Start-HistoricalSearch — usage, script and reference

Quick start script

# Start-HistoricalSearch — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Run and inspect
Start-HistoricalSearch -EndDate <DateTime> -ReportTitle <String> -ReportType <HistoricalSearchReportType> | Format-List

# 3. Export for evidence / drift tracking
Start-HistoricalSearch | Export-Clixml .\HistoricalSearch-$(Get-Date -Format yyyyMMdd).xml

Syntax

Start-HistoricalSearch -EndDate <DateTime> -ReportTitle <String> -ReportType <HistoricalSearchReportType> -StartDate <DateTime>
 [-BlockStatus <String>]
 [-CompressFile <Boolean>]
 [-ConnectorType <String>]
 [-DeliveryStatus <String>]
 [-Direction <MessageDirection>]
 [-DLPPolicy <MultiValuedProperty>]
 [-EncryptionTemplate <String>]
 [-EncryptionType <String>]
 [-Locale <CultureInfo>]
 [-MessageID <MultiValuedProperty>]
 [-NetworkMessageID <MultiValuedProperty>]
 [-NotifyAddress <MultiValuedProperty>]
 [-OriginalClientIP <String>]
 [-RecipientAddress <MultiValuedProperty>]
 [-SenderAddress <MultiValuedProperty>]
 [-SmtpSecurityError <String>]
 [-TLSUsed <String>]
 [-TransportRule <MultiValuedProperty>]
 [-Url <String>]
 [<CommonParameters>]

Parameters (23)

Parameter	Type	Required	What it controls
-EndDate	DateTime	yes	The EndDate parameter specifies the end date of the date range.
-ReportTitle	String	yes	The ReportTitle parameter specifies a descriptive name for the historical search. If the value contains spaces, enclose the value in quotation marks (").
-ReportType	HistoricalSearchReportType	yes	The ReportType parameter specifies the type of historical search that you want to perform. You can use one of the following values:
-StartDate	DateTime	yes	The StartDate parameter specifies the start date of the date range.
-BlockStatus	String		The BlockStatus parameter filters the results in OutboundSecurityReport reports by the status of messages sent externally, messages blocked due to security checks, or messages sent successfully.
-CompressFile	Boolean		{{ Fill CompressFile Description }}
-ConnectorType	String		The ConnectorType parameter filters the results in ConnectorReport reports by the connector type. Valid values are:
-DeliveryStatus	String		The DeliveryStatus parameter filters the results by the delivery status of the message. You can use one of the following values:
-Direction	MessageDirection		The Direction parameter filters the results by the direction of the message. Valid values are:
-DLPPolicy	MultiValuedProperty		The DLPPolicy parameter filters the results by the name of the DLP policy that acted on the message. You can specify multiple DLP policies separated by commas.
-EncryptionTemplate	String		{{ Fill EncryptionTemplate Description }}
-EncryptionType	String		{{ Fill EncryptionType Description }}
-Locale	CultureInfo		The Locale parameter filters the results by the locale of the message.
-MessageID	MultiValuedProperty		The MessageId parameter filters the results by the Message-ID header field of the message. This value is also known as the Client ID. The format of the Message-ID depends on the messaging server that sent the...
-NetworkMessageID	MultiValuedProperty		The NetworkMessageId parameter filters the message tracking log entries by the value of the NetworkMessageId field. This field contains a unique message ID value that persists across copies of the message that might...
-NotifyAddress	MultiValuedProperty		The NotifyAddress parameter specifies the email addresses of internal recipients to notify when the historical search is complete. The email address must be in an accepted domain that's configured for your...
-OriginalClientIP	String		The OriginalClientIP parameter filters the results by the original IP address of the message. For incoming messages, the OriginalClientIP value is the sender's IP address. For outgoing messages, the OriginalClientIP...
-RecipientAddress	MultiValuedProperty		The RecipientAddress parameter filters the results by the recipient's email address. You can specify multiple values separated by commas. The maximum number of addresses is 100.
-SenderAddress	MultiValuedProperty		The SenderAddress parameter filters the results by the sender's email address. You can specify multiple values separated by commas. The maximum number of addresses is 100.
-SmtpSecurityError	String		The SmtpSecurityError parameter filters the results in OutboundSecurityReport reports by the error type of blocked messages when sent externally.
-TLSUsed	String		The TLSUsed parameter filters the results in ConnectorReport reports by the TLS version. Valid values are:
-TransportRule	MultiValuedProperty		The TransportRule parameter filters the results by the name of the Exchange mail flow rule (also known as a transport rule) that acted on the message. You can specify multiple transport rules separated by commas.
-Url	String		{{ Fill Url Description }}