Like on-prem Exchange, the cloud Exchange Online has powerful built-in features to track email messages sent or received by users. Message tracking allows you to get full details on any email in your Exchange organization. Using a trace, you can tell whether your company received a specific email, if it was delivered to a user’s mailbox or a remote mail system, or it was filtered by antispam filters/transport rules. In this article, we’ll cover the basic ways to track (trace) sent or received emails in Exchange Online (Microsoft 365) using the Exchange Admin Center (EAC) and PowerShell.

How to Trace a Message in the Exchange Admin Center?

You can trace messages through the Exchange Admin Center web interface. Sign-in to the modern EAC portal (https://admin.exchange.microsoft.com) and go to Mail Flow -> Message Trace.

In the next window, some predefined message tracing options are available. To do a new search, click Start a trace.

Fill in the request fields. You can specify:

• A sender and/or a recipient. In this case, I want to get information about all email messages sent to my company from the external domain gmail.com (*@gmail.com);
• A search period. A report for the last 10 days will be generated interactively. If you want to search logs older than 10 days, will be sent to the specified email address;
• In the Detailed Search Options, you can specify extra search criteria (Message ID, IP address, Delivery Status).

Click the Search button to start searching.

You will see the information about all email messages meeting your criteria.

You can click any email and view detailed information. In this example, the email has been successfully delivered to the recipient’s mailbox (Status: The message was delivered to the recipient’s Inbox folder).

The last 10 trace queries are automatically saved in the EAC console. You can save tracking queries you use often.

Search Message Tracking Logs in Exchange Online (Microsoft 365) with PowerShell

Get-MessageTrackingLog cmdlet used in the on-premises Exchange Server to search sent/received email messages in the MessageTracking transport logs. In Exchange Online, the Get-MessageTrace and Get-MessageTraceDetail cmdlets are used to track messages.

Connect to your Microsoft 365 tenant using the Exchange Online PowerShell module:

Connect-ExchangeOnline -UserPrincipalName [email protected] -ShowProgress $true

If you run the Get-MessageTrace cmdlet without parameters, it returns information about all emails in your Microsoft 365 tenant for the last 48 hours. You can specify the date range for your search using -StartDate and -EndDate options. Let’s display the information about all messages sent to a user (RecipientAddress) for the last 5 days:

Get-MessageTrace -RecipientAddress [email protected] -StartDate 12/17/21 -EndDate 12/21/21| select Received,SenderAddress,RecipientAddress, Subject,Size,Status|ft

You can search both RecipientAddress and SenderAddress fields in a single trace query.

Use the -Status option to search by the message delivery status (Failed, Pending, Delivered, Expanded, Quarantined, FilteredAsSpam).

To display detailed information on the found events, use a pipe with Get-MessageTraceDetail cmdlet:

Get-MessageTrace -SenderAddress [email protected] -StartDate 12/19/21 -EndDate 12/21/21|Get-MessageTraceDetail|fl

The following commands show information about the delivery status of the email message sent to multiple recipients.

Get the MessageID first for any of the recipients:

Get-MessageTrace -RecipientAddress [email protected]|fl

Invalid StartDate value. The StartDate can't be greater than 90 days from today.