This article will guide you in deleting emails from a user mailbox in M365 using eDiscovery and PowerShell.
Requirement
In organizations, there might come a situation that some emails get sent to the wrong audience, and Recalling that email via outlook was not able to recall it from every recipient. Or unwanted emails get delivered bypassing all applied security features and management wants that email to be removed from people’s mailboxes within the organization.
Plan of Action
As an M365 admin if you come across such a request then you should follow the mentioned below points to proceed.
- Approvals
- Execution of email deletion
Approvals
You will be deleting emails from mailboxes so it is a must that you get appropriate approvals from management in this regard. As your actions for deletion of the email will get recorded in audit and if required configurations are in place then your alerts will also get triggered when an eDiscovery is run.
Execution of Email Deletion
To delete emails from the user mailbox you will need additional permissions assigned to you as mentioned below, you can also use the email deletion article from Microsoft to get the necessary permissions.
- For content search, you need an eDiscovery Manager role or Compliance Search role in the Microsoft Purview compliance portal
- To delete emails you need an Organization Management role or Search And Purge role in the compliance center.
You can use eDiscovery or Content search to generate a search providing the criteria
![how to delete emails from user mailbox using eDiscovery, Content Serch and PowerShell]()
![how to delete emails from user mailbox using eDiscovery, Content Serch and PowerShell]()
After you chose which option to go for creating a new content search
![how to delete emails from user mailbox using eDiscovery, Content Serch and PowerShell]()
Select location users etc for search
![how to delete emails from user mailbox using eDiscovery, Content Serch and PowerShell]()
Provide required search conditions
![how to delete emails from user mailbox using eDiscovery, Content Serch and PowerShell]()
Review your search and submit
![how to delete emails from user mailbox using eDiscovery, Content Serch and PowerShell]()
Wait till the search gets completed
![how to delete emails from user mailbox using eDiscovery, Content Serch and PowerShell]()
Review the search summary
![how to delete emails from user mailbox using eDiscovery, Content Serch and PowerShell]()
You can also review the sample of the generated search or download emails in PST format. To delete emails connect to Security & Compliance PowerShell for your organization.
![how to delete emails from user mailbox using eDiscovery, Content Serch and PowerShell]()
Now to can use New-ComplianceSearchAction command to delete the emails accumulated during search to soft Delete or Hard delete
![how to delete emails from user mailbox using eDiscovery, Content Serch and PowerShell]()
In case of soft delete you will be able to see the deleted emails in recoverable items
![how to delete emails from user mailbox using eDiscovery, Content Serch and PowerShell]()
In Case you used eDiscovery then you can also receive an email alert for running the eDiscovery.
![how to delete emails from user mailbox using eDiscovery, Content Serch and PowerShell]()
Summary
In this article, we looked at how to delete emails from user mailbox using eDiscovery, Content Serch and PowerShell.