Forum Discussion
Purging Malicious Emails via O 365 Security and Compliance
Hello Guys. When I purge malicious emails from user inbox via office 365 security and compliance, the users are still able to see them in their inbox. This is something that I am really grappling with.
Has someone come across this issue? Any help on how to successfully purged emails from user inboxes?
Thanks
Tatah
4 Replies
- Tatabime first check if the mailbox hasn't reached it's full mailboxsize Get-MailboxFolderStatistics <useremailaddress> -FolderScope RecoverableItems | FL Name,FolderAndSubfolderSize,ItemsInFolderAndSubfolders.
It can happen that the purged or recoverable has already reached 100GB even though you might notice that the inbox is lower. If that is the case you may need to recreate a new mailbox and depending if the mailbox is running from a hybrid or directly on the cloud. We aren't talking about https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/manage-quarantined-messages-and-files, emails in the quarantine are yet to be delivered and will be deleted automatically after the time has elapsed, 30 days by default?
If you are deleting malicious emails you can use a Content Search with PowerShell if that's the process you are following:
"The final step is to run the New-ComplianceSearchAction cmdlet to delete the message. You can soft- or hard-delete the message. A soft-deleted message is moved to a user's Recoverable Items folder and retained until the deleted item retention period expires. Hard-deleted messages are marked for permanent removal from the mailbox and will be permanently removed the next time the mailbox is processed by the Managed Folder Assistant."
https://docs.microsoft.com/en-gb/microsoft-365/compliance/search-for-and-delete-messages-in-your-organization
https://www.geekshangout.com/office-365-deleting-email-mailboxes-using-content-search-feature/
It easier with Office 365 E5 or ATP Plan 2 add-on, as this is in the interface without needing PowerShell - https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/investigate-malicious-email-that-was-delivered#find-and-delete-suspicious-email-that-was-delivered.
- What if I use the GUI to delete malicious messages? That is the method I use but it does not seem to work.
Tatabime Without knowing more on exactly what process you are following (the previous links I posted show how this should work), I'd suggest opening a ticket with Office 365 support if it's not working the way you are expecting, would be the next step I'd do.
