How to check and analyze the Message Trace

Modified on Fri, 13 Jan 2023 at 03:50 AM

Problem Statement:

How do I check and analyze Message Trace 


Solution:

You can check and analyze Message trace using 

  • Exchange Admin Center
  • PowerShell
  • CoreView


1. Message Trace using Exchange Admin Center:


To run a message trace, you need to be a member of one of the following role groups:

  • Global Administrator
  • Exchange Administrator

For more information, see Manage role groups in Exchange Online and Permissions in Exchange Online.


STEPS:

Open the modern EAC at https://admin.exchange.microsoft.com, expand Mail flow, and then select Message trace.

To go directly to message trace, open https://admin.exchange.microsoft.com/#/messagetrace.


For more detail information on Message Trace using Exchange Admin Center kindly refer MSDN article:

Message trace in the modern Exchange admin center in Exchange Online


2. Message Trace using PowerShell:

Use the Get-MessageTrace cmdlet to trace messages as they pass through the cloud-based organization. 

#This cmdlet is available only in the cloud-based service.
Get-MessageTrace


Example:

<# This example retrieves message trace information for messages sent by john@contoso.com between December 20, 2022 and December 30, 2022. #>

Get-MessageTrace -SenderAddress john@contoso.com -StartDate 12/20/2022 -EndDate 12/30/2022

Points to note:


  1. You can use this cmdlet to search message data for the last 10 days. If you run this cmdlet without any parameters, only data from the last 48 hours is returned.
  2. If you enter a start date that is older than 10 days, you will receive an error and the command will return no results.
  3. To search for message data that is greater than 10 days old, use the Start-HistoricalSearch and Get-HistoricalSearch cmdlets. 
  4. By default, this cmdlet returns a maximum of 1000 results, and will timeout on very large queries. If your query returns too many results, consider splitting it up using smaller StartDate and EndDate intervals.
  5. The time stamps on the output are in UTC time format. That might be different from the time format that you used for the -StartDate and the -EndDate parameters.


3. Message Trace using Coreview

  • Using CorevIew is the easiest way to Check and analyze Message Trace
  • Go to CoreView portal
  • Go to reports --> Exchange --> Message Trace

  • You can also type Trace in the Global search option to navigate to the report directly (refer below screenshot) 


  • Find all messages or find specific messages sent by senders and/or recipients within 10 days time range. Refine further by selecting custom time range or adjusting the advanced settings.


  • Use all the filter conditions like sender details and Recipient details to perform the Message Trace query.
  • Once done click on the search option to run the query.


  • You can click on the Message Trace ID arrow to see the details of the Message Trace.



Key Terminologies:

Senders: Click in this box and start typing to enter or select one or more senders from your organization.

Recipients: Click in this box and start typing to enter or select one more recipient in your organization.


Status

  • Delivered: The message was successfully delivered to the intended destination.
  • Expanded: A distribution group recipient was expanded before delivery to the individual members of the group.
  • Failed: The message wasn't delivered.
  • Pending: Delivery of the message is being attempted or reattempted.
  • Quarantined: The message was quarantined (as spam, bulk mail, or phishing). For more information, see Quarantined email messages in EOP.
  • Filtered as spam: The message was identified spam, and was rejected or blocked (not quarantined).


Note: operators will be able to see and manage Message Trace report for only mailboxes part of their V-Tenant defined scope.



Using CoreSuite you can not only manage every aspect of mailbox permissions, but you can also create, manage, monitor and delete mailbox objects and their configuration easily, always within the scope of your V-Tenant.


CoreSuite is an advanced Microsoft 365 tool offered by CoreView, used for reporting, managing, monitoring, auditing, and automating activities on your tenant to help keeping it under control. It simplify day by day activities, while ensuring a safer and more compliance management through tenant delegation, granular permission control, license optimization, workflow. 


Visit our main web site for more information.

Was this article helpful?

That’s Great!

Thank you for your feedback

Sorry! We couldn't be helpful

Thank you for your feedback

Let us know how can we improve this article!

Select atleast one of the reasons

Feedback sent

We appreciate your effort and will try to fix the article