MSFT 365 Defender - Email & Collaboration email preview not working

[dmk199]

Just curious, why the email preview under Email & Collaboration (explorer) is not working any more (All emails) 

It says "Message details couldn't be found. When a message is soft deleted or hard deleted by the user or the admin, its details no longer exist in the mailbox or server"

Is there a setting or permission that changed, as a note doing all this activity as a global admin.

[#2]

Hey there @dmk199 ! - thanks for reaching out.

There are two things which spring to mind here, firstly, you'll need to have the "Preview" role (permission) - detailed here: The Microsoft Defender for Office 365 email entity page - Office 365 | Microsoft Learn

Also, any messages delivered externally, such as to on premises, will not be able to be previewed, as they do not exist in your Exchange Online instance anymore.

Thanks

Ben.

[#3]

@dmk199 

Also seeing this in the last few days. Global admin with Purview permissions too.

The difference is that this tends to happen on emails that are being investigated for phishing so that we can determine if the email is actually a phishing email or the user is being overzealous with the reporting phishing button.

Makes it difficult to investigate if a soft deletion stops it from being previewed. Maybe it's always been like this but it's only in the last few days that it's becoming increasingly noticeable. 

Also note that "Download email" fails on this too. Nothing happens.

[#4]

@NCJC122This issue is still ongoing and it's extremely frustrating since it means everything can't be completed within the portal& using the builtin investigation & response cooling.  A workaround, to at least view the messages, I've got it so to set up email reports to also go to one of our mailboxes. If the message is missing, we can at least find it by going through that mailbox.   

This is also extra frustrating because if you're in the user reported messages tab of Submissions, you can't mark the message appropriately.   and yeah as you note, it really means you (or more likely the user who reported it) can't soft delete until AFTER the investigation is done.  It doesn't help that Microsoft itself seems to have set up the report button to the delete message when the user reports it.

[#5]

same problem
its not convenient
hope they can fix it soon