How to Track Email Messages in Exchange Online Microsoft 365
Track email messages in Exchange Online using the modern EAC message trace (90-day history) and PowerShell's Get-MessageTraceV2 cmdlet. Covers search setup, result analysis, reporting, and troubleshooting.
- Difficulty
- Intermediate
- Time required
- 10-15 minutes
- Steps
- 3
- Platform
- Exchange Online
- Last tested
- July 19, 2026
Table of contents
Quick Answer
Go to the stepsOpen the EAC, go to Mail flow > Message trace, enter search criteria, and click Search. Results show delivery status and detailed event logs.
- Go to admin.exchange.microsoft.com.
- Click Mail flow > Message trace.
- Click Start a trace.
- Enter sender, recipient, date range, or subject.
- Click Search and review results.
admin.exchange.microsoft.com > Mail flow > Message trace > Start a traceExpected result: Trace returns messages with status (Delivered, Quarantined, Failed), sender/recipient, subject, and timestamps.
Key takeaways
- How to trace email messages in Exchange Online using the EAC web interface and PowerShell.
- When a user reports missing email, message trace confirms whether it was delivered, quarantined, or blocked.
- Use the EAC message trace for quick lookups and PowerShell Get-MessageTraceV2 for scripted reports. Both support 90 days of history. Check Junk/Focused Inbox before escalating 'missing email' reports.
Introduction
Exchange Online's message trace lets you track any email's journey through your Microsoft 365 tenant. The modern Exchange Admin Center supports up to 90 days of history, 10,000 results per trace, and wildcard subject filtering. PowerShell's Get-MessageTraceV2 cmdlet (module v3.7.0+) provides the same data programmatically. This tutorial covers both methods.
Who this is for: Microsoft 365 administrators, help desk teams, and MSPs troubleshooting email delivery.
Before you start
- Access
- Exchange Admin Center and Exchange Online PowerShell
- Required roles
- Global Administrator or Organization Management
- Required licenses
- Microsoft 365 with Exchange Online
- Environment
- Microsoft 365 tenant with Exchange Online
- Vendor
- Microsoft
- Last tested
- Administrator permissions required
- Read-only procedure
10-15 minutes
Note: Results have a short delay
Messages take 2-5 minutes to appear in trace results after sending.
Note: V2 shows latest status
V2 trace shows the latest status. A quarantined message later released shows Delivered.
1Run a message trace in the Exchange Admin Center
Run a message trace in the modern Exchange Admin Center to check email delivery status.
admin.exchange.microsoft.com > Mail flow > Message trace > Start a traceGo to admin.exchange.microsoft.com. Sign in with your admin account.
In the left navigation, click Mail flow > Message trace. Click Start a trace.
Fill in the search criteria:
- Sender: the sender's email address (or leave blank for all)
- Recipient: the recipient's email address (or leave blank for all)
- Date range: up to 90 days back
- Subject: use wildcards like
*invoice*for partial matches
Click Search. Results appear in batches of 250, up to 10,000 total.
Click any message row to open the detailed view showing chronological events: Receive, Send, Deliver, Fail, Expand (for distribution lists). The Status column shows: Delivered, Failed, Quarantined, or Filtered as spam.
To export: click Download results for a CSV file.
Expected result: Trace returns matching messages with Date, Sender, Recipient, Subject, and Status columns.
Note
Messages take 2-5 minutes to appear after sending. If you don't see the Message trace option, check your admin role (Global Admin, Organization Management, or View-Only Org Management required). Bookmark admin.exchange.microsoft.com/#/messagetrace for direct access.
2Trace messages with PowerShell (Get-MessageTraceV2)
Use PowerShell's Get-MessageTraceV2 cmdlet for advanced, scriptable message tracing.
Install and connect to Exchange Online PowerShell:
Install-Module -Name ExchangeOnlineManagement -Force
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.comVerify module version 3.7.0+ (required for V2 cmdlet):
Get-Module ExchangeOnlineManagement -ListAvailable | Select VersionRun a basic trace:
Get-MessageTraceV2 -SenderAddress "john@company.com" -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) | Format-Table Received, SenderAddress, RecipientAddress, Status, SubjectFilter by status:
Get-MessageTraceV2 -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) -Status Quarantined | Select Received, SenderAddress, RecipientAddress, SubjectTrace by Network Message ID:
Get-MessageTraceV2 -MessageTraceId "abc123@server.prod.protection.outlook.com" -StartDate "2026-06-01" -EndDate "2026-06-15"Export results to CSV:
Get-MessageTraceV2 -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) -Status Delivered | Export-Csv -Path "C:\Reports\EmailTrace.csv" -NoTypeInformationConnect-ExchangeOnline
Get-MessageTraceV2 -SenderAddress "user@domain.com" -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date)Expected result: PowerShell returns message objects with Received, SenderAddress, RecipientAddress, Subject, Status, and MessageTraceId properties.
Note
For queries with more than 1,000 recipients, include the MessageTraceId parameter. The V2 cmdlet shows the latest status (released quarantine shows Delivered). For data beyond 90 days, use Start-HistoricalSearch with -ReportType MessageTraceDetail.
3Interpret results and troubleshoot delivery issues
Interpret trace results and resolve common email delivery problems.
Reading delivery events: Click a message in the EAC trace results to see its event timeline. Key events:
- Receive → message accepted by Exchange Online
- Send → forwarded to next hop
- Deliver → placed in recipient mailbox
- Fail → delivery error (check error code)
- Expand → distribution list expanded
Common delivery statuses:
- Delivered: successfully in mailbox
- Quarantined: held by anti-malware, anti-spam, or Safe Attachments
- Filtered as spam: blocked by content filter
- Failed: permanent delivery failure (check NDR error code)
- Getting status: still processing (retry in a few minutes)
PowerShell: get detailed events for a specific message:
Get-MessageTraceDetailV2 -MessageTraceId "abc123" -RecipientAddress "user@domain.com" -StartDate "2026-06-01" -EndDate "2026-06-15" | Format-Table Date, Event, Action, DetailFor historical data beyond 90 days:
Start-HistoricalSearch -ReportTitle "Q1_Audit" -StartDate "2026-01-01" -EndDate "2026-03-31" -ReportType MessageTraceDetail -NotifyAddress "admin@company.com"
Get-HistoricalSearch | Select ReportTitle, Status, RowsExpected result: You can identify why a message was delayed, quarantined, or failed by examining events and status codes.
Note
Time zone matters: EAC uses UTC by default. Adjust your date range if your local time differs. If a user claims an email is missing but the trace shows Delivered, check Junk Email folder, Focused Inbox, or Outlook rules that may have moved it.
Troubleshooting
Message trace returns no results for a known sent email
Note
Cause: Time zone mismatch (EAC uses UTC), messages still indexing (2-5 min delay), or date range doesn't cover the send time.
Wait 5 minutes and retry. Adjust the date range to account for UTC. Verify the sender/recipient address is correct (check for typos or aliases). Try broadening the search: remove the subject filter and extend the date range by one extra day in each direction.
Trace results are incomplete or truncated
Warning
Cause: The EAC has a 10,000 result limit per trace. PowerShell queries with more than 1,000 recipients require the MessageTraceId parameter.
Narrow your date range or add sender/recipient filters. For PowerShell, include the -MessageTraceId parameter when querying large distribution lists. Break large queries into smaller time windows (e.g., 7-day chunks) and combine the results.
Trace shows Delivered but user says email is missing
Note
Cause: The message was delivered but moved by an Outlook rule, Focused Inbox, or landed in Junk Email. The trace shows Delivered because Exchange placed it in the mailbox.
Ask the user to check: Junk Email folder, Focused Inbox > Other tab, Deleted Items (accidental deletion), and any Outlook rules that auto-move messages. In the EAC, check if a transport rule redirected the message. Run Get-InboxRule -Mailbox user@domain.com in PowerShell to list the user's inbox rules.
Frequently asked questions
How far back can I trace messages?
The modern message trace supports up to 90 days of history (extended from 10 days in 2024). For older data, use Start-HistoricalSearch in PowerShell, which can go further back and exports results as CSV or XML.
What's the difference between Get-MessageTrace and Get-MessageTraceV2?
Get-MessageTraceV2 (module v3.7.0+) supports 90-day history, 10,000 results, and shows the latest message status. The legacy Get-MessageTrace is limited to 10 days and shows the original status. Use V2 for new work.
Why don't I see a recently sent message?
Messages take 2-5 minutes to appear in trace results after sending. Wait a few minutes and retry. Also check that your date range includes the current time and accounts for UTC time zone differences.
What permissions do I need?
You need Global Administrator, Organization Management, or View-Only Organization Management role in Exchange Online. Regular users cannot run message traces.
How do I find quarantined or blocked emails?
Use the Status filter set to Quarantined in the EAC trace, or run Get-MessageTraceV2 -Status Quarantined in PowerShell. The detailed view shows which policy triggered the action. Note: V2 shows the latest status, so a released quarantine message shows Delivered.
Conclusion
You've learned to trace email messages in Exchange Online using both the modern EAC (Mail flow > Message trace, up to 90 days, 10,000 results) and PowerShell's Get-MessageTraceV2 cmdlet. You can interpret delivery statuses, read event timelines, export reports, and use Start-HistoricalSearch for data beyond 90 days.
Use the EAC message trace for quick lookups and PowerShell Get-MessageTraceV2 for scripted reports. Both support 90 days of history. Check Junk/Focused Inbox before escalating 'missing email' reports.
admin.exchange.microsoft.com > Mail flow > Message trace > Start a trace
