How to Track Email Messages in Exchange Online Microsoft 365

Navigate to the modern Exchange Admin Center where Microsoft has consolidated all message tracking capabilities. This is your primary interface for email monitoring in 2026.

Open your browser and go to https://admin.exchange.microsoft.com. Sign in with your administrator credentials that have the required permissions.

Once logged in, you'll see the modern Exchange Admin Center dashboard. The interface has been streamlined since the 2024 rollout, making message tracing more accessible than the legacy classic EAC.

Locate the message trace functionality within the Mail flow section. Microsoft reorganized this in 2024 to make email tracking more intuitive.

In the left navigation pane, click Mail flow, then select Message trace. This takes you to the main message tracking interface.

You'll see the message trace dashboard with options for "Start a trace" and any previous trace results. The new interface supports up to 90 days of historical data, a significant improvement from the previous 10-day limit.

Set up your first message trace by defining the search criteria. The new message trace feature offers enhanced filtering capabilities compared to previous versions.

Click Start a trace to open the "New message trace" flyout panel. You'll see several fields to configure:

• Sender: Enter the sender's email address or leave blank for all senders
• Recipient: Specify recipient email or leave blank for all recipients
• Date range: Select up to 90 days of historical data
• Subject: Use wildcards like "*invoice*" to find emails containing specific terms

For your first trace, try searching for messages from the last 24 hours by setting the date range to yesterday through today.

Example search criteria:
Sender: john.doe@company.com
Recipient: (leave blank)
Date range: Last 24 hours
Subject: (leave blank)

Run your configured trace and interpret the comprehensive results provided by the modern interface.

Click Search to execute the trace. The system will process your request and display results in batches of 250 messages, with a maximum of 10,000 results per trace.

The results table includes these key columns:

• Date: When the message was processed
• Sender/Recipient: Email addresses involved
• Subject: First 256 characters of the subject line
• Status: Delivery status (Delivered, Failed, Quarantined, etc.)
• Message size: Size in KB or MB
• From/To IP: Source and destination IP addresses (when available)

Click on any message row to see detailed information including message events, routing details, and any actions taken by security policies.

Examine individual message details to understand the complete email journey and identify any delivery problems.

Select a specific message from your trace results and click View details. This opens a detailed view showing the message's complete path through Exchange Online.

The details panel displays message events in chronological order:

• Receive: Message accepted by Exchange Online
• Send: Message forwarded to next hop
• Deliver: Message delivered to recipient's mailbox
• Fail: Delivery failure occurred
• Expand: Distribution list expanded

Pay attention to status codes and error messages. Common statuses include:

• Delivered: Successfully delivered
• Quarantined: Held by security policies
• Filtered as spam: Blocked by anti-spam
• Getting status: Still processing

Set up PowerShell access for automated message tracing and advanced queries that exceed the web interface limitations.

Open PowerShell as an administrator and install the latest Exchange Online Management module:

Install-Module -Name ExchangeOnlineManagement -Force
Update-Module -Name ExchangeOnlineManagement

Verify you have version 3.7.0 or later, which includes the new Get-MessageTraceV2 cmdlet:

Get-Module -Name ExchangeOnlineManagement -ListAvailable | Select-Object Version

Connect to Exchange Online using your administrator credentials:

Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com

The connection will prompt for authentication. Use modern authentication (OAuth) which is the default and most secure method.

Use the new Get-MessageTraceV2 cmdlet to perform advanced message tracing with greater flexibility than the web interface.

Run a basic trace for messages from a specific sender in the last 7 days:

Get-MessageTraceV2 -SenderAddress "john.doe@company.com" -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) -Status Delivered | Format-Table Received, SenderAddress, RecipientAddress, Status, Subject, TotalBytes

For more complex queries, use multiple parameters:

# Trace quarantined messages with subject filtering
Get-MessageTraceV2 -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) -Status Quarantined -Subject "*invoice*" | Select-Object Received, SenderAddress, RecipientAddress, Subject, Status

To trace a specific message using its Network Message ID:

Get-MessageTraceV2 -MessageTraceId "d9683b4c-127b-413a-ae2e-fa7dfb32c69d@DM3NAM06BG401.Eop-nam06.prod.protection.outlook.com" -StartDate "2026-03-10" -EndDate "2026-03-16"

Create comprehensive email flow reports for compliance, auditing, and analysis purposes using both web interface and PowerShell methods.

Web Interface Export:

In the Exchange Admin Center message trace results, click Download results to export your trace data as a CSV file. This includes all visible columns and respects any filters you've applied.

PowerShell Export:

Export detailed traces directly to CSV files for further analysis:

# Export all delivered messages from last 30 days
Get-MessageTraceV2 -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) -Status Delivered | Export-Csv -Path "C:\EmailReports\DeliveredMessages_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

For historical data beyond 90 days, use the Historical Search feature:

# Start a historical search for older data
Start-HistoricalSearch -ReportTitle "Q4_Email_Report" -StartDate "2025-10-01" -EndDate "2025-12-31" -ReportType MessageTraceDetail -NotifyAddress "admin@company.com"

Check the status and retrieve results:

Get-HistoricalSearch -ReportTitle "Q4_Email_Report"

Address frequent problems encountered during message tracing and implement best practices for reliable email monitoring.

Issue: Partial or Missing Results

If you're not seeing expected messages, check these common causes:

• Time zone differences: Ensure your date range accounts for UTC vs. local time
• Recent messages: Wait 2-5 minutes after sending before tracing
• Large recipient lists: Include MessageTraceId for queries with >1000 recipients

Issue: Status Discrepancies

The new Message Trace V2 shows the latest message status, which may differ from the original status:

# Compare V1 and V2 results for the same message
Get-MessageTrace -SenderAddress "sender@domain.com" -StartDate (Get-Date).AddHours(-2) -EndDate (Get-Date)
Get-MessageTraceV2 -SenderAddress "sender@domain.com" -StartDate (Get-Date).AddHours(-2) -EndDate (Get-Date)

Issue: Performance and Limits

Optimize your queries to avoid timeouts and limits:

• Use specific date ranges instead of maximum 90 days
• Filter by sender or recipient when possible
• Break large queries into smaller time windows