Exchange message trace by alias

[StevenAtRavn]

In Exchange 365, when searching for an email sent to a recipient using message trace, the suggested results will give only the primary email address. The subsequent search will then only show emails sent to the primary address, not any of the user's aliases. Even if you attempt to set an alias as the recipient, the suggested result will only give the user's primary address and the resultant search will not show any email sent to any other address.

I have found a workaround by temporarily altering the primary address of the user and returning it after the search has been done.

Unless I am completely missing how to do this, I'd like to be able to search for an email based on the actual recipient address, no matter if it is an alias or the primary. Alternately, show the results of all addresses, primary and alias, when searching a user's mailbox.

[#2]

@StevenAtRavn 

I have this same issue, and now that Classic message trace is pretty much gone in our tenants, this has become not only a practical issue, but a security issue.

I opened a ticket with Microsoft, and they are unable to resolve. The only option is a workaround to export all email within in the organization over a given time period, and look for aliases among all the other messages within the CSV. Besides being a huge pain to find emails to aliases, there is a security issue here in that it potentially exposes the admin to data irrelevant to the investigation at hand. If this is a HIPAA covered entity, for instance, and PII happens to be in the header/subject/etc in the CSV exported by message trace, this can lead to unauthorized PII exposure.

Classic message trace did not have this limitation. 

[#3 · Accepted solution]

@guitman423 

I was able to use the following in Powershell v7:

Install-Module -Name ExchangeOnlineManagement -RequiredVersion 2.0.5

Connect-ExchangeOnline

Get-MessageTrace -Sender email address removed for privacy reasons

Get-MessageTrace -Recipient email address removed for privacy reasons

This is confirmed to work with aliases

[#4]

Once again, powershell proves its worth. Thanks!