Email Hide and Go Seek: How to locate a specific email (down to the folder) in Office 365 using PowerShell

In many organizations, end users receive too much email to manage effectively. Many utilize rules to filter emails into specific buckets to make them easier to find. Over time, these rules compound, and could eventually lead to unintended consequences (i.e. receiving an email but being unable to find it).

When this happens, I’d typically run a quick message trace to establish whether the email was actually delivered or not. Many admins will stop there, advising the end-user to check their rule settings, but using PowerShell, we can find the email(s) for them!

First, let’s get logged into the Office 365 tenant:

$Credential = Get-Credential
$ExchangeSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "" -Credential $credential -Authentication "Basic" -AllowRedirection
Import-PSSession $ExchangeSession

Next, we can determine how many emails match the criteria in case there are more than one (Optional):

search-mailbox -EstimateResultOnly -identity [target user] -searchquery 'from:"[sender emai]" AND subject:"subject"'

Now for the coup de grâce, to reconstruct precisely which folder and sub-folder(s) of where the email(s) that match that criteria are in the user’s inbox:

search-mailbox -identity [recipient] -searchquery 'from:"[sender]" AND subject:"[subject] "' -targetmailbox "[your email] " -targetfolder "SearchResults"

In your inbox, you’ll see a folder called ‘SearchResults’. Using this, you can guide the end-user through the folder structure on their own Inbox that they’ll need to traverse to get to the desired email(s).

3 thoughts on “Email Hide and Go Seek: How to locate a specific email (down to the folder) in Office 365 using PowerShell”

  1. Search-Mailbox Has been deprecated. Compliance search doesn’t seem to give seem to give the same detailed information of which folder a given email is in. Is there another way?

  2. The Search-Mailbox command has since been depreciated. Other than 3rd party solutions or downloading a copy of a user’s .pst and doing a manual search, I haven’t found a way for an admin to locate the specific folder that a given email resides in. Is it possible using only MS tools anymore?

    1. One of the hazards of publishing technical guides is their inevitable obsolescence, and this [nearly] 4-year-old post is no exception. At the time, I managed several hundred O365 tenants for an MSP, but have moved on. As such, I no longer have access to any O365 tenants to experiment with.

      A google search seemed to indicate a lot of people are suffering from the same issue:

      My recommendation would be to open a support case with Microsoft and ask for guidance.

Leave a Reply

Your email address will not be published. Required fields are marked *