Sign into Microsoft admin center and go into the purview compliancy center
Go under eDiscovery and select standard
Create a new case
Name it whatever you want
Once created, select the new case
Select the Searches tab
Create a new search
Enter a name/description (don’t use special characters)
Specify the locations you want to search for the emails
Next
Enter in the keywords that you want to search all mailboxes in the organization for. Be as specific as possible.
You can add conditions to the search, such as date, from, to, size, etc.
Review your search criteria and hit submit
Once the search is created, select the search
It will process the search and tell you when it is complete, giving you statistics of how many emails fell into your search criteria
You can review a sample of the emails pulled from the search to confirm if they are the emails you are looking for.
Once confirmed, you need to go into powershell in administrator mode
First install and import the exchangeonlinemanagement module from Microsoft
https://www.powershellgallery.com/packages/ExchangeOnlineManagement/3.1.0
run the cmd
Install-Module -Name ExchangeOnlineManagement -RequiredVersion 3.1.0
And then
Import-Module -Name ExchangeOnlineManagement
(if you have the module installed already, make sure to run Disconnect-ExchangeOnline to make sure you are not connected to another account already.)
Run the cmd
Connect-IPPSSession -UserPrincipalName <UPN>
<UPN> is your admin email address
This will pop up a window from Microsoft asking you to sign in
Enter in your admin email address and password. The window will close
Back in Powershell, we can start the purge of emails
Once you are connected to an online session,
Run the command
New-ComplianceSearchAction -SearchName <searchname> -Purge -PurgeType SoftDelete
It will ask for confirmation
Press a for accept all
The purge will begin deleting all of the emails found in the search.
You have removed the emails from all mailboxes in the organization. Good job.
Make sure to run Disconnect-ExchangeOnline before closing out of powershell to close out your connection to exchangeonline
