Deleting malicious emails from all O365 mailboxes

[jstump1972]

Please assist me with a exch ps o365 script to remove email from all o365 mailboxes by subject line or sender email address. I cannot seem to find the right command to do in cloud. 

[#2]

@jstump1972 

"By default, Search-Mailbox is available only in the Mailbox Search or Mailbox Import Export roles, and these roles aren't assigned to *any* role groups. To use this cmdlet, you need to add one or both of the roles to a role group (for example, the Organization Management role group). Only the Mailbox Import Export role gives you access to the DeleteContent parameter."

https://docs.microsoft.com/en-us/powershell/module/exchange/search-mailbox?view=exchange-ps

[#3]

Just to add the eDiscovery method as well, as Search-Mailbox might disappear at any time now: https://docs.microsoft.com/en-us/microsoft-365/compliance/search-for-and-delete-messages-in-your-org...

[#4]

example below - 

PS C:\get-mailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox | Search-Mailbox -SearchQuery 'subject:"JOB REFERRAL" -DeleteContent -force

'Search-Mailbox : The term 'Search-Mailbox' is not recognized as the name of a cmdlet, function, script file, oroperable program. Check the spelling of the name, or if a path was included, verify that the path is correct and tryagain.At line:1 char:71+ ... Unlimited -RecipientTypeDetails UserMailbox | Search-Mailbox -Search ...+ ~~~~~~~~~~~~~~+ CategoryInfo : ObjectNotFound: (Search-Mailbox:String) [], CommandNotFoundException+ FullyQualifiedErrorId : CommandNotFoundException@stevemorgan

@stevemorgan 

[#5]

@jstump1972 

How are you connecting to Exchange Online? I just connected via V2 Module and it ran. Do you have the appropriate roles assigned? Did you reconnect after assigning to reload the appropriate cmdlets?

[#6]

i am connecting using the microsoft exchange online powershell module and i am a global admin in our tenant

@stevemorgan 

[#7]

There are some Exchange permissions that are required to remove the emails.

[#8]

@jstump1972 

Like I quoted earlier, you'll need to assign yourself the appropriate roles in Exchange Online. These aren't assigned by default to anyone; even when you're a Global Admin or part of Organizational Management in EXO. Have you assigned those roles and established a new connection to Exchange Online?

In EXO ECP you can navigate to Permissions > admin roles > click the + to add a new role:
Give it name/description

Add the two roles mentioned in the first Doc I shared

Assign members (yourself) and save. 

Give it a few minutes, reestablish a powershell connection to EXO and try again. 

[#9]

@jstump1972 

To use the process @Vasil Michev mentioned earlier with this doc:

https://docs.microsoft.com/en-us/microsoft-365/compliance/search-for-and-delete-messages-in-your-org...

You'll need to open Admin Center > Scroll down on the left pane and choose the Security admin center (or go to https://protection.microsoft.com) 

From there, you'll need to click on permissions and then assign the permissions mentioned in the doc he provided. 

After that you can follow the steps using that method. As mentioned Search-Mailbox is end-of-life soon:

"WARNING: WARNING: On July 1, 2020, the Search-Mailbox cmdlet is being retired and Microsoft Support will no longer provide assistance. See https://go.microsoft.com/fwlink/?linkid=2113221 to learn more.
WARNING: The Search-Mailbox cmdlet returns up to 10000 results per mailbox if a search query is specified. To return more than 10000 results, use the New-MailboxSearch cmdlet or the In-Place eDiscovery & Hold console in the Exchange Administration Center."

[#10]

I have fixed the permissions, i did a simple search for a test email i sent from external to internal and came back with 0 results. @stevemorgan