Commands › Exchange Online

New-ComplianceSecurityFilter

Exchange Online ExchangeOnlineManagement New-*

This cmdlet is functional only in Security & Compliance PowerShell. For more information, see Security & Compliance PowerShell. Use the New-ComplianceSecurityFilter cmdlet to create compliance security filters in the Microsoft Purview compliance portal. These filters allow specified users to search only a subset of mailboxes and SharePoint or OneDrive sites in your Microsoft 365 organization.

Quick start script

# New-ComplianceSecurityFilter — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-ComplianceSecurityFilter
$before | Format-List

# 3. Make the change (dry run first)
New-ComplianceSecurityFilter -Action <ComplianceSecurityFilterActionType> -FilterName <String> -Users <MultiValuedProperty> -WhatIf
New-ComplianceSecurityFilter -Action <ComplianceSecurityFilterActionType> -FilterName <String> -Users <MultiValuedProperty>

# 4. Verify and diff
$after = Get-ComplianceSecurityFilter
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

New-ComplianceSecurityFilter -Action <ComplianceSecurityFilterActionType> -FilterName <String> -Users <MultiValuedProperty>
 [-Confirm]
 [-Description <String>]
 [-Filters <MultiValuedProperty>]
 [-Region <String>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (8)

Parameter	Type	Required	What it controls
-Action	ComplianceSecurityFilterActionType	yes	The Action parameter specifies that type of search action that the filter is applied to. Valid values are:
-FilterName	String	yes	The FilterName parameter specifies the name for the compliance security filter. If the value contains spaces, enclose the value in quotation marks (").
-Users	MultiValuedProperty	yes	The Users parameter specifies the user who gets this filter applied to their searches. Valid values are:
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-Description	String		The Description parameter specifies a description for the compliance security filter. The maximum length is 256 characters. If the value contains spaces, enclose the value in quotation marks (").
-Filters	MultiValuedProperty		The Filters parameter specifies the search criteria for the compliance security filter. The filters are applied to the users specified by the Users parameter. You can create three different types of filters:
-Region	String		The Region parameter specifies the satellite location for multi-geo tenants to conduct eDiscovery searches in. Valid values are:
-WhatIf	SwitchParameter		The WhatIf switch doesn't work in Security & Compliance PowerShell.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.