{"id":607,"date":"2022-10-18T15:44:17","date_gmt":"2022-10-18T22:44:17","guid":{"rendered":"https:\/\/blog.iabsolute.com\/?p=607"},"modified":"2022-10-18T15:44:17","modified_gmt":"2022-10-18T22:44:17","slug":"track-email-messages-with-office-365-mail-trace","status":"publish","type":"post","link":"https:\/\/blog.iabsolute.com\/?p=607","title":{"rendered":"Track Email Messages With Office 365 Mail Trace"},"content":{"rendered":"\n<p>On-prem Exchange did not allow message tracking via the Exchange admin center. In Office 365,&nbsp;EAC&nbsp;enables message tracing and offers quite a comfortable experience. Although usually I prefer administrating Exchange Online with PowerShell, I must say that in this case,&nbsp;EAC&nbsp;seems to do its job very efficiently.<\/p>\n\n\n\n<p><strong>Note:<\/strong>&nbsp;It was also possible to perform a message trace in the Microsoft 365 Security and Compliance center. However, Microsoft announced this method is blocked after November 2021 (it was rescheduled from October 5, 2021).<\/p>\n\n\n\n<p>To access Message trace, you can either use&nbsp;<a href=\"https:\/\/admin.exchange.microsoft.com\/#\/messagetrace\" target=\"_blank\" rel=\"noreferrer noopener\">this link<\/a>, or go to&nbsp;<strong>Exchange admin center<\/strong>&nbsp;&gt;&nbsp;<strong>Mail flow<\/strong>&nbsp;&gt;&nbsp;<strong>Message trace<\/strong>:<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/www.codetwo.com\/admins-blog\/wp-content\/uploads\/2017\/11\/Message-trace-in-M365.png\" alt=\"Message trace in M365\" class=\"wp-image-5720\"\/><\/figure>\n<\/div>\n\n\n<p>Now, you can either click&nbsp;<strong>Start a trace<\/strong>&nbsp;to specify your search criteria from scratch or use one of the templates available below. Templates open the same&nbsp;<strong>New message trace<\/strong>&nbsp;window, but they have some fields predefined.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/www.codetwo.com\/admins-blog\/wp-content\/uploads\/2017\/11\/Message-trace-options.png\" alt=\"Message trace options\" class=\"wp-image-5721\"\/><\/figure>\n<\/div>\n\n\n<p>This window lets you define the criteria for the reports you want to generate. You can define the following criteria:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Senders \u2013 defines senders the tool will incorporate in the reports. The field accepts wildcards, which allows you to easily limit results for a certain domain.<\/li><li>Recipients \u2013 similar to the&nbsp;<strong>Senders<\/strong>&nbsp;fields, it accepts wildcards.<\/li><li>Time range \u2013 can be configured by using a slider or entering a custom time range.<\/li><\/ul>\n\n\n\n<p>Additionally, you can click&nbsp;<strong>Detailed search options<\/strong>&nbsp;to make your query even more granular:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Delivery status \u2013 lets you search only for the emails which were, for example, successfully delivered or quarantined. For a list of all available statuses and what they mean, see&nbsp;<a href=\"https:\/\/www.codetwo.com\/admins-blog\/message-tracking-office-365\/#delivery-status\">this section<\/a>&nbsp;of the article.<\/li><li>Message ID \u2013 lets you find a specific message. Message ID can be found in the email\u2019s headers.<\/li><li>Direction \u2013 lets you choose from&nbsp;<strong>Inbound<\/strong>,&nbsp;<strong>Outbound<\/strong>&nbsp;and&nbsp;<strong>All<\/strong>.<\/li><li>Original client IP address.<\/li><\/ul>\n\n\n\n<p>Remember, tracing messages older than ten days is treated like a Historical Search, no matter if you use&nbsp;EAC&nbsp;or&nbsp;PS. It means that you will have to wait for your reports either way. Generating the reports might take up to a few hours. If you trace messages from the past ten days, clicking search will open a window with the results:<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/www.codetwo.com\/admins-blog\/wp-content\/uploads\/2017\/11\/Message-trace-results.png\" alt=\"Message trace results\" class=\"wp-image-5722\"\/><\/figure>\n<\/div>\n\n\n<p>If you want to see details for a chosen email, click it, and a new window will open:<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/www.codetwo.com\/admins-blog\/wp-content\/uploads\/2017\/11\/Message-tracing-details.png\" alt=\"Message trace result details\" class=\"wp-image-2866\"\/><\/figure>\n<\/div>\n\n\n<p>In this window, you can check what happened to the message. In the example above, you can see that the delivery failed because of a transport rule. You can easily check which transport rule caused the problem and fix the issue.<\/p>\n\n\n\n<p>Back in the main message trace window, you can go to&nbsp;<strong>Downloadable reports<\/strong>&nbsp;tab to see a list of the historical searches and extended reports you have requested. If you have started a Historical Search using PowerShell and failed to specify the&nbsp;<strong>\u2013NotifyAddress<\/strong>&nbsp;parameter, this is the only place to learn if the message trace is finished and to download the csv file with your report.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/www.codetwo.com\/admins-blog\/wp-content\/uploads\/2017\/11\/Downloadable-reports.png\" alt=\"Downloadable message trace reports\" class=\"wp-image-5723\"\/><\/figure>\n<\/div>\n\n\n<p>The downloaded report is in the CSV format.&nbsp;Each row displays information about a single email. To make your report more readable, you&nbsp;can open it in Excel or another spreadsheet.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>On-prem Exchange did not allow message tracking via the Exchange admin center. In Office 365,&nbsp;EAC&nbsp;enables message tracing and offers quite a comfortable experience. Although usually I prefer administrating Exchange Online with PowerShell, I must say that in this case,&nbsp;EAC&nbsp;seems to &hellip; <a href=\"https:\/\/blog.iabsolute.com\/?p=607\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[35],"tags":[],"class_list":["post-607","post","type-post","status-publish","format-standard","hentry","category-35"],"_links":{"self":[{"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=\/wp\/v2\/posts\/607","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=607"}],"version-history":[{"count":1,"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=\/wp\/v2\/posts\/607\/revisions"}],"predecessor-version":[{"id":608,"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=\/wp\/v2\/posts\/607\/revisions\/608"}],"wp:attachment":[{"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=607"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=607"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.iabsolute.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=607"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}