Deleting Dangerous or Objectionable Content from Exchange Mailboxes

When you need to delete email from Exchange mailboxes because a malicious or inappropriate message has already been delivered, the right tool depends on why it needs to go. For phishing and malware in Microsoft 365, start with Microsoft Defender for Office 365 Threat Explorer and its email remediation. For compliance, privacy or data-spillage incidents, use Microsoft Purview search and purge. On-premises Exchange Server has its own tool, Search-Mailbox. Whichever you use, verify the result rather than trusting that a successful command means the problem is gone.

That distinction matters, because at this point the question is no longer how to prevent the email. It’s how to remove it without making the situation worse. A phishing email may have reached hundreds of users. A sensitive document may have gone to the wrong distribution list. An inappropriate message may need removing as part of an HR investigation. Or a message originally judged safe may later be reclassified as malware or phishing. Microsoft 365 offers several ways to handle these, but they aren’t interchangeable.

One limitation shapes everything else. According to Microsoft’s search and purge documentation, New-ComplianceSearchAction -Purge removes a maximum of 10 items per mailbox at a time. It’s an incident-response mechanism, not a mailbox clean-up tool.

Start by establishing what actually happened

Before deleting anything, establish the scope of the incident. At a minimum, work out:

• what message you’re trying to remove, and whether it was actually delivered
• which users received it, and whether it’s still present
• where it now sits: Inbox, Junk, Deleted Items, Recoverable Items or quarantine
• whether Microsoft Defender has already detected and removed it
• whether it’s part of an ongoing phishing or malware campaign
• whether it’s also a compliance, privacy or HR matter
• whether any affected mailboxes are subject to a hold

That last point is particularly important. A security incident and a compliance investigation can overlap, but they aren’t the same thing.

Also check whether Zero-hour auto purge (ZAP) has already acted. Defender for Office 365 can retrospectively identify delivered messages as spam, phishing or malware and remove them from cloud mailboxes. If Defender has already remediated the message, manually deleting the same content adds little and can complicate the investigation.

For phishing and malware, start with Defender Threat Explorer

If the problem is a malicious email delivered to Microsoft 365 mailboxes, Threat Explorer in Defender for Office 365 is usually the place to start. It lets security teams investigate messages and take remediation actions against them: move to Junk, move to Deleted Items, soft delete or hard delete. Remediation is tracked in the Action Center, including its status and the number of messages affected.

Why Defender remediation beats Compliance Search for campaigns

Defender’s email remediation is built for security operations and supports large-scale removal, whereas Compliance Search purge stops at 10 items per mailbox per run. That makes Defender the right starting point when the problem is “we have a malicious email campaign in user mailboxes and need to remove the messages”. It also records the action in the Action Center, instead of leaving you with a PowerShell command you have to document separately. Remediation limits in Defender do change, so check the current documentation for the maximum message count supported by Take action before planning a large operation.

Check the latest delivery location

Threat Explorer shows where each message currently sits, whether that’s the Inbox, Junk, Deleted Items, Recoverable Items or quarantine. That matters because you don’t want to assume a message is still in the Inbox when another control has already moved or deleted it.

ZAP may have already dealt with the message

ZAP is worth checking before any manual clean-up, because it’s designed to act on messages delivered before Microsoft determined they were malicious, spam or phishing. A typical sequence is: the phishing email passes filtering and is delivered, Microsoft receives new threat intelligence, Defender changes the verdict, and ZAP finds and remediates the copies already delivered. If that’s happened, your job is more about confirming the scope and documenting the incident than manually removing every copy.

Use Purview search and purge when you need a controlled content search

Defender remediation isn’t always the whole answer. Sensitive information sent to the wrong recipients, a message that breaches internal policy, a specific message to locate across mailboxes, data-spillage investigations, and eDiscovery work all call for something else. So does any situation where you need to build a precise query before removing anything. For these, Purview eDiscovery and the Compliance Search PowerShell workflow are appropriate.

The connection requirements changed

This catches people out, particularly anyone running an older script. Microsoft’s documentation now requires Exchange Online PowerShell module version 3.9.0 or later, released in August 2025, and the -EnableSearchOnlySession switch on Connect-IPPSSession:

powershell

Connect-IPPSSession -EnableSearchOnlySession

Despite the name, this switch is part of the current connection requirement for search and purge, not a restriction that blocks purge actions. If your runbook connects with plain Connect-IPPSSession, it needs updating.

Check permissions too. Microsoft notes that membership of Organization Management in Exchange Online doesn’t grant the permissions needed to delete messages this way. The search-and-purge permissions are assigned in the Microsoft Purview portal. If you’re planning to automate the workflow with app-only or certificate-based authentication, check Microsoft’s current guidance first, because these cmdlets have historically required an interactive, delegated sign-in.

Build the search

Start with a narrow query. Creating the search doesn’t delete anything:

powershell

New-ComplianceSearch `
    -Name "Remove-Phishing-September2026" `
    -ExchangeLocation All `
    -ContentMatchQuery 'Subject:"Password Reset" AND From:"alerts@contoso.com"'

Run it, then check the result:

powershell

Start-ComplianceSearch -Identity "Remove-Phishing-September2026"

Get-ComplianceSearch -Identity "Remove-Phishing-September2026" |
    Format-List Name,Status,Items,Size

Before purging, make sure the result actually represents the message you intend to remove.

The 10-item purge limit is important

This is the limitation most worth understanding. This command:

powershell

New-ComplianceSearchAction `
    -SearchName "Remove-Phishing-September2026" `
    -Purge `
    -PurgeType SoftDelete

doesn’t mean “delete every matching message from every mailbox”. New-ComplianceSearchAction purges a maximum of 10 items per mailbox per run, and Microsoft is explicit that it’s an incident-response tool, not a way to clean up user mailboxes.

Imagine a phishing message reached one mailbox 11 times. The purge removes 10, and one remains. If you see that the purge action completed and stop there, you could wrongly conclude the mailbox is clean. That’s why the search has to be repeated.

The purge-and-verify process

1. Create the search, run it and validate the results.
2. Run the purge and let the action complete.
3. Re-run the search and check how many matching messages remain.
4. If appropriate, remove the previous purge action and create another one.
5. Repeat until the remaining results are understood.

Microsoft specifically documents removing the previous purge action before running another purge against the same search. There’s also a Microsoft Graph eDiscovery purge, which allows up to 100 items per location. It’s a different API with its own limits, and Microsoft advises against mixing PowerShell and Graph purges for the same incident. It still doesn’t make eDiscovery purge a general mailbox clean-up mechanism.

Soft delete versus hard delete

The purge type matters:

For a Compliance Search purge, the only difference in the command is the -PurgeType value:

powershell

New-ComplianceSearchAction `
    -SearchName "Remove-Phishing-September2026" `
    -Purge `
    -PurgeType HardDelete

Don’t treat HardDelete as simply “delete it harder”. The right choice depends on the incident and your organisation’s retention, legal and security requirements. For a suspected malware campaign, security may want rapid removal from user view. For a legal or compliance matter, preservation may matter more than making the message disappear.

Holds can change what deletion actually means

A mailbox under a hold needs special attention, because a purge can remove an item from the user’s view without destroying the underlying retained copy. Microsoft’s eDiscovery documentation explains that deleted content can be preserved when applicable holds apply.

Before any destructive action, find out whether the mailbox is on Litigation Hold or an eDiscovery hold, whether retention policies or labels are involved, and whether the message is subject to a regulatory or legal preservation requirement. The security team may need the message out of user view while legal needs a preserved copy, so remediation and evidence preservation sometimes have to happen together.

On-premises Exchange is different

Search-Mailbox is often copied from older Exchange articles as though it still works in Exchange Online. It doesn’t exist there. It remains available in Exchange Server, which Microsoft’s Exchange documentation confirms you can still use for deletion. Exchange Server 2016 and 2019 reached end of support on 14 October 2025, so Exchange Server Subscription Edition is now the supported on-premises release.

Validate the search first with -LogOnly, then delete:

powershell

Search-Mailbox `
    -Identity "user@contoso.com" `
    -SearchQuery 'Subject:"Suspicious Invoice"' `
    -LogOnly

Search-Mailbox `
    -Identity "user@contoso.com" `
    -SearchQuery 'Subject:"Suspicious Invoice"' `
    -DeleteContent

Microsoft’s Search-Mailbox reference documents up to 10,000 results per mailbox when a search query is specified, and the cmdlet can copy results to another mailbox before deletion. That’s a very different scale from the 10-item limit of the cloud purge.

Why the cloud and on-premises tools differ

There was a genuine capability change between the old and new approaches. Search-Mailbox was a mailbox-management tool. It could search one mailbox or many, log results, copy them to another mailbox and delete matching content, all in one cmdlet. Exchange Online doesn’t provide it. For cloud mailboxes, Microsoft directs administrators to Defender remediation or Purview eDiscovery, depending on the scenario. The two serve different purposes, which is why neither is a drop-in replacement for Search-Mailbox.

Proving the clean-up actually worked

A successful PowerShell command isn’t proof that the incident is resolved. Get-ComplianceSearchAction tells you about the purge action and its result, but it isn’t a complete record of every affected mailbox and message:

powershell

Get-ComplianceSearchAction |
    Format-List Name,Status,JobEndTime,Results

Keep that as part of the operational record, but don’t stop there.

Re-run the search

The simplest validation is to run the original search again and inspect the result:

powershell

Start-ComplianceSearch -Identity "Remove-Phishing-September2026"

Get-ComplianceSearch -Identity "Remove-Phishing-September2026" |
    Format-List Name,Status,Items,Size

If matching messages remain, find out why. They may be outside the search scope, unindexed, already in Recoverable Items, protected by a hold, newly delivered copies, or not removable by the method you chose. Microsoft notes that unindexed items aren’t removed by the purge, and that items from Microsoft Teams aren’t deleted either, even when the search returns them.

Use the audit log to verify deletion activity

For a serious incident, also check the Microsoft Purview audit log. Exchange audit operations include SoftDelete, HardDelete and MoveToDeletedItems, which help establish what deletion activity happened and when. Use an unambiguous date format rather than relying on the local PowerShell date parser:

powershell

$StartDate = Get-Date "2026-09-22"
$EndDate   = Get-Date "2026-09-23"

Search-UnifiedAuditLog `
    -StartDate $StartDate `
    -EndDate $EndDate `
    -Operations SoftDelete,HardDelete,MoveToDeletedItems `
    -ResultSize 5000

Add -UserIds "user@contoso.com" to narrow the search to one user. Search-UnifiedAuditLog returns a maximum of 5,000 results per call. For larger searches, it supports paging through SessionId and SessionCommand: ReturnLargeSet can retrieve up to 50,000 records, while ReturnNextPreviewPage is limited to 5,000. On a busy tenant, don’t assume -ResultSize 5000 means you’ve retrieved everything. Break the search into smaller time periods or use paging instead.

The audit data records the operation, its time, the user or account involved, the mailbox, client and message details, and the result. That’s far more useful than “the PowerShell command completed”, because it’s evidence the expected deletion actually happened.

Keep an incident record

For anything beyond a routine admin mistake, document what you did. Record:

• the message’s subject, sender, and Message ID or Network Message ID
• the recipient scope, date and time, and detection source
• the search query and the number of messages found and remediated
• the remediation method, soft or hard delete, and any exceptions or failures
• the hold or retention considerations
• the verification performed and who approved the action

That record becomes particularly important when security, legal, HR or management are involved.

Preventing the message from becoming an incident

Removal is only the response after delivery. For malicious email, Defender for Office 365 provides controls such as anti-phishing, anti-malware, Safe Links and Safe Attachments, which aim to stop threats before they become a clean-up exercise, and Threat Explorer shows how messages were delivered and which detections applied. For accidental disclosure of sensitive information, Microsoft Purview DLP tackles a different part of the problem, by applying policy to sensitive information before or during sending. Malware remediation and data loss prevention solve different problems.

Choosing the right tool

The key is not to pick a deletion command first and work backwards. Start with the incident. If it’s a malicious email campaign, investigate it through Defender. If it’s a compliance or data-spillage issue, establish the search and preservation requirements before removing anything. If it’s on-premises Exchange, use the tools for that platform. Whatever the method, verify the result rather than assuming a successful command means the problem has gone.

Email removal checklist

1. Establish the scope: the message, who received it, where it now sits, and whether it’s a security, compliance or HR matter, or more than one.
2. Check whether ZAP or Defender has already remediated it.
3. For phishing or malware in Microsoft 365, remediate through Threat Explorer and track it in the Action Center.
4. Check every affected mailbox for holds and preservation requirements before any destructive action.
5. For a Purview purge, connect with Exchange Online PowerShell 3.9.0 or later using Connect-IPPSSession -EnableSearchOnlySession, with the search-and-purge permissions assigned in Purview.
6. Build a narrow search, run it, and confirm the results match the message you intend to remove.
7. Choose SoftDelete or HardDelete deliberately, then purge, re-search and repeat, removing the previous purge action each time, until any remaining results are explained.
8. On Exchange Server Subscription Edition, validate with Search-Mailbox -LogOnly before using -DeleteContent.
9. Verify the deletion in the Purview audit log, paging or splitting by date for large result sets.
10. Record the incident details, approval and verification.

Microsoft references

• Search for and delete email messages – the Purview search-and-purge workflow, connection requirements and 10-item limit
• New-ComplianceSearchAction – purge actions and purge types
• Connect-IPPSSession – connecting to Security & Compliance PowerShell
• Search-Mailbox – the Exchange Server cmdlet
• Threat Explorer in Defender for Office 365 – investigating and remediating delivered messages
• Zero-hour auto purge – retrospective removal of malicious messages
• Search-UnifiedAuditLog – audit log searches and paging limits

Daniel Lutton

From my early days on the helpdesk through roles as a service desk manager, systems administrator, and network engineer, I’ve spent more than 25 years in the IT world. As I transition into cyber security, my goal is to make tech a little less confusing by sharing what I’ve learned and helping others wherever I can.