365-command-logoThe “Tech Tip of the Week” is about performing mail retrievals within Office 365.

Mail Retrievals within Office 365

Take Free Trial of 365 CommandDesigned to Quickly Enable You to Manage Microsoft Office 365 Online Services Better: You will Save time & money with advanced Office 365 management tools, analytics, reports, security insights & more.

 

Utilization of the Discovery Search Mailbox to perform Mail Retrievals within Office 365:

I learned a few things today while trying to do a mail retrieval in Office 365 and I wanted to share. Below are the instructions to retrieve mail that had been previously deleted from a user’s mailbox and put it into a custom folder within the Discovery Search Mailbox.

First, you will need to make sure that your account is setup to perform mailbox searches within your environment.  This is done slightly differently depending on if you are on Wave 15 (Exchange 2013 back-end) or Wave 14 (Exchange 2010 back-end) for Office 365:

Wave 15 Instructions:

  • Make sure that you are using an account with Global Administrator rights and browse to:  http://portal.microsoftonline.com.
  • Upon logging in, go to the Admin menu toward the upper-right and choose “Exchange” from the drop-down list.
  • Then, click on the permissions link on the left-side.
  • Select admin roles and locate a group named Discovery Management.
  • Double-click or highlight the group and select the pencil icon (Edit) and a pop-up window will appear.
  • Towards the bottom of this window is a Members section where users can be added in order to grant them this ability.

Wave 14 Instructions:

  • Make sure that you are using an account with Global Administrator rights and browse to:  http://portal.microsoftonline.com.
  • Click Manage underneath Exchange on the main login screen/dashboard.
  • Click Roles & Auditing on the left and locate a group named Discovery Management.
  • Double-click the group and a pop-up window will appear.
  • Towards the bottom of this window is a Members section where users can be added in order to grant them this ability.

After you have been added to the “Discovery Management” group you will need to open up Powershell and connect to your environment.

Once connected you will need to add the Discovery Search Mailbox to your account so that when you complete the scan the results are viewable within Outlook. To do this run the following command:

Add-MailboxPermission -Identity ‘Discovery Search Mailbox’ -User ‘username’ -AccessRights FullAccess -Inheritance All

Now there are multiple ways to create search scripts that cater to your needs. In the example below the user required a script that pulled back deleted emails from a single mailbox for a specific date range:

Search-Mailbox ‘mailbox name’ -SearchDumpsterOnly -SearchQuery ‘Received:(01/01/13..12/31/13)’ -TargetMailbox “Discovery Search Mailbox” -TargetFolder ‘folder name’ -LogLevel Full

A couple things to take note of in that script is the –SearchDumpsterOnly parameter which will only pull mail items that have been deleted. Also the –Search Query portion is very customizable and doesn’t need to be just a date range. Below are some other ways of using it:

Property
Example
Search results
Attachments
attachment:annualreport.ppt
Messages that have an attachment that is named annualreport.ppt. The use of attachment:annualreport or attachment:annual* returns the same results as using the full name of the attachment.
Cc
cc:”gurinder singh”
cc:gurinders
Messages with Gurinder Singh in the Cc field
From
from:”Max Stevens”
from:maxs
from:maxs@contoso.com
Messages sent by Max Stevens
Sent
sent:10/19/2010
Messages that were sent on October 19, 2010
Subject
subject:”Quarterly Financials”
Messages that contain the exact phrase “Quarterly Financials” in the subject line
To
to:”Ann Beebe”
to:annb
to:annb@domain.com
Messages sent to Ann Beebe

Finally –TargetFolder is the folder name you can choose where your results will be populated within the Discovery Search Mailbox. Once you run your script it will run the search in real time and once completed you can find the Discovery Search Mailbox you added through Powershell earlier in your Outlook. Inside you will find the custom folder you created and the results of your search.

Rob, thank you again for this great contribution towards the Tech Tip of the Week!!

Here is a review of previous Tech Tips of the Week:

Shared Mailboxes Part I -What to do if you want or need to convert a full (user) Office 365 mailbox into a Shared Mailbox.

Shared Mailboxes Part II – How do you create a shared mailbox from scratch and then add permissions to them?  

Mailbox Archiving

Office 365 Calendar Invites and Meeting Requests