Can I find out who sent a message from Exchange Online logs

They want me to find out who sent a message outside of the organization they believe was BCC'd but the only information I have is the subject. Can we find out who sent it to an outside address? I've looked through the Exchange Mst trace logs, Security and Compliance etc I cannot find a way of querying this information is it possible?
Jason KomendatAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Vasil Michev (MVP)Commented:
There is no subject-based search in ExO, you will have to at least specify a date range and get the full message trace logs, then filter the output and search for the subject. Do you at least have the recipient address?
0
Jason KomendatAuthor Commented:
No of course not that would be too easy, I thought of that searching for all messages and just sorting through but when I try that I specify the date range it opens a windows with just some of 1 day and thats it. The windows even after I hit show all results at the bottom doesn't show all for that date range. It like it limits it to 1000 messages and we get close to 50,000 a day
0
Vasil Michev (MVP)Commented:
Yes, you have to use pagination to get the full result for the data range, and it can take a while in large environments. Here's a sample script that you can modify to get the full list of messages: https://gallery.technet.microsoft.com/office/Office-365-Mail-Traffic-afa37da1
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

Jason KomendatAuthor Commented:
This script says it gives Office 365 Mail Traffic Statistics by User. I need to search outgoing messages and find one by a specific subject that went BCC'd to external addresses. I need to find out which local user sent that message. I don't think this script is what I need
0
Vasil Michev (MVP)Commented:
The point was that you can use it as an example on how to get all the messages. The script does exactly that, for all recipients in your tenant. But you will have to modify the output to give you jsut the ones with the subject you care about.
0
Ajit SinghCommented:
Try PowerShell something like:

Get-MessageTrace -SenderAddress $email -StartDate "11/01/2017 6:00" -EndDate "11/15/2017 6:00" | 
Export-csv C:\export.csv

Open in new window


Message Trace, the PowerShell Way

Message Tracking by Subject

Office 365 – Script to Perform Message Trace By Subject

User Login History, Statistics and Activity Reports in the Office 365

Hope this helps!
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Ajit SinghCommented:
Please post back if you need further assistance.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.