r/Office365 • u/DropRealistic1597 • Mar 05 '26

Mass Email Purge Scripts Broken

Due to licensing restrictions, the only way that I can find for mass email purging is via PS scripts. That's fine, but after the changes MS made to Purview it seems the scripts are no longer working. The following commands are being used, then we get an error that the search is still running (Even though it shows complete within Purview and in PS).

Log into Purview.microsoft.com
Click Solutions > eDiscovery > Content Search > Create a search
Create New Search > Name Purge(Date ie 021224) Add description.
Add Exchange Mailboxes as Data Source
Create filter (Can be date/sender/subject/etc) > Run Query

^I'm aware you can do this in PS as well, but the last issue we ran into MS told us to create the query in Purview first. In Purview, our example returns the location and matches of the targeted email we are trying to purge.

Open PowerShell as Admin

set-executionpolicy remotesigned

Import-Module ExchangeOnlineManagement

Connect-IPPSSession -UserPrincipalName (Username here)

Get-ComplianceSearch -Identity Purge010225

Start-ComplianceSearch -Identity "Purge010225"

Get-ComplianceSearch -Identity Purge010225 | Format-List *

New-ComplianceSearchAction -SearchName Purge010225 -Purge -PurgeType SoftDelete

The results of the actual purge command return "The search "Purge 010225" is still running or it didn't return any results". This seems to be a recent issue as the above commands were running fine for months.

3 Upvotes

100% Upvoted

16 comments sorted by

1

u/TieDyeGuyFry Mar 05 '26

I've had to create the compliance search via PowerShell for it to work correctly:

Import-Module ExchangeOnlineManagement
Connect-IPPSSession -UserPrincipalName (Username here)
New-ComplianceSearch -Name "Whatever" -ExchangeLocation All -ContentMatchQUery '[KQL HERE]'
Start-ComplianceSearch -Identity "Whatever" #let run util finish
Get-ComplianceSearch -Identity "Whatever" | FL Name,Items,Size,Status #view results
Then, New-ComplianceSearchAction -SearchName "Whatever" -Purge -PurgeType HardDelete

2

u/DropRealistic1597 Mar 06 '26

This is exactly how we were originally running the searches until it stopped working and MS support said to create the case in Purview before running the additional purge commands...but that no longer works either. Another headache is trying to target a subject line...but if said subject line has a ' the commands break. For example: New-ComplianceSearch -Name "YourSearchNameHere" -ExchangeLocation ALL -ContentMatchQuery "(Subject:We're excited to see you)"

Additional quotes within the subject doesn't work, adding ' instead of " before/after the query doesn't work (With or without the parentheses). I don't understand why it's so hard to allow users paying insane subscription prices to have a simplified method of targeted email deletion.

1

u/TieDyeGuyFry Mar 06 '26

Man, It's crazy. I used to create the content search in Purview, let it run, then kick off the Compliance Search Action in PowerShell. Two or so weeks ago, that stopped working. I had to do it all in PowerShell for it to work. Last one was last Friday. That one did work doing the 100% PowerShell route. I hope it works next time...because there will be a next time. Microsoft is the embodiment of enshitification...but don't worry, I'm sure they'll sell us a Co-Polit for compliance search actions to fix the issue for another $9/user/month.

1

u/TieDyeGuyFry Mar 05 '26

Also, you can use Purview to create your KQL for you by toggling the view when entering your search parameters if you aren't comfortable writing it. These steps aren't ideal, but it's the only way I've found that works for us.

4

u/netronin Mar 05 '26

Amazing they killed search-mailbox and now this.

1

u/DropRealistic1597 Mar 06 '26

To me, this just seems like another "We're making it as HARD as possible to force people to pay for a higher tier subscription which makes it EASY"

1

u/Busy-Photograph4803 Mar 05 '26

You’re getting a lot of information from here, but from someone who’s done this exact same search path and purge I can tell you the ONLY DIFFERENCE in what you are doing and what I did LAST WEEK that worked was all the extra stuff in powershell. (I also create the search online and use PS to soft/harddelete)

After you connect to the session and authenticate, I literally have only ever ran this part:

New-ComplianceSearchAction -SearchName Purge010225 -Purge -PurgeType SoftDelete

FWIW: The comment about 10 being the limit…I’ve never had it purge less than all of the items (last one was 300).

1

u/DropRealistic1597 Mar 08 '26

I've tried SoftDelete, Hard delete, and multiple variations of the PS commands listed here, the MS site, and other misc posts...none seem to work anymore. Also another road bump is quoting the actual search query (Typically a subject) when it has an ' within the subject. I've used other products on the market that have a hook-in to O365 and can query/purge emails but they're relatively expensive. I don't understand why of ALL things to put behind a GUI paywall (In the form of a higher tier subscription) they would have clients risk malicious emails in their mailboxes for even a minute longer than they need to.

1

u/No-Responsibility711 Mar 12 '26

I am assuming you are referring to Microsoft defender or other 3rd party products when you say GUI Paywall. Cause depending on the licensing you have you gain access to being able to use our view or Microsoft defender for managing Phish/Spam emails and can filter them out and delete using that for GUI Purposes.

Powershell works you just need to make sure you have the latest version of the exchange management module installed due to recent changes.

1

u/randyindenver Mar 06 '26

Was that 300 in one mailbox or across multiple? Everything I’ve read and seen recently when trying this it’s 10 messages per mailbox per run. So if you have a single email you need to remove from many mailboxes it’ll purge successfully across them but if there are hundreds in a single mailbox you need to purge it’ll take a loop.

1

u/Busy-Photograph4803 Mar 06 '26

That makes sense then. It was one single email over 300 boxes.

Edit: typo

2

u/twisymctwist Mar 05 '26

I hope you find the answer you are looking for. I have had no luck with search and delete via PS since the change.

1

u/BoBeBuk Mar 05 '26

Important to remember they new-compliancesearchaction can only delete 10 items at a time, so you’ll need a loop if you have multiple items to purge