Commands › Exchange Online

Get-MailboxSearch

Exchange Online ExchangeOnlineManagement Get-*

View mailbox searches that are in progress, complete or stopped. **Note**: As of October 2020, the \*-MailboxSearch cmdlets are retired in Exchange Online PowerShell. Use the \*-ComplianceSearch cmdlets in Security & Compliance PowerShell instead. For more information, see Retirement of legacy eDiscovery tools.

Quick start script

# Get-MailboxSearch — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Run and inspect
Get-MailboxSearch -InPlaceHoldIdentity <String> | Format-List

# 3. Export for evidence / drift tracking
Get-MailboxSearch | Export-Clixml .\MailboxSearch-$(Get-Date -Format yyyyMMdd).xml

Syntax — 3 parameter sets

SearchObjectIdentity

Get-MailboxSearch [[-Identity] <SearchObjectIdParameter>]
 [-DomainController <Fqdn>]
 [-ResultSize <Unlimited>]
 [<CommonParameters>]

EwsStoreObjectIdentity

Get-MailboxSearch [[-Identity] <EwsStoreObjectIdParameter>]
 [-ShowDeletionInProgressSearches]
 [-DomainController <Fqdn>]
 [-ResultSize <Unlimited>]
 [<CommonParameters>]

InPlaceHoldIdentity

Get-MailboxSearch -InPlaceHoldIdentity <String>
 [-ShowDeletionInProgressSearches]
 [-DomainController <Fqdn>]
 [-ResultSize <Unlimited>]
 [<CommonParameters>]

Parameters (5)

Parameter	Type	Required	What it controls
-Identity	SearchObjectIdParameter		The Identity parameter specifies the name of the search query. If a name isn't provided, all mailbox search queries are returned.
-InPlaceHoldIdentity	String	yes	The InPlaceHoldIdentity parameter specifies the GUID of an In-Place Hold. Use this parameter to search for an In-Place Hold that a user is placed on. GUIDs of all In-Place Holds that a user is placed on are added to...
-DomainController	Fqdn		This parameter is available only in on-premises Exchange.
-ResultSize	Unlimited		The ResultSize parameter specifies the maximum number of results to return. If you want to return all requests that match the query, use unlimited for the value of this parameter. The default value is 1000.
-ShowDeletionInProgressSearches	SwitchParameter		This parameter is reserved for internal Microsoft use.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.