Deleting O365 Emails using Compliance Centre and Powershell

[kennysarmy]

I need to delete some emails - don't ask.

 

I've logged in to the Compliance centre and run a search for the emails to be purged : https://compliance.microsoft.com/contentsearch

 

I then run the following command on my PC : New-ComplianceSearchAction -SearchName "GHD3" -Purge -PurgeType HardDelete

 

When it's finished I run the command : Get-ComplianceSearchAction -Identity "GHD3_Purge" | Format-List

 

This looks like it's actioned the HardDelete command and deleted the emails.

 

HOWEVER.

 

When I go back to the Compliance Centre and search for the emails again - they still appear to be there.

 

What am I doing wrong?

 

Cheers

[psydii]

I've found search and compliance to be a bit flaky recently. But not seen this particular behaviour.

 

Just checking: are you running a new search entirely, or re-running the existing one?

Also did you enable a hold on the mailboxes when you were creating the search?

 

Finally: Are you able to hop into a mailbox that appears to still have the email and check whether it is really there?

[kennysarmy]

I've found search and compliance to be a bit flaky recently. But not seen this particular behaviour.

 

Just checking: are you running a new search entirely, or re-running the existing one?

Also did you enable a hold on the mailboxes when you were creating the search?

 

Finally: Are you able to hop into a mailbox that appears to still have the email and check whether it is really there?

 

Ran the existing one / also tried a new one.

 

I did n't enable a hold - what does this mean?

 

I've just done a test.

Sent an email to a test student account.

Picked it up on a content search.

Ran the purge.

Verified both the sent and received emails were deleted.

 

I'm now re-running the content search to see the results :/

 

Seems to be taking a while

[kennysarmy]

The test email still appeared in the content search!

 

I'll try a brand new content search.

[kennysarmy]

I wonder if it's this : "Every mail item that was Soft Deleted or Hard deleted will automatically be saved in the Exchange Online mailbox special folder – the “Recoverable items” folder."

[psydii]

Good find. That potentially sounds like the culprit.

 

To answer your question about Hold: https://docs.microsoft.com/en-us/exchange/security-and-compliance/in-place-and-litigation-holds

[kennysarmy]

https://docs.microsoft.com/en-us/exchange/security-and-compliance/recoverable-items-folder/clean-up-deleted-items