Office 365 Compliance Search

[Guest Guest]

I've been asked by our Head to delete an email she accidentally sent to a member of staff. I created a Compliance Search within the Compliance Center and ran New-ComplianceSearchAction with the purge and Hard Purge parameters set. However, when when I re-run the Compliance Search the email still shows. I suspect I just need to wait and this will update, however, she's panicking. Has anyone else done this and had a delay before the compliance search shows the email has been removed?

 

I tested the process against an email within my account and it worked fine

 

many thanks

[HPlum78]

Would need to take a look at the command your running to be able to shed any light on it as based on what you are saying it should have removed the mail.

[Guest Guest]

The command I ran was New-ComplianceSearchAction -SearchName "NameOfSearch" -Purge -PurgeType HardDelete I'm running the Compliance Search from within the O365 Compliance Portal

[FragglePete]

I go through the steps detailed here:

 

https://www.geekshangout.com/office-365-deleting-email-mailboxes-using-content-search-feature/

 

Recent search and deletes due to a number of phising e-mails hitting our tenant have been successful.

 

Pete

 

[EddyAllen]

If its to prevent a data breach I would say you could probably justify delegating full access to the mailbox to yourself, going to outlook and in the top right under your username click "open another mailbox". Open the mailbox and delete the email. Just make sure you have logged it and remove your delegated access afterwards to show what you've done.

 

If its political then you're probably going to have to go through the hard-purge route.

[Guest Guest]

If its to prevent a data breach I would say you could probably justify delegating full access to the mailbox to yourself, going to outlook and in the top right under your username click "open another mailbox". Open the mailbox and delete the email. Just make sure you have logged it and remove your delegated access afterwards to show what you've done.

 

If its political then you're probably going to have to go through the hard-purge route.

I ended up delegating access in the end. It had worked, however, repeating the compliance search still showed the email for some reason

[EddyAllen]

I ended up delegating access in the end. It had worked, however, repeating the compliance search still showed the email for some reason

 

Glad to hear you got a solution! Compliance search will continue to show deleted emails for a while (2 years I believe and indefinitely if you have litigation hold on)

Just make sure you have it logged somewhere like your GDPR incidents / e-Safety incidents to protect yourself and the organisation as its pretty unconventional to delegate access that way and could, in itself, be considered a data breach unless you are doing it to actively try prevent a more serious data breach!