Source review: September 29, 2026. Tenant validation pending.
Page tools and document details
Start with one exact message
Repeated resends can create duplicates and hide the original problem. Trace the original message first.
Use authorized Exchange access
The tenant needs Exchange Online, and the operator needs an authorized Exchange role with message-trace permissions. Exchange Administrator is a supported option; do not use Global Administrator merely for convenience. A normal mailbox user supplies evidence to the helpdesk.
The current EAC can search up to 90 days of trace history. Use a narrow interval of at most 10 days for a summary query; broader reports are downloadable and can take longer. A recent status can lag delivery by several minutes. Record the queried period and recheck when appropriate.
A hybrid route or third-party gateway can require evidence from another system. A trace gap in this tenant does not prove the sender never sent the message.
Trace the message, then read its events
- Open Exchange admin center → Mail flow → Message trace → Start a trace. Verify the tenant.
- Set the exact sender, recipient and a bounded time range with the correct time zone. Start with all delivery statuses. Use the full Internet Message-ID, including angle brackets when present, to narrow a known message.
- Open the matching result and its message events. Check recipient expansion, redirection and the final destination, not only the top-level status.
- Save the query filters, result and UTC investigation time. Preserve the relevant report in approved storage; it can contain personal addresses and subjects.
| Result | Next action |
|---|---|
| No matching result | Verify addresses, time zone, aliases and message ID; widen the interval carefully. Confirm the source system submitted to this route. Preserve the NDR or upstream trace. |
| Pending or deferred | Read the latest event and retry reason. Check service health and the identified destination/connector. Recheck the same message before resending. |
| Failed or filtered | Use the exact SMTP/error or filtering explanation to choose the correction. Do not assume DNS is responsible for every failure. |
| Quarantined | An authorized operator reviews the message, detection and release eligibility. Do not release malware or broadly allowlist a sender to test delivery. |
| Delivered | Inspect event detail, recipient and folder/rule behavior. Delivery does not prove that the person saw it in the Inbox or read it. |
Read-only PowerShell trace for one message
Use an existing, authorized Exchange Online PowerShell session in the correct tenant. The ExchangeOnlineManagement module must be 3.7.0 or later for the V2 trace commands. This example neither connects nor changes tenant configuration. It prompts for the exact sender, recipient, Message-ID and UTC window.
V2 can query retained data from the last 90 days, at most 10 days per request. It returns 1,000 rows by default and at most 5,000. The script requests 5,000 and stops before interpreting a result at the cap. Narrow the interval or use the documented continuation procedure. -Page is not V2 pagination.
Keep the full Internet Message-ID including angle brackets if present. It is different from the service-generated MessageTraceId used for detail queries. The original query’s dates must also be passed to the detail command, otherwise it defaults to a shorter recent window.
# Read only. Use an existing authorized Exchange Online session in the correct tenant.
# Requires ExchangeOnlineManagement 3.7.0 or later. Does not connect or change settings.
$ErrorActionPreference = 'Stop'
Get-Command Get-MessageTraceV2, Get-MessageTraceDetailV2 -ErrorAction Stop | Out-Null
$sender = (Read-Host 'Exact sender address').Trim()
$recipient = (Read-Host 'Exact recipient address').Trim()
$messageId = (Read-Host 'Full Internet Message-ID, including angle brackets if present').Trim()
if (-not $sender -or -not $recipient -or -not $messageId) { throw 'All message identifiers are required.' }
$startInput = Read-Host 'Start with UTC offset, e.g. 2026-09-29T08:00:00Z'
$endInput = Read-Host 'End with UTC offset, e.g. 2026-09-29T10:00:00Z'
if ($startInput -notmatch 'T.*(Z|[+-][0-9]{2}:[0-9]{2})$' -or $endInput -notmatch 'T.*(Z|[+-][0-9]{2}:[0-9]{2})$') {
throw 'Both timestamps need Z or an explicit UTC offset.'
}
$start = [datetimeoffset]::Parse($startInput, [cultureinfo]::InvariantCulture).UtcDateTime
$end = [datetimeoffset]::Parse($endInput, [cultureinfo]::InvariantCulture).UtcDateTime
if ($end -le $start -or ($end - $start).TotalDays -gt 10) { throw 'Use a positive interval no longer than 10 days.' }
if ($start -lt [datetime]::UtcNow.AddDays(-90) -or $end -gt [datetime]::UtcNow) { throw 'Choose a past interval within the last 90 days.' }
$trace = @(Get-MessageTraceV2 -SenderAddress $sender -RecipientAddress $recipient -MessageId $messageId -StartDate $start -EndDate $end -ResultSize 5000)
if ($trace.Count -ge 5000) { throw 'Result cap reached. Narrow the query before interpreting the results.' }
$trace | Format-List Received,SenderAddress,RecipientAddress,Subject,Status,MessageId,MessageTraceId
if ($trace.Count -eq 0) { Write-Warning 'No match in this query. Recheck identifiers, route, timing and coverage.' }
foreach ($row in $trace) {
Get-MessageTraceDetailV2 -MessageTraceId $row.MessageTraceId -RecipientAddress $row.RecipientAddress -StartDate $start -EndDate $end |
Format-List *
}This example is source-reviewed and tested with synthetic command stubs. It has not been executed against a customer tenant.
Get-MessageTraceV2 · Get-MessageTraceDetailV2 · Microsoft: EAC message trace
Correct the cause supported by the trace
For a wrong address or recipient configuration, have its owner correct that specific setting. For a client-only symptom, retain the cloud copy and investigate the affected client's account, views and synchronization.
For a filtering result, have the security owner review the detection and use the appropriate false-positive or release workflow. For a connector, rule or DNS problem, preserve the prior configuration and make a scoped change with the service owner. Do not add a tenant-wide bypass.
If a rule is named, compare its current settings with the settings at the message's time. A rule may have changed since the trace event. Record that uncertainty before attributing the original action to today's configuration.
Unexpected forwarding or a rule created without authorization can be an incident. Preserve it and use Compromised Account rather than simply deleting the evidence.
Follow the transport event to its destination
RECEIVE means the service accepted the message. DELIVER records mailbox delivery. SEND records a handoff by the service, not proof that an external recipient read or received it in their Inbox. For an external handoff, preserve the destination and response, then request the next system’s trace.
EXPAND concerns distribution-group members. Follow the intended recipient’s resulting path. DEFER means a delayed attempt, so use the recorded reason and subsequent events. FAIL needs its actual SMTP response or NDR, not a guessed DNS correction.
For Delivered but missing, check Outlook on the web for the exact message, including Junk, Deleted Items, archive and inbox rules. Also check forwarding, quarantine or a later security action when the evidence points there. Example: a mailbox delivery followed by a rule moving the item is a different problem from failure at an external gateway.
Check the original and one controlled test
If the scoped change causes a regression, its authorized owner restores the saved configuration and checks the same route again. Escalate with trace/NDR evidence if another service owns the failure or the cause remains unknown.
Prepare the mail-flow handoff
Problem: missing / delayed / failed / client only Direction and affected recipient scope: Original send time and UTC offset: Message-ID and NDR preserved internally: Trace interval, status and relevant event: Cloud mailbox / upstream system checks: Scoped change and test result: Evidence gap / next owner:
Request mail-flow support with a redacted summary. Agree a secure channel before sharing headers, message bodies or trace exports.