Exchange Online message tracing cheat sheet
Trace a recent sender and examine the events for a specific message.
Exchange Online Get-MessageTraceV2; ExchangeOnlineManagement 3.7.0 or later.
Updated · Exchange Online · 7 min read
| Command | What it does |
|---|---|
$end = Get-Date
$start = $end.AddHours(-24) | Define a bounded search window |
Get-MessageTraceV2 -SenderAddress 'sender@example.com' -StartDate $start -EndDate $end | Find messages from a sender |
Get-MessageTraceDetailV2 -MessageTraceId '<trace-guid>' -RecipientAddress 'recipient@example.com' | Inspect events for one recipient |
Disconnect-ExchangeOnline -Confirm:$false | End the investigation session |
Walkthrough
Connect-ExchangeOnline first with message-trace RBAC rights. Substitute the example addresses. This example limits the query to the last 24 hours.
Step 1: Define a bounded search window
$end = Get-Date
$start = $end.AddHours(-24)
Use the reported delivery time and check time zones. V2 tracing supports up to 90 days of history, with at most a 10-day range per query; this example uses one day.
Step 2: Find messages from a sender
Get-MessageTraceV2 -SenderAddress 'sender@example.com' -StartDate $start -EndDate $end
Inspect recipient, received time, status and MessageTraceId. A bounded result set may need further filtering; do not infer that the first returned message is the reported one.
Step 3: Inspect events for one recipient
Get-MessageTraceDetailV2 -MessageTraceId '<trace-guid>' -RecipientAddress 'recipient@example.com'
Replace the trace GUID with MessageTraceId from the previous result. Review the event sequence and any policy or transport explanation for that exact recipient.
Step 4: End the investigation session
Disconnect-ExchangeOnline -Confirm:$false
Record only required trace identifiers and the disposition. A delivered transport status does not prove a person read the message or that a client displayed it.