Commands › Exchange Online

Search-Mailbox

Exchange Online ExchangeOnlineManagement Search-*

Search a mailbox and copy the results to a specified target mailbox, delete messages from the source mailbox, or both. **Note**: In cloud-based environments, the Search-Mailbox cmdlet was deprecated in favor of New-ComplianceSearch and related eDiscovery cmdlets. By default, Search-Mailbox is available only in the Mailbox Search or Mailbox Import Export roles, and these roles aren't assigned to *any* role groups. To use this cmdlet, you need to add one or both of the roles to a role group (for example, the Organization Management role group). Only the Mailbox Import Export role gives you acces

Quick start script

# Search-Mailbox — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Run and inspect
Search-Mailbox -Identity <MailboxOrMailUserIdParameter> -EstimateResultOnly <SwitchParameter> -TargetFolder <String> | Format-List

# 3. Export for evidence / drift tracking
Search-Mailbox | Export-Clixml .\Mailbox-$(Get-Date -Format yyyyMMdd).xml

Syntax — 3 parameter sets

Identity

Search-Mailbox [-Identity] <MailboxOrMailUserIdParameter>
 [-Confirm]
 [-DeleteContent]
 [-DomainController <Fqdn>]
 [-DoNotIncludeArchive]
 [-Force]
 [-IncludeUnsearchableItems]
 [-SearchDumpster]
 [-SearchDumpsterOnly]
 [-SearchQuery <String>]
 [-WhatIf]
 [<CommonParameters>]

EstimateResult

Search-Mailbox [-Identity] <MailboxOrMailUserIdParameter>
 [-EstimateResultOnly]
 [-Confirm]
 [-DomainController <Fqdn>]
 [-DoNotIncludeArchive]
 [-Force]
 [-IncludeUnsearchableItems]
 [-SearchDumpster]
 [-SearchDumpsterOnly]
 [-SearchQuery <String>]
 [-WhatIf]
 [<CommonParameters>]

Mailbox

Search-Mailbox [-Identity] <MailboxOrMailUserIdParameter> -TargetFolder <String> -TargetMailbox <MailboxIdParameter>
 [-Confirm]
 [-DeleteContent]
 [-DomainController <Fqdn>]
 [-DoNotIncludeArchive]
 [-Force]
 [-IncludeUnsearchableItems]
 [-LogLevel <LoggingLevel>]
 [-LogOnly]
 [-SearchDumpster]
 [-SearchDumpsterOnly]
 [-SearchQuery <String>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (16)

Parameter	Type	Required	What it controls
-Identity	MailboxOrMailUserIdParameter	yes	The Identity parameter specifies the identity of the mailbox to search. You can use any value that uniquely identifies the mailbox. For example:
-EstimateResultOnly	SwitchParameter	yes	The EstimateResultOnly switch returns only an estimate of the total number and size of messages. Messages aren't copied to the target mailbox. You don't need to specify a value with this switch.
-TargetFolder	String	yes	The TargetFolder parameter specifies a folder name in which search results are saved in the target mailbox. The folder is created in the target mailbox upon execution.
-TargetMailbox	MailboxIdParameter	yes	The TargetMailbox parameter specifies the destination mailbox where search results are copied. You can use any value that uniquely identifies the mailbox. For example:
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-DeleteContent	SwitchParameter		Note: You need to be assigned the Mailbox Import Export management role to use this switch. By default, this role isn't assigned to any role group (including Organization Management). Typically, you assign a role...
-DomainController	Fqdn		The DomainController parameter specifies the domain controller that's used by this cmdlet to read data from or write data to Active Directory. You identify the domain controller by its fully qualified domain name...
-DoNotIncludeArchive	SwitchParameter		The DoNotIncludeArchive switch specifies that the user's archive mailbox shouldn't be included in the search. You don't need to specify a value for this switch.
-Force	SwitchParameter		The Force switch hides warning or confirmation messages. You don't need to specify a value with this switch.
-IncludeUnsearchableItems	SwitchParameter		The IncludeUnsearchableItems switch includes items that couldn't be indexed by Exchange Search in the search results. You don't need to specify a value with this switch.
-LogLevel	LoggingLevel		The LogLevel parameter specifies the logging level for the search. It can have one of the following values:
-LogOnly	SwitchParameter		The LogOnly switch performs a search, but only generates a log. Messages returned by the search aren't copied to the target mailbox. You don't need to specify a value with this switch.
-SearchDumpster	SwitchParameter		The SearchDumpster switch specifies whether to include the Recoverable Items folder in the search. The Recoverable items folder stores items that were deleted from the Deleted Items folder or items that were...
-SearchDumpsterOnly	SwitchParameter		The SearchDumpsterOnly switch specifies that only the Recoverable Items folder of the specified mailbox is searched. You don't need to specify a value with this switch.
-SearchQuery	String		The SearchQuery parameter specifies a search string or a query formatted using Keyword Query Language (KQL). For more information about KQL in Exchange, see [Message properties and search operators for In-Place...
-WhatIf	SwitchParameter		The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.