Trace a lost email in Exchange Online with PowerShell

"I never received that email" is one of the most common tickets in Microsoft 365. Message trace answers it in a few minutes.

Find the message

Get-MessageTraceV2 searches up to 90 days of history, with a maximum of 10 days per query:

Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

Get-MessageTraceV2 -RecipientAddress user@contoso.com `
    -SenderAddress partner@fabrikam.com `
    -StartDate (Get-Date).AddDays(-2) -EndDate (Get-Date) |
    Format-Table Received, SenderAddress, Subject, Status, MessageTraceId -AutoSize

Get-MessageTraceV2 replaces the older Get-MessageTrace cmdlet, which Microsoft has deprecated. Scripts that still use the old cmdlet should be updated.

See every step for one message

Take the MessageTraceId from the previous result:

Get-MessageTraceDetailV2 -MessageTraceId 2f8c5e1a-0000-0000-0000-000000000000 `
    -RecipientAddress user@contoso.com |
    Format-Table Date, Event, Action, Detail -Wrap

The Event column tells the story: Receive, Spam filter verdict, Transport rule, Deliver, Fail, and so on.

Large or older searches

For a long period or a large report, start a historical search instead. The CSV report is delivered by email:

Start-HistoricalSearch -ReportTitle "Fabrikam invoices" -ReportType MessageTrace `
    -SenderAddress partner@fabrikam.com `
    -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) `
    -NotifyAddress admin@contoso.com

In hybrid

If the message passed through your on-premises servers, continue the investigation there with Get-MessageTrackingLog:

Get-TransportService | Get-MessageTrackingLog -Recipients user@contoso.com -Start (Get-Date).AddDays(-2) |
    Format-Table Timestamp, EventId, Source, ServerHostname -AutoSize