Link to home
Start Free TrialLog in
Avatar of K B
K BFlag for United States of America

asked on

Office 365: Content Search, Search and Purge

In a test for production, I am attempting to purge all items in one mailbox.

1. I created a Content Search
2. The Content Search produces a report & preview that shows all items in the mailbox
3. I connect to Office 365 compliance PowerShell
4. I execute this PowerShell:

New-ComplianceSearchAction -SearchName "Test Compliance Search 01" -Purge -PurgeType SoftDelete

Open in new window


5. Get-ComplianceSearchAction shows the status for "Test Compliance Search 01_Purge" as Completed
6. Not one item is deleted from the mailbox

Here is a screenshot showing 192 Results in the Content Search I used.  I was originally just using email as the type and a date range, when that didn't work I removed all conditions. So this screenshot shows all items in the mailbox:

User generated image
Any ideas experts?

Thank you.
Avatar of Amit
Amit
Flag of India image

As far as I know, with soft delete data will retained for sometime and then exchange will purge it permanently, as per retention policy. I assume for O365 it is 30 days.
Few points here. First, "purge" for this cmdlet really means delete, more specifically soft-delete. As in move the item to the recoverable items subtree, Deletions folder, where the item still remains for the duration of the single item recovery window. And since the recoverable item subtree is searched by default, you still see them. Here's verbatim from the help:

If you run the same Content Search after you delete a message, you will still see the same number of search results (and might assume that the message wasn't deleted from user mailboxes). This is because a Content Search searches the Recoverable Items folder...

Repeating the delete will not make much difference, as only soft delete is supported. And even if you really purge it, you still need to respect other limits:

A maximum of 10 items per mailbox can be removed at one time. Because the capability to search for and remove messages is intended to be an incident-response tool, this limit helps ensure that messages are quickly removed from mailboxes. This feature isn't intended to clean up user mailboxes.

If you are only targeting Exchange data, why dont you simply use the Search-Mailbox cmdlet instead? It allows you to exclude the dumpster to report on items in the user-accessible folder only, or even purge items from the dumpster :)
Avatar of K B

ASKER

Thank you for your replies:  This is purely office 365 so i dont think there is Search-Mailbox correct?

I used just purge without purge type.. either way they don't even move from the inbox or any folder.  shouldn't something happen if I am looking at the mailbox?
Avatar of K B

ASKER

Amit that is exactly the article I followed.
Check my reply above. This is from KB:

What happens after you delete a message?   A message that is deleted by using the New-ComplianceSearchAction -Purge -PurgeType SoftDelete command is moved to the Deletions folder in the user's Recoverable Items folder. It isn't immediately purged from Office 365. The user can recover messages in the Deleted Items folder for the duration based on the deleted item retention period configured for the mailbox. After this retention period expires (or if user purges the message before it expires), the message is moved to the Purges folder and can no longer be accessed by the user. Once in the Purges folder, the message is again retained for the duration based on the deleted item retention period configured for the mailbox if single items recovery is enabled for the mailbox. (In Office 365, single item recovery is enabled by default when a new mailbox is created. ) After the deleted item retention period expires, the message is marked from permanent deletion and will be purged from Office 365 the next time that the mailbox is processed by the Managed Folder assistant.
Avatar of K B

ASKER

Amit does that mean it should be moved at least from the inbox for example?
Can  you expand you question more.
Avatar of K B

ASKER

say in my mailbox I have 1 email only ... nothing else.. it lives in the INBOX.

Now I do a Content Search that shows the 1 item named: Test Compliance Search 02
Next I do New-ComplianceSearchAction -SearchName "Test Compliance Search 02" -Purge

It completes successfully.

What should happen to the 1 email in the INBOX?
As per MS KB, it will be move to deletion folder in the user Recoverable Items folder and will be retained till the retention policy.
Avatar of K B

ASKER

Thank you for confirming that.. That is not happening in this case.
Are you saying mail is still present in inbox? I might give sometime and check again.
Avatar of K B

ASKER

yes, nothing changed at all
ASKER CERTIFIED SOLUTION
Avatar of Amit
Amit
Flag of India image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of K B

ASKER

That was it! Thank you!
Great :)
Avatar of Anna Johnson
Anna Johnson

Thanks for you replies, I know everything now :)