Recall an Email from User as an Admin

NOTE this only recalls emails within the tenant, from mailboxes where it has not been read. It is not possible to do this process through a Microsoft admin centre.

- Ensure that your Microsoft Admin profile is elevated to Global Administrator.

- Open Powershell on your desktop as an Administrator.

- There is a module that must be installed to do this process. To install it run
Install-Module -Name ExchangeOnlineManagement -Force

- Run
Connect-IPPSSession -EnableSearchOnlySession

- This should open a Microsoft login window. Log in using your Microsoft account.

- To set the query, run
New-ComplianceSearch -Name “Query Name” -ExchangeLocation All -ContentMatchQuery ‘MessageId: “<MessageID>”’

 Where the Query Name is identifiable to this instance, and the Message ID has been specified from the email ( you can find this in the email properties either from a receiver or the sender).

- To start the query, run
Start-ComplianceSearch -Identity “Query Name”

- To view the status of the query, run
Get-ComplianceSearch -Identity “Query Name”

This will take some time, use the same line to check if it is complete.

- To perform the recall, run
New-ComplianceSearchAction -SearchName “QueryName” -Purge -PurgeType HardDelete

- This will ensure the email is unrecoverable. To allow it to be recoverable, change HardDelete to SoftDelete.

- Powershell will ask if you are sure you want to complete the action, enter A for Yes to All.

- To check the status of the Action, run
Get-ComplianceSearchAction -Identity “QueryName_Purge” -Details

Once this shows as Completed, the recall has finished running.