Disappearing Emails

%3CLINGO-SUB%20id%3D%22lingo-sub-867454%22%20slang%3D%22en-US%22%3EDisappearing%20Emails%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-867454%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20a%20user%20who%20is%20reporting%20a%20particular%20error.%20She%20will%20see%20the%20notification%20of%20an%20email%20come%20in%20on%20her%20phone%20and%20then%20when%20she%20goes%20to%20outlook%20to%20view%20the%20email%2C%20the%20email%20isn't%20there.%20She%20doesn't%20have%20any%20rules%20set%2C%20it%20is%20is%20not%20in%20her%20junk%20folder.%26nbsp%3B%20We%20have%20checked%20OWA%20and%20the%20emails%20also%20aren't%20there.%20This%20is%20happening%20across%204%20different%20users%20from%204%20different%20domains%20(All%20external)%2C%20that%20she%20has%20had%20previous%20communication%20with.%20When%20I%20run%20message%20traces%20on%20these%20emails%20it%20shows%20these%20as%20delivered.%20I%20have%20run%20a%20security%20and%20compliance%20search%20and%20I%20am%20able%20to%20find%20the%20emails%20through%20that.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDoes%20anyone%20know%20what%20is%20going%20on%3F%26nbsp%3B%3CBR%20%2F%3ESecondly%2C%20Is%20there%20a%20way%20to%20get%20the%20security%20and%20compliance%20search%20to%20show%20the%20location%20of%20items%20returned%20by%20the%20search%3F%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%20in%20advance%20for%20any%20help%20provided.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-867454%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EHybrid%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-867616%22%20slang%3D%22en-US%22%3ERe%3A%20Disappearing%20Emails%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-867616%22%20slang%3D%22en-US%22%3E%3CP%3EIf%20the%20messages%20are%20being%20moved%20by%20any%20server-side%20rule%2C%20the%20message%20trace%20details%20(the%20ones%20you%20obtain%20via%20Get-MessageTraceDetail)%20will%20contain%20information%20about%20the%20folder%20the%20item%20was%20moved%20to.%20If%20it's%20a%20client-side%20rule%20or%20some%20other%20action%20(mobile%20app%3F)%2C%20you%20can%20check%20the%20mailbox%20audit%20logs.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20see%20which%20folder%20a%20given%20item%20is%20located%20when%20doing%20a%20Content%20Search%2FeDiscovery%2C%20export%20the%20report.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Visitor

I have a user who is reporting a particular error. She will see the notification of an email come in on her phone and then when she goes to outlook to view the email, the email isn't there. She doesn't have any rules set, it is is not in her junk folder.  We have checked OWA and the emails also aren't there. This is happening across 4 different users from 4 different domains (All external), that she has had previous communication with. When I run message traces on these emails it shows these as delivered. I have run a security and compliance search and I am able to find the emails through that. 

 

Does anyone know what is going on? 
Secondly, Is there a way to get the security and compliance search to show the location of items returned by the search? 

 

Thank you in advance for any help provided. 

1 Reply
Highlighted

If the messages are being moved by any server-side rule, the message trace details (the ones you obtain via Get-MessageTraceDetail) will contain information about the folder the item was moved to. If it's a client-side rule or some other action (mobile app?), you can check the mailbox audit logs.

 

To see which folder a given item is located when doing a Content Search/eDiscovery, export the report.