Delete Emails from Microsoft 365 with PowerShell (Step-by-Step) Details

A step-by-step admin guide to removing unwanted messages from every mailbox in your tenant

Introduction

Sooner or later, every Microsoft 365 administrator faces the same request: a message has landed in dozens of inboxes and it needs to disappear, fast. It could be a phishing email, a newsletter sent to the wrong audience, or an internal mail that contained confidential details. Asking each employee to delete it by hand is slow and unreliable.

The better approach is to search the whole tenant for the message and purge it centrally. This guide shows how to delete sent and received emails from Microsoft 365 mailboxes by combining a Compliance Search with a purge action in PowerShell. The same method works for items that users sent as well as items they received, because the search looks inside the mailboxes themselves.

What You Will Learn

• How to connect PowerShell to the Security & Compliance (Microsoft Purview) service
• How to build a search that finds a message by its subject
• How to monitor the search and confirm it has finished
• How to purge the matching items from all mailboxes
• Safety checks to run before you delete anything

Before You Start: Requirements

Make sure the following are in place so the commands run without permission errors:

• Administrator access. Your account needs the appropriate roles in Microsoft Purview. In practice that means membership of a role group that includes the Compliance Search role (for example eDiscovery Manager) and the Search And Purge role (for example Organization Management).
• PowerShell with the Exchange Online module. The ExchangeOnlineManagement module provides the Connect-IPPSSession cmdlet used below.
• The exact subject line (or another unique detail) of the email you want to remove.

Step-by-Step: Delete Emails from Microsoft 365

Step 1: Connect PowerShell to Your Tenant

Open PowerShell as an administrator and start a session with the Security & Compliance service. The search-only switch is required so that the purge action becomes available later in the session.

A sign-in window will appear. Authenticate with your admin credentials, and the prompt returns once the connection is established.

Figure 1: Connecting PowerShell to the Security & Compliance service

Step 2: Create a Compliance Search for the Email

Next, define what you are looking for. The command below creates a search called "documentation test delete" that scans every mailbox in the organization for messages whose subject contains the text "Test mail for delete". Replace both values with your own.

Here is what each part does:

• -Name gives the search a label you will reuse in the final step.
• -ExchangeLocation All tells the search to cover every mailbox. You can list specific mailboxes instead to narrow the scope.
• -ContentMatchQuery holds the keyword query. Here it matches on the subject, but you can also combine conditions such as sender or date range.

Figure 2: Creating the compliance search

Step 3: Start the Search

Creating the search does not run it. Launch it with the command below, which uses the variable saved in the previous step.

Figure 3: Starting the compliance search

Step 4: Check the Search Status

Searches across a large tenant can take a few minutes. Run the following command to see how far along it is:

Look for your search name in the list. While it is running, the status reads Starting or InProgress. Wait until it changes to Completed before moving on. Running the command again every minute or so will refresh the result.

Figure 4: Status column showing the search as Completed (other entries hidden)

Step 5: Purge the Emails from the Mailboxes

Once the search is complete and you are satisfied with the results, run the purge action. It references the search by name:

PowerShell asks you to confirm because the action makes the matching items inaccessible to users. Type Y and press Enter to proceed. The action begins in the Starting state and finishes after a short while; you can follow its progress with Get-ComplianceSearchAction.

Figure 5: Confirming the purge action

SoftDelete vs. HardDelete: Which Should You Choose?

The -PurgeType parameter controls what happens to the messages:

Purge Type	What It Does	When to Use
SoftDelete	Moves items to the Recoverable Items folder. Users can no longer see them, but they remain recoverable until the deleted-item retention period expires (14 days by default, configurable up to 30 days).	Safer starting point when you want a recovery window.
HardDelete	Marks items for permanent removal from the mailbox.	Use only when you are certain, such as for confirmed malicious content.

For most situations SoftDelete is the safer starting point because it leaves a recovery window if the search turned out to be too broad.

Important Points to Remember

• The purge cannot be undone with a simple command, so always verify the item count first.
• Test your query on a single mailbox before running it against the whole organization.
• Mailboxes under litigation hold or a retention policy may keep a preserved copy of the message even after purging.
• A single purge action removes a limited number of items per mailbox (currently 10). If a mailbox holds more matches, you will need to repeat the action.
• Use a precise subject, sender and date range so you do not remove legitimate mail.
• Disconnect when finished with Disconnect-ExchangeOnline to close the session cleanly.

Frequently Asked Questions

Can I delete emails sent by users as well as received ones?

Yes. The compliance search inspects the contents of mailboxes, so a message in a Sent Items folder is found exactly like one in an Inbox, as long as it matches your query.

Can I do this from the admin center instead of PowerShell?

You can create and run the search in the Microsoft Purview portal, but the purge step is performed through PowerShell. That is why this guide combines both tools for a complete workflow.

Will users be notified when the email is removed?

No notification is sent. The message simply stops appearing in the mailbox.

How do I recover a message deleted by mistake?

If you used SoftDelete and the retention window is still open, the item can be restored from the Recoverable Items folder through the user's mailbox or by an administrator.

Conclusion

Removing a message from every mailbox no longer has to be a manual chore. With five commands you can connect to the service, define a search, run it, check its status and purge the results across your Microsoft 365 tenant. Take your time with the search query, confirm the item count, and choose the purge type carefully, and you will have a fast and dependable way to handle incidents such as phishing campaigns or accidental mass mailings.

If this tutorial helped, share it with a colleague who manages Exchange Online, and leave a comment below if you would like a follow-up on automating the process with scripts.