Commands › Exchange Online

New-MailboxSearch

Exchange Online ExchangeOnlineManagement New-*

Create a mailbox search and either get an estimate of search results, place search results on In-Place Hold or copy them to a Discovery mailbox. You can also place all contents in a mailbox on hold by not specifying a search query, which accomplishes similar results as Litigation Hold. **Note**: As of October 2020, the \*-MailboxSearch cmdlets are retired in Exchange Online PowerShell. Use the \*-ComplianceSearch cmdlets in Security & Compliance PowerShell instead. For more information, see Retirement of legacy eDiscovery tools.

Quick start script

# New-MailboxSearch — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-MailboxSearch
$before | Format-List

# 3. Make the change (dry run first)
New-MailboxSearch -Name <String> -WhatIf
New-MailboxSearch -Name <String>

# 4. Verify and diff
$after = Get-MailboxSearch
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

New-MailboxSearch [-Name] <String>
 [-AllPublicFolderSources <Boolean>]
 [-AllSourceMailboxes <Boolean>]
 [-Confirm]
 [-Description <String>]
 [-DomainController <Fqdn>]
 [-DoNotIncludeArchive]
 [-EndDate <ExDateTime>]
 [-EstimateOnly]
 [-ExcludeDuplicateMessages <Boolean>]
 [-Force]
 [-IncludeKeywordStatistics]
 [-IncludeUnsearchableItems]
 [-InPlaceHoldEnabled <Boolean>]
 [-InPlaceHoldIdentity <String>]
 [-ItemHoldPeriod <Unlimited>]
 [-Language <CultureInfo>]
 [-LogLevel <LoggingLevel>]
 [-MessageTypes <KindKeyword[]>]
 [-Recipients <String[]>]
 [-SearchDumpster]
 [-SearchQuery <String>]
 [-Senders <String[]>]
 [-SourceMailboxes <RecipientIdParameter[]>]
 [-StartDate <ExDateTime>]
 [-StatusMailRecipients <RecipientIdParameter[]>]
 [-TargetMailbox <MailboxIdParameter>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (28)

Parameter	Type	Required	What it controls
-Name	String	yes	The Name parameter specifies a friendly name for the search. If the value contains spaces, enclose the value in quotation marks (").
-AllPublicFolderSources	Boolean		The AllPublicFolderSources parameter specifies whether to include all public folders in the organization in the search. Valid values are:
-AllSourceMailboxes	Boolean		The AllSourceMailboxes parameter specifies whether to include all mailboxes in the search. Valid values are:
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-Description	String		The Description parameter specifies a description for the search. The description isn't displayed to users. If the value contains spaces, enclose the value in quotation marks (").
-DomainController	Fqdn		This parameter is available only in on-premises Exchange.
-DoNotIncludeArchive	SwitchParameter		The DoNotIncludeArchive switch specifies that archive mailboxes are not included in the search. You don't need to specify a value with this switch.
-EndDate	ExDateTime		The EndDate parameter specifies the end date of the date range.
-EstimateOnly	SwitchParameter		The EstimateOnly switch specifies that only an estimate of the number of items to be returned is provided. You don't need to specify a value with this switch.
-ExcludeDuplicateMessages	Boolean		The ExcludeDuplicateMessages parameter eliminates duplication of messages in search results. Valid values are:
-Force	SwitchParameter		The Force switch hides warning or confirmation messages. You don't need to specify a value with this switch.
-IncludeKeywordStatistics	SwitchParameter		The IncludeKeywordStatistics switch returns keyword statistics (number of instances for each keyword) in search results. You don't need to specify a value with this switch.
-IncludeUnsearchableItems	SwitchParameter		The IncludeUnsearchableItems switch specifies that items that couldn't be indexed by Exchange Search should be included in the results. You don't need to specify a value with this switch.
-InPlaceHoldEnabled	Boolean		The InPlaceHoldEnabled parameter specifies whether to set an In-Place Hold on items in the search results. Valid values are:
-InPlaceHoldIdentity	String		This parameter is reserved for internal Microsoft use.
-ItemHoldPeriod	Unlimited		The ItemHoldPeriod parameter specifies the number of days for the In-Place Hold onthe mailbox items (all mailbox items or the items that are returned in the search query results). The duration is calculated from the...
-Language	CultureInfo		The Language parameter specifies a locale for the search.
-LogLevel	LoggingLevel		The LogLevel parameter specifies the logging level for the search. Valid values are:
-MessageTypes	KindKeyword[]		The MessageTypes parameter specifies the message types to include in the search query. Valid values are:
-Recipients	String[]		The Recipients parameter specifies one or more recipients to include in the search query. Messages that have the specified recipients in the To, Cc, and Bcc fields are returned in the search results.
-SearchDumpster	SwitchParameter		The SearchDumpster switch specifies whether the dumpster is searched. You don't need to specify a value with this switch.
-SearchQuery	String		The SearchQuery parameter specifies keywords for the search query by using the Keyword Query Language (KQL). For more information, see [Keyword Query Language (KQL) syntax...
-Senders	String[]		The Senders parameter specifies one or more senders to include in the search query. Messages that have the specified sender are returned in the search results. Senders can include users, distribution groups (messages...
-SourceMailboxes	RecipientIdParameter[]		The SourceMailboxes parameter specifies the identity of one or more mailboxes to be searched. You can use any value that uniquely identifies the mailbox. For example:
-StartDate	ExDateTime		The StartDate parameter specifies the start date of the date range.
-StatusMailRecipients	RecipientIdParameter[]		The StatusMailRecipients parameter specifies one or more recipients to receive a status email message upon completion of the search. You can use any value that uniquely identifies the recipient. For example:
-TargetMailbox	MailboxIdParameter		The TargetMailbox parameter specifies the destination mailbox where the search results are copied. You can use any value that uniquely identifies themailbox. For example:
-WhatIf	SwitchParameter		This parameter is reserved for internal Microsoft use.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.