable through the selected method
• Newly delivered copies of the message

Microsoft specifically notes that unindexed items aren’t removed by the Compliance Search purge action.

Use the audit log to verify deletion activity

For a serious incident, I would also check the Microsoft Purview audit log.

Exchange audit operations include SoftDelete, HardDelete and MoveToDeletedItems. These records can help establish what deletion activity occurred and when.

Use an unambiguous date format rather than relying on the local PowerShell date parser:

$StartDate = Get-Date "2026-09-22"
$EndDate   = Get-Date "2026-09-23"

Search-UnifiedAuditLog `
    -StartDate $StartDate `
    -EndDate $EndDate `
    -Operations SoftDelete,HardDelete,MoveToDeletedItems `
    -ResultSize 5000

Search-UnifiedAuditLog has a maximum ResultSize of 5,000 per call. For larger searches, Microsoft provides paging through SessionId and SessionCommand. ReturnLargeSet can retrieve up to 50,000 records, while ReturnNextPreviewPage is limited to 5,000.

For a busy tenant, don’t assume that -ResultSize 5000 means you have retrieved every matching audit record.

You can also narrow the search by user:

$StartDate = Get-Date "2026-09-22"
$EndDate   = Get-Date "2026-09-23"

Search-UnifiedAuditLog `
    -StartDate $StartDate `
    -EndDate $EndDate `
    -UserIds "user@contoso.com" `
    -Operations SoftDelete,HardDelete,MoveToDeletedItems `
    -ResultSize 5000

For large investigations, Microsoft’s audit-log guidance recommends breaking the search into smaller time periods or using paging rather than relying on a single large query.

The audit data can provide information such as:

• Operation performed
• Time of the operation
• User or account involved
• Mailbox
• Client information
• Message information
• Result status

That gives you something much more useful than:

“The PowerShell command completed.”

It gives you evidence that the expected deletion activity actually occurred.

Keep an incident record

For anything beyond a routine administrative mistake, document the action.

I would record:

• Original message subject
• Sender
• Recipient scope
• Message ID or Network Message ID where available
• Date and time
• Detection source
• Search query
• Number of messages identified
• Number remediated
• Remediation method
• Soft or hard delete
• Any exceptions or failures
• Hold or retention considerations
• Verification performed
• Person who approved the action

This becomes particularly important when security, legal, HR or management are involved.

Preventing the message from becoming an incident

Removal is only the response after delivery.

For malicious email, Microsoft Defender for Office 365 provides controls intended to prevent or detect threats before they become a mailbox cleanup exercise, including anti-phishing, anti-malware, Safe Links and Safe Attachments.

Defender also provides visibility through Threat Explorer, which can be used to investigate how messages were delivered and what detection technologies were associated with them.

For accidental disclosure of sensitive information, Microsoft Purview DLP addresses a different part of the problem by applying policy to sensitive information before or during transmission.

The important distinction is that malware remediation and data-loss prevention are solving different problems.

Choosing the right tool

The practical decision looks something like this:

The key is not to pick a deletion command first and work backwards.

Start with the incident.

If it is a malicious email campaign, investigate it through Defender. If it is a compliance or data-spillage issue, establish the search and preservation requirements before removing anything. If it is an on-premises Exchange environment, use the tools available to that platform.

And regardless of the method, verify the result rather than assuming the command succeeded means the problem is gone.

Microsoft references

• New-ComplianceSearchAction
• Connect-IPPSSession
• Search-Mailbox
• Threat Explorer in Defender for Office 365
• Search-UnifiedAuditLog

Daniel Lutton

From my early days on the helpdesk through roles as a service desk manager, systems administrator, and network engineer, I’ve spent more than 25 years in the IT world. As I transition into cyber security, my goal is to make tech a little less confusing by sharing what I’ve learned and helping others wherever I can.