Forum Discussion

dmk199's avatar
dmk199
Copper Contributor
Jan 11, 2023

MSFT 365 Defender - Email & Collaboration email preview not working

Just curious, why the email preview under Email & Collaboration (explorer) is not working any more (All emails) 

 

It says "Message details couldn't be found. When a message is soft deleted or hard deleted by the user or the admin, its details no longer exist in the mailbox or server"

 

Is there a setting or permission that changed, as a note doing all this activity as a global admin.

 

incident management
investigation
microsoft defender for office 365

6 Replies

  • vknsm's avatar
    vknsm
    Copper Contributor
    Jun 25, 2024
    Hello, maybe you have any new about this issue? We still can't preview or download emails from Explorer
    • snewman2210's avatar
      snewman2210
      Copper Contributor
      Sep 28, 2024

      vknsm I don't have any insight into lack of preview due to the message being deleted, but if you see an error message when you mouse over the preview link that indicates you need a role permission, this is where you can make that role change: 

      Defender >System > Permissions > Email & Collaboration Roles  > Data Investigator

       

      https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about

  • NCJC122's avatar
    NCJC122
    Copper Contributor
    Jan 13, 2023

    dmk199 

     

    Also seeing this in the last few days. Global admin with Purview permissions too.

     

    The difference is that this tends to happen on emails that are being investigated for phishing so that we can determine if the email is actually a phishing email or the user is being overzealous with the reporting phishing button.

     

    Makes it difficult to investigate if a soft deletion stops it from being previewed. Maybe it's always been like this but it's only in the last few days that it's becoming increasingly noticeable. 

     

    Also note that "Download email" fails on this too. Nothing happens.

    • CodyDavid's avatar
      CodyDavid
      Copper Contributor
      Oct 19, 2023
      same problem
      its not convenient
      hope they can fix it soon
    • jvalente's avatar
      jvalente
      Copper Contributor
      Sep 29, 2023

      NCJC122This issue is still ongoing and it's extremely frustrating since it means everything can't be completed within the portal& using the builtin investigation & response cooling.  A workaround, to at least view the messages, I've got it so to set up email reports to also go to one of our mailboxes. If the message is missing, we can at least find it by going through that mailbox.   

       

      This is also extra frustrating because if you're in the user reported messages tab of Submissions, you can't mark the message appropriately.   and yeah as you note, it really means you (or more likely the user who reported it) can't soft delete until AFTER the investigation is done.  It doesn't help that Microsoft itself seems to have set up the report button to the delete message when the user reports it.

Resources