Commands › Exchange Online

Export-QuarantineMessage

Exchange Online ExchangeOnlineManagement Export-*

Export quarantined messages and files from your cloud-based organization. Messages are exported to .eml message files so you can open them in Outlook. For files that were quarantined by Safe Attachments for SharePoint, OneDrive, and Microsoft Teams, the files are exported in Base64 format.

Quick start script

# Export-QuarantineMessage — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Run and inspect
Export-QuarantineMessage -Identities <QuarantineMessageIdentity[]> | Format-List

# 3. Export for evidence / drift tracking
Export-QuarantineMessage | Export-Clixml .\QuarantineMessage-$(Get-Date -Format yyyyMMdd).xml

Syntax — 2 parameter sets

Identities

Export-QuarantineMessage -Identities <QuarantineMessageIdentity[]> [-Identity <QuarantineMessageIdentity>]
 [-CompressOutput]
 [-EntityType <Microsoft.Exchange.Management.FfoQuarantine.EntityType>]
 [-ForceConversionToMime]
 [-Password <SecureString>]
 [-PasswordV2 <String>]
 [-ReasonForExport <String>]
 [-RecipientAddress <String>]
 [<CommonParameters>]

IdentityOnly

Export-QuarantineMessage -Identity <QuarantineMessageIdentity>
 [-CompressOutput]
 [-EntityType <Microsoft.Exchange.Management.FfoQuarantine.EntityType>]
 [-ForceConversionToMime]
 [-Password <SecureString>]
 [-PasswordV2 <String>]
 [-ReasonForExport <String>]
 [-RecipientAddress <String>]
 [<CommonParameters>]

Parameters (9)

Parameter	Type	Required	What it controls
-Identities	QuarantineMessageIdentity[]	yes	The Identities parameter identifies quarantined messages for bulk operations. You identify the messages by using the syntax: `value1,value2...valueN`. Each value is a unique quarantined message identifier in the...
-Identity	QuarantineMessageIdentity		The Identity parameter specifies the quarantined message that you want to export. The value is a unique quarantined message identifier in the format `GUID1\GUID2` (for example...
-CompressOutput	SwitchParameter		The CompressOutput switch exports the message as a compressed .zip file. You don't need to specify a value with this switch.
-EntityType	EntityType		The EntityType parameter filters the results by EntityType. Valid values are:
-ForceConversionToMime	SwitchParameter		The ForceConversionToMime switch converts exported plain text messages to MIME formatting. You don't need to specify a value with this switch.
-Password	SecureString		The Password parameter specifies the password that's required to open the exported message.
-PasswordV2	String		The PasswordV2 parameter specifies the plain text value of the password that's required to open the exported message. Enclose the value in quotation marks (for example, `'<password>'`).
-ReasonForExport	String		The ReasonForExport parameter specifies why the message was exported. If the value contains spaces, enclose the value in quotation marks (").
-RecipientAddress	String[]		The RecipientAddress parameter filters the results by the recipient's email address. You can specify multiple values separated by commas.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.