Office 365 - Microsoft purview E-Discovery search and deletion query.

vSolutionsIT 0 Reputation points
2026-10-26T09:47:16.2366667+00:00

One of the user who recently left the company send an sensitive content email to few internal users (Example below).

 

Email details :

 

Sender:

Sent date/time: October 20, 2026 around 6:00 pm.

Subject: Party Invitation

Attachment excel filename: Party Invitation for all.

Recipients:

 

Looking at the sensitivity of the data we would like to gather below info using purview or any other method in Office 365. Kindly suggest the steps to achieve each of the below tasks. 

 

  1. Confirm which  Exchange mailboxes contain the original message or remaining copies.
  2. How to check if any of the users who received that email /attachment moved it under retention, legal hold , security policy and how remove that email along with attachment from there.

 

  1. How to confirm if that sensitive email has attachment sent as standard email attachment as a file or a One Drive / SharePoint cloud attachment or sharing link.

 

  1. If the attachment was One Drive / SharePoint or Cloud attachment, how to find it's attachment and delete it as remediation action.

 

  1. Confirm if the deletion we performed was successful, or blocked by any retention policy, Litigation hold, e Discovery hold or any other compliance settings.

 

Any help in these queries will be greatly appreciated. Thank you very much in advance.

Exchange | Other
Exchange | Other

A powerful email and collaboration platform developed by Microsoft, designed to support enterprise-level communication and productivity. Miscellaneous topics that do not fit into specific categories.

0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Austin-H 8,805 Reputation points Microsoft External Staff Moderator
    2026-11-02T04:05:46.4966667+00:00

    Hello vSolutionsIT
    You can use Microsoft Purview eDiscovery, Exchange Online PowerShell, the Microsoft 365 audit log, and OneDrive/SharePoint administration to investigate this incident. The steps depend on whether the Excel file was attached directly to the email or shared through OneDrive/SharePoint.

    1.Confirm which Exchange mailboxes contain the original message or any remaining copies

    -From:

    -Subject: Party Invitation

    -Sent: October 20, 2026

    -Attachment: Party Invitation for all.xlsx

    The search results should help identify all mailboxes where the message currently exists.

    Reference: Search for mailbox data in eDiscovery.

    2.Check retention policies, Litigation Hold, and eDiscovery holds

    A user moving an email to a folder does not by itself establish that the message is under a legal hold. Administrators should review the applicable retention policies, retention labels, mailbox settings, and eDiscovery cases.

    You can use Exchange Online PowerShell to inspect relevant mailbox properties:

    Connect-ExchangeOnline
Get-Mailbox user(at)domain.com |
    Format-List LitigationHoldEnabled,
                LitigationHoldDuration,
                InPlaceHolds,
                RetentionHoldEnabled,
                RetainDeletedItemsFor,
                SingleItemRecoveryEnabled

    Replace the example address with each recipient's actual mailbox address.

    These properties do not reveal every applicable compliance setting. Also review Purview retention policies, eDiscovery case holds, and relevant audit records.

    If a hold is discovered, any removal action should be coordinated with the organization's Compliance or Legal team before attempting to release or modify the hold settings to determine whether the content must be preserved. You can remove accessible copies where authorized, but preserved copies may remain subject to retention requirements.

    3.Determine whether the attachment was a standard file attachment or a OneDrive/SharePoint cloud attachment

    Inspect the original message through eDiscovery or an export of the message, including its attachment metadata and MIME content where necessary.

    -Standard attachment: The Excel file is embedded directly within the email.

    -Cloud attachment: The email contains a OneDrive or SharePoint sharing link instead of the actual file.

    If the message contains URLs that reference SharePoint Online or OneDrive, it is likely a cloud attachment rather than a physical file attached to the message.
    4.If the attachment is a OneDrive/SharePoint cloud file

    If the attachment is a cloud file, deleting the email does not necessarily delete the original file.

    -Identify the document URL, storage location, and owner.

    -Locate and verify the file in OneDrive or SharePoint.

    -Review and revoke unauthorized sharing links or permissions, where appropriate.

    -If authorized, delete the file from its original location.

    -Review the recycle bin, version history, and applicable retention or preservation settings.

    Please note that retention policies, retention labels, and eDiscovery holds may preserve the file even after it has been deleted from its original location. Whether deletion is prevented or the content remains preserved depends on the applicable configuration.

    You can read more at Manage hold policies for eDiscovery cases | Microsoft Learn
    5.Verify whether the deletion was successful or blocked by compliance controls

    After remediation:

    -Rerun the Purview search to check whether matching messages remain in the searched locations.

    -Review the purge operation's status and results, if a purge was performed.

    -Check the applicable retention policies, retention labels, Litigation Hold, and eDiscovery holds.

    -For cloud files, verify that the file is no longer accessible at its original location and that unauthorized sharing links no longer work.

    -Review relevant audit records and any remaining preserved copies.

    A successful purge or deletion does not necessarily mean all copies have been permanently removed. Depending on the organization's compliance configuration, content may remain preserved in locations such as Recoverable Items, Preservation Hold storage, recycle bins, or other compliance repositories until retention requirements are satisfied.

    I hope this helps.

    Was this answer helpful?

  2. AI answer

    2026-10-26T10:29:27.8733333+00:00

    Use a narrowly scoped Purview eDiscovery search across the sender’s and known recipients’ mailboxes, export the location report, classify the attachment, and then remediate the Exchange message and any linked SharePoint/OneDrive file as separate objects.

    1. Identify every mailbox copy

    First run Exchange admin center → Mail flow → Message trace for October 20, 2026, using the sender’s SMTP address and the known recipients. The enhanced report provides recipient delivery status, message ID, network message ID, subject, and message size. The network message ID persists across copies created by message bifurcation or distribution-group expansion.^1^

    Then create a search in Microsoft Purview portal → Solutions → eDiscovery → Cases:

    1. Add only Peter’s mailbox and the three known recipient mailboxes initially.
    2. Use actual SMTP/UPN addresses—not display names—and a UTC range covering the approximate 6:00 PM send time.
    3. Use a query such as:
    kind:email
AND from:[Email]
AND subject:"Party Invitation"
AND attachmentnames:"Party Invitation for all*"
AND sent>=2026-10-20 AND sent<=2026-10-21

    From, Subject, Sent, AttachmentNames, and HasAttachment are supported searchable properties. Full UPNs are preferable because aliases can produce incomplete results.^2^

    1. Review samples, then export a report-only result. Use:
      • Items report to inspect each item and its folder/path.
      • Location report to identify every matching mailbox and count.^3^
    2. Expand the search only if message trace, forwards, audit evidence, or search results identify additional mailboxes.

    This search finds mailbox copies, including copies moved into ordinary folders or Recoverable Items. It does not prove that every delivered recipient retained a live copy.

    2. Determine whether it was a file attachment or cloud attachment

    An attached copy is embedded in each email. A cloud attachment is a link to a live file stored in SharePoint or OneDrive.^4^

    In the eDiscovery collection/export workflow:

    1. Enable Access links (cloud attachments) in messages.
    2. Collect or export the matching original email—not only a reply or forward.
    3. Review items.csv:
      • Filter Is modern attachment = True.
      • Use GroupID to associate the file with its parent email.
      • Inspect the source/location metadata to identify its OneDrive or SharePoint site.

    A normal attached copy is not a cloud attachment; an Outlook cloud-attachment control or a URL to a SharePoint/OneDrive file is treated as one.^5^

    Cloud-attachment extraction has limitations: plain-text and encrypted messages, malformed or stale links, and links appearing only in quoted reply/forward content might not be extracted. In those cases, inspect the original message and search the suspected SharePoint/OneDrive locations separately.^4^

    3. Remove the Exchange mailbox copies

    Required permissions include Compliance Search/eDiscovery Manager for searching and Search And Purge in Purview for deletion. Exchange Online PowerShell 3.9.0 or later is required, and the session must use EnableSearchOnlySession.^6^

    Create and validate a narrowly scoped PowerShell search:

    Connect-IPPSSession -EnableSearchOnlySession

$locations = @(
 "[Email]",
 "[Email]",
 "[Email]",
 "[Email]"
)
$query = '(kind:email) AND (from:[Email]) AND ' +
         '(subject:"Party Invitation") AND ' +
         '(sent>=2026-10-20 AND sent<=2026-10-21)'

New-ComplianceSearch -Name "Sensitive-PartyInvitation" `
  -ExchangeLocation $locations -ContentMatchQuery $query
Start-ComplianceSearch -Identity "Sensitive-PartyInvitation"
Get-ComplianceSearch -Identity "Sensitive-PartyInvitation"

    Wait for Status = Completed, compare the count with the reviewed/exported results, and preview again. If the search was originally created in the portal, rerun it with Start-ComplianceSearch and verify it through Get-ComplianceSearch before purging; otherwise, the PowerShell result can show ItemCount = 0.^6^

    For immediate containment, use soft delete:

    New-ComplianceSearchAction -SearchName "Sensitive-PartyInvitation" `
  -Purge -PurgeType SoftDelete

Get-ComplianceSearchAction -Identity "Sensitive-PartyInvitation_Purge"

    SoftDelete is containment, not permanent erasure. It removes the message from normal mailbox view but moves it to Recoverable Items, where users or administrators might recover it depending on deleted-item retention, Single Item Recovery, and holds. HardDelete is irreversible, but held content is still preserved. PowerShell processes at most 10 matching items per mailbox per purge action; that should not affect one original message but can matter for duplicates or forwarded copies.^6^

    4. Check retention labels and holds

    Users do not place messages into an eDiscovery or Litigation Hold themselves; administrators configure those holds. Users can, however, apply a retention label to an item.

    For each affected mailbox, run Exchange Online PowerShell:

    Get-Mailbox [Email] |
  Format-List LitigationHoldEnabled,InPlaceHolds,
    ComplianceTagHoldApplied,SingleItemRecoveryEnabled,
    DelayHoldApplied,DelayReleaseHoldApplied

Get-OrganizationConfig | Format-List InPlaceHolds

    Check every recipient and sender mailbox. UniH identifies an eDiscovery case hold, mbx a mailbox retention policy, and cld a cloud-attachment hold.^7^

    ComplianceTagHoldApplied=True is only a mailbox-level historical indicator; it does not prove this email has a label. Where licensing, permissions, indexing, and exposed metadata permit, go to Purview → Solutions → Data Lifecycle Management → Overview → View details → Content Explorer, locate the matching mailbox item, and inspect its retention-label metadata. Also inspect label information in the eDiscovery item/export metadata when available.^8^

    Do not remove a legal or compliance hold merely to complete this cleanup without records-management/legal approval. If a hold remains, an ordinary HardDelete deliberately leaves the item preserved in Recoverable Items.^9^

    For authorized permanent removal of held Exchange content, use the separate Exchange Priority Cleanup compliance workflow. The available material confirms this as the supported hold-override path but does not provide the complete Exchange-specific configuration procedure, so it should be performed from your tenant’s Data Lifecycle Management → Priority cleanup workflow under the required legal approvals rather than approximated with ad-hoc hold removal.

    5. Delete a linked SharePoint/OneDrive file

    A mailbox purge does not delete the linked file. Delete the source file separately after recording its URL, owner, sharing permissions, and required evidence.

    If retention or an eDiscovery hold blocks file deletion, use Purview → Solutions → Data Lifecycle Management → Priority cleanup. Priority Cleanup supports targeted SharePoint/OneDrive deletion with simulation, multiple approvals, and auditing.^10^

    If Delete data permanently is available in the tenant, it is a public-preview capability rolling out from August 24, 2026. It requires the Priority Cleanup Admin role, auditing enabled at least one day beforehand, simulation, approvers, and a second administrator to turn on the policy. The audit event PriorityCleanupFileDeleted confirms permanent deletion.^11^

    Priority Cleanup cannot remove a copy already collected into an eDiscovery review set; that copy remains until the case is deleted. It also cannot override record or regulatory-record restrictions.^10^

    6. Verify the final state

    1. Confirm Get-ComplianceSearchAction reports the purge action as completed.
    2. Rerun the same search and export a report:
      • No live-folder result means removal from normal user view succeeded.
      • A path under Recoverable Items means a recoverable or preserved copy remains.
    3. Rerun the hold checks. A completed purge action alone does not prove permanent deletion.
    4. Search Purview → Audit for:
      • eDiscovery search and purge activities.^12^
      • SoftDelete/HardDelete mailbox events.
      • PriorityCleanupFileDeleted or the applicable Priority Cleanup event for the file.
    5. Record the search query, UTC interval, location report, item paths, attachment type, hold results, purge-action status, and audit records as the incident evidence package.

    References

    1. Message trace in the Exchange admin center in Exchange Online
    2. Finding content in mailboxes in eDiscovery
    3. Export reference for eDiscovery
    4. Cloud attachments in eDiscovery
    5. Can't retain cloud attachments
    6. Find and delete email messages in eDiscovery
    7. Manage holds in eDiscovery
    8. Learn about retention policies and retention labels
    9. Delete items in the Recoverable Items folder for mailboxes on hold in eDiscovery
    10. Override holds to clean up files for Copilot and reclaim storage
    11. Permanently delete files with Microsoft Purview Priority Cleanup
    12. Search for eDiscovery activities in the audit log
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.