Complete Tutorial: How to Search and Delete Emails Across Microsoft 365 Using Microsoft Purview eDiscovery
- Hanna Korotka
- Oct 2
- 3 min read
In today’s fast-paced digital
environment, small and medium-sized businesses (SMBs) must be prepared to respond quickly to email-based threats, accidental data leaks, or compliance violations. One powerful tool available in Microsoft 365 is Microsoft Purview eDiscovery, which allows administrators to search and delete emails across Microsoft 365 environments.
This tutorial walks you through the process step-by-step, so you can act fast when security or compliance is at risk.
🔍 What Is Microsoft Purview eDiscovery?
Microsoft Purview eDiscovery is a compliance solution that enables organizations to identify, hold, search, and export content across Microsoft 365 services. It’s especially useful for legal investigations, data breaches, and removing malicious or inappropriate emails from user mailboxes.
🛠️ Step-by-Step Guide: Search and Delete Emails Across Microsoft 365 Using Microsoft Purview eDiscovery
Step 1: Assign Permissions
To perform a search and purge, you need two separate roles:
To create and run a Content Search: You must be a member of the eDiscovery Manager role group or assigned the Compliance Search role in the Microsoft Purview portal.
To delete messages: You must be a member of the Organization Management role group (in the Microsoft Purview portal, not Exchange Online) or assigned the Search And Purge role.
For information about adding users to a role group, see Assign eDiscovery permissions.
Step 2: Create a Content Search
Go to the Microsoft Purview compliance portal.
Navigate to eDiscovery under the Solutions section.
Select Content Search
Click New search and define your query:
Use keywords, sender/recipient addresses, or date ranges.
Filter by location (e.g., Exchange mailboxes).
Preview the results to confirm the emails you want to delete. This step is critical to avoid accidental data loss.
Step 3: Start the Search via PowerShell
Connect to Security & Compliance PowerShell for your organization. For step-by-step instructions, see Connect to Security & Compliance PowerShell.
Run following command:
Start-ComplianceSearch -Identity "Your Search Name"To check the status of the search run following:
Get-ComplianceSearch -Identity "Your Search Name" | Format-ListOnce the search completes, proceed with the next step.
Step 4: Delete Emails via PowerShell
To delete emails, connect to Security & Compliance PowerShell and run:
New-ComplianceSearchAction -SearchName "Your Search Name" -Purge -PurgeType HardDelete🧾What Happens to Deleted Emails?
When you delete messages using the New-ComplianceSearchAction -Purge -PurgeType HardDelete command, those emails are moved to a hidden folder called Purges. Users can’t access or recover these messages.
If single item recovery is enabled for the mailbox (which is the default in Microsoft 365), the deleted messages will stay in the Purges folder for the duration of the deleted item retention period. After that period ends, the messages are marked for permanent deletion and are removed from Microsoft 365 the next time the Managed Folder Assistant processes the mailbox.
This means the messages aren’t instantly erased from the system—but they are completely hidden from users and eventually purged from the service.
✅When Should SMBs Use This?
- Phishing attacks: Quickly remove malicious emails from all mailboxes.
- Accidental sends: Delete sensitive information mistakenly sent to the wrong recipients.
- Compliance violations: Remove non-compliant communications before they escalate.
🔐About PlexHosted LLC
At PlexHosted LLC, we specialize in helping SMBs enhance their security and compliance posture in Microsoft 365. From configuring Microsoft Purview to implementing advanced threat protection, data loss prevention, and secure collaboration tools, our team ensures your cloud environment is secure, compliant, and optimized for business continuity.
Need help setting up Microsoft Purview or responding to a security incident?
Contact PlexHosted today to learn how we can support your business.