Office 365 - Microsoft purview E-Discovery search and deletion query.

Use a narrowly scoped Purview eDiscovery search across the sender’s and known recipients’ mailboxes, export the location report, classify the attachment, and then remediate the Exchange message and any linked SharePoint/OneDrive file as separate objects.

1. Identify every mailbox copy

First run Exchange admin center → Mail flow → Message trace for October 20, 2026, using the sender’s SMTP address and the known recipients. The enhanced report provides recipient delivery status, message ID, network message ID, subject, and message size. The network message ID persists across copies created by message bifurcation or distribution-group expansion.^1^

Then create a search in Microsoft Purview portal → Solutions → eDiscovery → Cases:

1. Add only Peter’s mailbox and the three known recipient mailboxes initially.
2. Use actual SMTP/UPN addresses—not display names—and a UTC range covering the approximate 6:00 PM send time.
3. Use a query such as:

kind:email
AND from:[Email]
AND subject:"Party Invitation"
AND attachmentnames:"Party Invitation for all*"
AND sent>=2026-10-20 AND sent<=2026-10-21

From, Subject, Sent, AttachmentNames, and HasAttachment are supported searchable properties. Full UPNs are preferable because aliases can produce incomplete results.^2^

4. Review samples, then export a report-only result. Use:
   • Items report to inspect each item and its folder/path.
   • Location report to identify every matching mailbox and count.^3^
5. Expand the search only if message trace, forwards, audit evidence, or search results identify additional mailboxes.

This search finds mailbox copies, including copies moved into ordinary folders or Recoverable Items. It does not prove that every delivered recipient retained a live copy.

2. Determine whether it was a file attachment or cloud attachment

An attached copy is embedded in each email. A cloud attachment is a link to a live file stored in SharePoint or OneDrive.^4^

In the eDiscovery collection/export workflow:

1. Enable Access links (cloud attachments) in messages.
2. Collect or export the matching original email—not only a reply or forward.
3. Review items.csv:
   • Filter Is modern attachment = True.
   • Use GroupID to associate the file with its parent email.
   • Inspect the source/location metadata to identify its OneDrive or SharePoint site.

A normal attached copy is not a cloud attachment; an Outlook cloud-attachment control or a URL to a SharePoint/OneDrive file is treated as one.^5^

Cloud-attachment extraction has limitations: plain-text and encrypted messages, malformed or stale links, and links appearing only in quoted reply/forward content might not be extracted. In those cases, inspect the original message and search the suspected SharePoint/OneDrive locations separately.^4^

3. Remove the Exchange mailbox copies

Required permissions include Compliance Search/eDiscovery Manager for searching and Search And Purge in Purview for deletion. Exchange Online PowerShell 3.9.0 or later is required, and the session must use EnableSearchOnlySession.^6^

Create and validate a narrowly scoped PowerShell search:

Connect-IPPSSession -EnableSearchOnlySession

$locations = @(
 "[Email]",
 "[Email]",
 "[Email]",
 "[Email]"
)
$query = '(kind:email) AND (from:[Email]) AND ' +
         '(subject:"Party Invitation") AND ' +
         '(sent>=2026-10-20 AND sent<=2026-10-21)'

New-ComplianceSearch -Name "Sensitive-PartyInvitation" `
  -ExchangeLocation $locations -ContentMatchQuery $query
Start-ComplianceSearch -Identity "Sensitive-PartyInvitation"
Get-ComplianceSearch -Identity "Sensitive-PartyInvitation"

Wait for Status = Completed, compare the count with the reviewed/exported results, and preview again. If the search was originally created in the portal, rerun it with Start-ComplianceSearch and verify it through Get-ComplianceSearch before purging; otherwise, the PowerShell result can show ItemCount = 0.^6^

For immediate containment, use soft delete:

New-ComplianceSearchAction -SearchName "Sensitive-PartyInvitation" `
  -Purge -PurgeType SoftDelete

Get-ComplianceSearchAction -Identity "Sensitive-PartyInvitation_Purge"

SoftDelete is containment, not permanent erasure. It removes the message from normal mailbox view but moves it to Recoverable Items, where users or administrators might recover it depending on deleted-item retention, Single Item Recovery, and holds. HardDelete is irreversible, but held content is still preserved. PowerShell processes at most 10 matching items per mailbox per purge action; that should not affect one original message but can matter for duplicates or forwarded copies.^6^

4. Check retention labels and holds

Users do not place messages into an eDiscovery or Litigation Hold themselves; administrators configure those holds. Users can, however, apply a retention label to an item.

For each affected mailbox, run Exchange Online PowerShell:

Get-Mailbox [Email] |
  Format-List LitigationHoldEnabled,InPlaceHolds,
    ComplianceTagHoldApplied,SingleItemRecoveryEnabled,
    DelayHoldApplied,DelayReleaseHoldApplied

Get-OrganizationConfig | Format-List InPlaceHolds

Check every recipient and sender mailbox. UniH identifies an eDiscovery case hold, mbx a mailbox retention policy, and cld a cloud-attachment hold.^7^

ComplianceTagHoldApplied=True is only a mailbox-level historical indicator; it does not prove this email has a label. Where licensing, permissions, indexing, and exposed metadata permit, go to Purview → Solutions → Data Lifecycle Management → Overview → View details → Content Explorer, locate the matching mailbox item, and inspect its retention-label metadata. Also inspect label information in the eDiscovery item/export metadata when available.^8^

Do not remove a legal or compliance hold merely to complete this cleanup without records-management/legal approval. If a hold remains, an ordinary HardDelete deliberately leaves the item preserved in Recoverable Items.^9^

For authorized permanent removal of held Exchange content, use the separate Exchange Priority Cleanup compliance workflow. The available material confirms this as the supported hold-override path but does not provide the complete Exchange-specific configuration procedure, so it should be performed from your tenant’s Data Lifecycle Management → Priority cleanup workflow under the required legal approvals rather than approximated with ad-hoc hold removal.

5. Delete a linked SharePoint/OneDrive file

A mailbox purge does not delete the linked file. Delete the source file separately after recording its URL, owner, sharing permissions, and required evidence.

If retention or an eDiscovery hold blocks file deletion, use Purview → Solutions → Data Lifecycle Management → Priority cleanup. Priority Cleanup supports targeted SharePoint/OneDrive deletion with simulation, multiple approvals, and auditing.^10^

If Delete data permanently is available in the tenant, it is a public-preview capability rolling out from August 24, 2026. It requires the Priority Cleanup Admin role, auditing enabled at least one day beforehand, simulation, approvers, and a second administrator to turn on the policy. The audit event PriorityCleanupFileDeleted confirms permanent deletion.^11^

Priority Cleanup cannot remove a copy already collected into an eDiscovery review set; that copy remains until the case is deleted. It also cannot override record or regulatory-record restrictions.^10^

6. Verify the final state

1. Confirm Get-ComplianceSearchAction reports the purge action as completed.
2. Rerun the same search and export a report:
   • No live-folder result means removal from normal user view succeeded.
   • A path under Recoverable Items means a recoverable or preserved copy remains.
3. Rerun the hold checks. A completed purge action alone does not prove permanent deletion.
4. Search Purview → Audit for:
   • eDiscovery search and purge activities.^12^
   • SoftDelete/HardDelete mailbox events.
   • PriorityCleanupFileDeleted or the applicable Priority Cleanup event for the file.
5. Record the search query, UTC interval, location report, item paths, attachment type, hold results, purge-action status, and audit records as the incident evidence package.

References

1. Message trace in the Exchange admin center in Exchange Online
2. Finding content in mailboxes in eDiscovery
3. Export reference for eDiscovery
4. Cloud attachments in eDiscovery
5. Can't retain cloud attachments
6. Find and delete email messages in eDiscovery
7. Manage holds in eDiscovery
8. Learn about retention policies and retention labels
9. Delete items in the Recoverable Items folder for mailboxes on hold in eDiscovery
10. Override holds to clean up files for Copilot and reclaim storage
11. Permanently delete files with Microsoft Purview Priority Cleanup
12. Search for eDiscovery activities in the audit log