Bulk purge emails in Outlook 365

[enjay]

I need to bulk purge a load of emails from a specific mailbox. After a bit of battling, I've got a PowerShell script which does what I want but it is limited to 10 messages at a time, and I'm needing to delete hundreds if not thousands of messages. I know I should be able to do with the Compliance Center GUI or eDiscovery, but I can't get those to work. Does anyone have any pointers or know of good guides on using either of these?

[andy_b]

Ignoring the adverts, this seems a fairly step by step guide:

 

https://o365info.com/search-and-delete-emails-microsoft-365/

[enjay]

Thanks, that gets me pretty close to where I want to be. The problem I'm still having is the search identifies 1500 emails but only deletes the first 10 results.

[Ant]

I use the ComplianceSearch cmdlet (as described in @andy_b's link) to search and remove emails from users' mailboxes, usually removing potentially malicious emails that slip thorugh our vairous filters. Granted never in the thousands, but definitely in the 10s. If I recall correctly, the preview is often limited in number, but the purge usually gets them all.

[enjay]

Clearing out malicious emails is what I've used it for previously too, so a 10 email limit wasn't a huge problem (although might mean I left some behind if I didn't know about the limit at the time!), but for this usage case I need to delete hundreds. 

 

The results of the compliance search and the purge action are below, showing 1490 items found and 10 items deleted. If I run the search and purge again, it deletes another 10 items with a slightly different file size, so it does look like only 10 items have been deleted each time. That said, the search is still finding 1490 items each time I run it, shouldn't that be going down by 10 each time?

 

 

[Ant]

It looks like there is a limit of up to 10 per mailbox now, I didn't realise this. If all results are in a single mailbox this is explains the issue you're facing. Also explains why we've had success with the odd email. I'm sure you could loop the command some how?

 

The total not updating is probably just a delay in updating. Does it update if you re-run the search? I find changes can be slow to update at times.

[enjay]

Ah, 10 per mailbox would explain why clearing malicious emails has worked in bulk.

 

As for looping the command, it's a bit confusing but I think I have to run the search each time too. I've just tried the purge action again, and it reported deleting 10 emails but with the exact same size as the last time I ran it.

[andy_b]

That's annoying - didn't know that.

 

You could use Get-EXOMailboxFolderItem and Remove-EXOMailboxItem to accomplish the task.

[enjay]

22 minutes ago, andy_b said:

That's annoying - didn't know that.

 

You could use Get-EXOMailboxFolderItem and Remove-EXOMailboxItem to accomplish the task.

 

Do you mean this:

 

Get-ExoMailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited | Search-Mailbox -SearchQuery {Subject: "Spam Email" Received:1-Apr-2018..1-Jul-2024} -DeleteContent

[andy_b]

This is a chatgtp script, but looks ok at inital glance, but TEST.

 

Testing and Adjustments:

    List Only (No Deletion):
    To preview the emails that match the filters without deleting them, replace the Remove-EXOMailboxItem line with:

Write-Host "Matched email: $($_.Subject)"

 

 

# Install Exchange Online module if needed
# Install-Module ExchangeOnlineManagement -Scope CurrentUser

# Import the module and connect to Exchange Online
Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline -UserPrincipalName [email protected]

# Define the target mailbox and folder
$mailbox = "[email protected]"
$folder = "Inbox"  # Specify folder (e.g., "Sent Items", "Deleted Items")

# Define the date filter and subject filter
$dateThreshold = (Get-Date).AddMonths(-6)  # Delete emails older than 6 months
$subjectKeyword = "*Report*"  # Subject filter (wildcards supported)

# Get the Folder ID for the specified folder
$folderId = (Get-EXOMailboxFolderStatistics -Identity $mailbox | Where-Object { $_.Name -eq $folder }).FolderId

# Fetch and delete matching emails based on date and subject
Get-EXOMailboxFolderItem -Mailbox $mailbox -FolderId $folderId | 
    Where-Object { $_.ReceivedDateTime -lt $dateThreshold -and $_.Subject -like $subjectKeyword } | 
    ForEach-Object { 
        Remove-EXOMailboxItem -Mailbox $mailbox -ItemId $_.ItemId -Confirm:$false
        Write-Host "Deleted email with Subject: $($_.Subject)"
    }

# Disconnect from Exchange Online
Disconnect-ExchangeOnline -Confirm:$false
Write-Host "Disconnected from Exchange Online."

 

Edited March 21, 2025 by andy_b

[enjay]

Thanks @andy_b I'll give that a whirl and let you know. I'm testing with a mailbox that doesn't matter before I go for the real one.