Use Microsoft Purview Content search plus a purge action when you need to delete matching Exchange Online emails. Confirm the search scope first, then choose SoftDelete when you need recoverability, or HardDelete only when retention and legal hold rules allow it. Bad scope or the wrong purge type can remove the wrong mail, leave copy data behind, or trigger compliance issues. These errors indicate that the listed PowerShell commands and arguments should not be used in this workflow. This guide explains how to validate the search, pick the right purge method, and avoid irreversible deletion mistakes before you act.
Using Microsoft Purview for targeted deletions
The modern path is Microsoft Purview content search, then a purge action. Use it for targeted deletion, incident response, or mailbox cleanup when you need to match sender, subject, date, or another KQL term. The older Search-Mailbox cmdlet is retired in Exchange Online, so it should not be the first choice for new work.
Keep the workflow tight. Search first. Review the scope. Delete only what you can justify. That matters because retention, hold, archive, and single item recovery can change what deletion actually removes.
What you need first
- Microsoft Purview permissions: eDiscovery Manager or Compliance Search for searching.
- Search And Purge or Organization Management for deletion.
- Access to Exchange Online PowerShell and the Security & Compliance session through Connect-IPPSSession. (Microsoft Learn)
- The Exchange Online Management module, plus the compliance session used for search and purge work.
- A clear mailbox scope: one mailbox, a set of mailboxes, or all mailboxes.
- A search term, such as sender, subject, or date range, written in KQL.
Role changes may take time to apply. A command can fail even after the right role assignment appears in the portal if the token or backend role cache has not caught up yet.
Confirm scope before you start
Decide whether this is routine cleanup or an incident-response purge. Routine cleanup usually stays narrow and recoverable. Incident work may justify broader scope, but it still needs exact mailbox targeting and a documented reason for deletion.
- Identify the mailbox or mailboxes that may contain the message.
- Decide whether archive mailboxes need to be included.
- Prepare the sender, subject, or date filter before you run the search.
- Check whether retention or legal hold might preserve content after deletion.
How do you search and delete emails?
Connect to the Security & Compliance session, create a compliance search, start it, confirm the status, and then run the purge action. The core search workflow uses mailbox scope plus a KQL query, and you can confirm whether the search is still pending or has completed before you delete anything.
Use the compliance session
Start with the compliance endpoint, not just a general Exchange session. Exchange Online PowerShell is useful for tenant administration, but the search-and-purge workflow depends on the Security & Compliance connection.
- Open Exchange Online PowerShell.
- Run Connect-IPPSSession.
- Confirm that the role assignments for search and purge are present.
Create the search
Build the search with the narrowest mailbox scope that fits the case. One example search term from Microsoft guidance uses the subject term spam. Use your own sender, subject, or date clause instead of broad mailbox-wide text when possible.
- Create a compliance search with the mailbox or mailboxes you want to target.
- Add a KQL condition that matches the message you need to remove.
- Name the search clearly so the target is obvious in later review.
Example: create a search named for the cleanup task, set the mailbox scope to the intended user mailbox, and use a subject-based query that matches the message you want to remove.
Start and check status
Creation does not begin the search. Start it, then check the status until it completes. If the status remains unchanged for a long time, verify the query and mailbox scope before you retry.
- Run the search start action.
- Check the search status until it changes from NotStarted to Completed.
- Review the result count and mailbox scope before any deletion step.
Example: start the compliance search after you create it, then check its status until it completes.
Example: confirm the search status after the job has had time to run.
Run the purge action
New-ComplianceSearchAction is used for follow-up actions such as purge workflows in Microsoft Purview and eDiscovery contexts. Preview behavior can vary by tenant and experience, so do not assume the same review option exists everywhere. Use the action only after you have confirmed the search returned the right messages.
Example: after you confirm the search results, run the purge action with the purge type that matches your recovery needs.
Which purge method should you choose?
SoftDelete moves content out of the user-visible mailbox, while HardDelete is the more aggressive purge type. Neither choice should be treated as a guarantee that content is gone everywhere, because retention, hold, and single item recovery can still preserve or surface data later. Microsoft Learn also warns that deleted items cannot be recovered after permanent deletion in the contexts where permanent deletion applies.
Use SoftDelete for lower-risk cleanup
Choose SoftDelete when you need to remove a message from normal user access and keep a recovery path for investigation or rollback. That is the better default for routine mailbox cleanup and most first-pass incident work.
- Run the search and confirm the result set.
- Choose -PurgeType SoftDelete.
- Recheck mailbox and item counts after the action completes.
Use HardDelete only with a clear compliance reason
HardDelete is for cases where policy, legal review, or incident response calls for a stronger deletion path. Even then, retention or hold can still preserve the item somewhere in the service, so the result is not the same as erasing every trace from the tenant.
- Confirm that legal hold and retention rules permit the action.
- Document why SoftDelete is not enough.
- Run the purge only on the verified search scope.
Example: Suppose a phishing message is present in 12 user mailboxes. Start with a search against those 12 mailboxes, not all mailboxes, then review the result count before choosing SoftDelete. A broader action should wait until the scope is proven.
Exchange mailbox scope checklist
Single mailbox
Use a single mailbox when one user received the message or when you need to test the query before widening scope. This is the safest way to validate sender and subject filters.
Multiple mailboxes
Use a defined mailbox list when the message reached a known group. This keeps the search bounded and reduces the chance of touching unrelated mail.
All mailboxes
You can target all mailboxes with -ExchangeLocation All. Use it only when the message truly belongs everywhere, because the search can scale across a very large tenant. Microsoft guidance places the searchable and purgeable mailbox maximum at 50,000.
Sender, subject, and date filters
Use KQL terms that narrow the target quickly. Sender-based searches work well for campaign cleanup. Subject terms help when the message has a known title. Date filters help when the incident window is known.
Example: build a sender-based search that targets the bad actor address and the mailboxes affected by the message.
Example: build a subject-based search that matches the exact wording in the message title.
Example: build a date-based search that covers only the known incident window.
Exchange online content search checklist
| Scenario | Recommended method | Required roles | Red-flag warnings |
|---|---|---|---|
| Single mailbox | New-ComplianceSearch with one mailbox, then SoftDelete | Compliance Search; Search And Purge | Broad sender terms can catch old mail and forwarded copies |
| All mailboxes | New-ComplianceSearch with -ExchangeLocation All | Compliance Search; Search And Purge; often Organization Management | Wide searches can return unrelated mail and large result sets |
| Sender-based purge | Search by from: address, then purge only verified hits | eDiscovery Manager or Compliance Search; Search And Purge | Display names are not enough; use the SMTP address |
| Accidental broad search | Stop, narrow the query, and rerun before deleting anything | Search role only until scope is corrected | Deleting a broad result set can remove mail you did not intend to touch |
Exchange online content search table
| Failure | Likely cause | Fix |
|---|---|---|
| Permission denied | Search or purge role not assigned yet | Check the Purview role group, then wait for assignment latency and reconnect |
| Search stays NotStarted | The job was created but not started | Start the search, then check its status again |
| Too many results | The query is too broad or the mailbox scope is too wide | Add sender, subject, date, or mailbox filters and rerun |
| Purge does not remove everything | Retention, hold, or single item recovery kept copies | Review compliance settings before choosing HardDelete or escalating |
Common mistakes to avoid
Overbroad searches are the biggest risk. A query like a single common word can sweep in unrelated mail from many mailboxes, especially if you target all mailboxes. Narrow by sender address, exact subject text, and date range before you delete anything.
Another common failure is role timing. An admin can look correctly assigned in the portal and still get a deny response until the role update finishes propagating. If a command fails after a fresh role change, reconnect and try again later.
Archive mailboxes and hold settings also change expectations. A purge result does not mean the content is permanently absent everywhere in the service. That is why incident-response deletion and routine cleanup should not use the same risk tolerance.
Common first-timer mistake is running a tenant-wide purge because one user reported spam. The safer move is to search one mailbox first, inspect the result set, and widen only if the same message appears elsewhere.
How many mailboxes or items can you purge with compliance search?
Microsoft guidance places the searchable and purgeable mailbox ceiling at 50,000. Some workflows limit deletion to 10 items per mailbox at once, while premium-enabled cases can purge up to 100 items per location. Treat those as workflow limits, not a reason to run a broad search without review. (Microsoft Learn)
Search-Mailbox, when referenced historically, can return up to 10,000 results per mailbox. It is retired in Exchange Online, so it should not be the default path for current tenants.
How do I preview search results before deleting emails?
Preview options can vary by tenant and experience, so the safe default is to validate scope with a narrow search and review the result count before purging. If your tenant exposes a preview or report action in Purview, use it only after the query has already been narrowed to the mailbox or mailboxes you expect.
A practical check is to run a status check on the search, confirm the search is completed, and compare the returned scope with the intended target. If the count is higher than expected, narrow the query before any purge action.
Frequently asked questions
How do I search Exchange Online mailboxes and delete specific emails?
Use Connect-IPPSSession, create a search with the compliance search tools, start it, verify completion, then run the purge action. Keep the mailbox scope narrow and confirm the query matches the message you intend to remove.
What PowerShell permissions do I need to purge emails in Microsoft 365?
You need Compliance Search or eDiscovery Manager to search, plus Search And Purge or Organization Management to delete. If a fresh assignment does not work immediately, reconnect to the compliance session and allow time for role propagation.
Can I delete emails from all mailboxes at once in Exchange Online?
Yes, by using -ExchangeLocation All in the compliance search workflow. That should be reserved for cases where the message truly spans the tenant, because the search can touch up to 50,000 mailboxes and produce a very large result set.
What is the difference between soft delete and hard delete for compliance search?
SoftDelete removes the item from normal mailbox access but leaves more room for recovery or investigation. HardDelete is more aggressive, yet retention, hold, and single item recovery can still preserve content. Do not treat HardDelete as a guarantee of complete disappearance from the service.
Does Search-Mailbox still work in Exchange Online?
No, it is retired in Exchange Online and should not be used as the modern deletion path. Use Microsoft Purview content search and purge actions instead, with Connect-IPPSSession and the compliance search workflow.
What if the email I need to remove was sent by a specific sender or subject line?
Use a narrow KQL query based on the sender or subject, then scope it to the right mailboxes with the compliance search settings. Run the search first, inspect the results, and only then choose SoftDelete or HardDelete based on the retention rules that apply.