Deleting Emails From A User Mailbox In M365 Using eDiscovery Content Search And PowerShell

This article will guide you in deleting emails from a user mailbox in M365 using eDiscovery and PowerShell.

Requirement

In organizations, there might come a situation that some emails get sent to the wrong audience, and Recalling that email via outlook was not able to recall it from every recipient. Or unwanted emails get delivered bypassing all applied security features and management wants that email to be removed from people’s mailboxes within the organization.

Plan of Action

As an M365 admin if you come across such a request then you should follow the mentioned below points to proceed.

• Approvals
• Execution of email deletion

Approvals

You will be deleting emails from mailboxes so it is a must that you get appropriate approvals from management in this regard. As your actions for deletion of the email will get recorded in audit and if required configurations are in place then your alerts will also get triggered when an eDiscovery is run.

Execution of Email Deletion

To delete emails from the user mailbox you will need additional permissions assigned to you as mentioned below, you can also use the email deletion article from Microsoft to get the necessary permissions.

• For content search, you need an eDiscovery Manager role or Compliance Search role in the Microsoft Purview compliance portal
• To delete emails you need an Organization Management role or Search And Purge role in the compliance center.

You can use eDiscovery or Content search to generate a search providing the criteria

After you chose which option to go for creating a new content search

Select location users etc for search