Forum Discussion
Deleting malicious emails from all O365 mailboxes
"By default, Search-Mailbox is available only in the Mailbox Search or Mailbox Import Export roles, and these roles aren't assigned to *any* role groups. To use this cmdlet, you need to add one or both of the roles to a role group (for example, the Organization Management role group). Only the Mailbox Import Export role gives you access to the DeleteContent parameter."
https://docs.microsoft.com/en-us/powershell/module/exchange/search-mailbox?view=exchange-ps
example below -
PS C:\get-mailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox | Search-Mailbox -SearchQuery 'subject:"JOB REFERRAL" -DeleteContent -force
'Search-Mailbox : The term 'Search-Mailbox' is not recognized as the name of a cmdlet, function, script file, oroperable program. Check the spelling of the name, or if a path was included, verify that the path is correct and tryagain.At line:1 char:71+ ... Unlimited -RecipientTypeDetails UserMailbox | Search-Mailbox -Search ...+ ~~~~~~~~~~~~~~+ CategoryInfo : ObjectNotFound: (Search-Mailbox:String) [], CommandNotFoundException+ FullyQualifiedErrorId : CommandNotFoundException@stevemorgan
How are you connecting to Exchange Online? I just connected via V2 Module and it ran. Do you have the appropriate roles assigned? Did you reconnect after assigning to reload the appropriate cmdlets?
i am connecting using the microsoft exchange online powershell module and i am a global admin in our tenant
To use the process VasilMichev mentioned earlier with this doc:
https://docs.microsoft.com/en-us/microsoft-365/compliance/search-for-and-delete-messages-in-your-organization?view=o365-worldwide
You'll need to open Admin Center > Scroll down on the left pane and choose the Security admin center (or go to https://protection.microsoft.com)
From there, you'll need to click on permissions and then assign the permissions mentioned in the doc he provided.
After that you can follow the steps using that method. As mentioned Search-Mailbox is end-of-life soon:
"WARNING: WARNING: On July 1, 2020, the Search-Mailbox cmdlet is being retired and Microsoft Support will no longer provide assistance. See https://go.microsoft.com/fwlink/?linkid=2113221 to learn more.
WARNING: The Search-Mailbox cmdlet returns up to 10000 results per mailbox if a search query is specified. To return more than 10000 results, use the New-MailboxSearch cmdlet or the In-Place eDiscovery & Hold console in the Exchange Administration Center."