Advanced Hunting - Schema missing

[Sheridan]

I'm trying to use the Exchange 365 Advanced Hunting to trace (and delete) a phishing email. In true MS form this doesn't seem to work but offers little help!

 

If I select an email and use the 'Go Hunt' option, it opens the Advanced Hunting window but with an error 'Failed to decode shared query text' and I can see the query shows an error status - but it looks like the schema it needs (EmailEvents) is missing from the list of schemas I have - how do I add missing schemas, or is this some licensing issue? (we're on A3 for Faculty)

[andy_b]

Doesn't help with this - but I mostly use Content Search and powershell to remove phishing emails - https://learn.microsoft.com/en-us/purview/ediscovery-search-for-and-delete-email-messages

[Sheridan]

Thanks, I'll have a look into that instead