How do you run a message trace in Microsoft 365?

When someone says "I never got that email", message trace is the first place to look. It shows whether Microsoft 365 received the message, what its filters did with it and where it ended up. This guide covers where to find it at the time of writing (October 2026), how to read the results, and the PowerShell cmdlets that replaced the old ones.

Where is message trace in Microsoft 365?

Message trace lives in the Exchange admin center (EAC). Go to admin.exchange.microsoft.com, then Mail flow > Message trace, or open https://admin.exchange.microsoft.com/#/messagetrace directly (Microsoft Learn).

You can also start from the Microsoft Defender portal at security.microsoft.com: go to Email & collaboration > Exchange message trace. Microsoft calls that page "a really pass through" to the EAC page (Microsoft Learn), so you end up in the same tool.

You need the right role. For the EAC, Microsoft lists the Organization Management role group in Exchange Online, or the Exchange Administrator role in Microsoft Entra ID. Microsoft advises against using Global Administrator for routine work.

The new message trace began rolling out to general availability in June 2025, and Microsoft said the old trace page and old cmdlets would start deprecating on September 1, 2025 (Microsoft Tech Community). If you have old screenshots or scripts, expect differences.

How do you run a message trace?

1. On the Message trace page, select Start a trace. The default searches all senders and recipients for the last two days.
2. In Senders and Recipients, enter addresses. External addresses work, and a single wildcard such as *@contoso.com is allowed.
3. Set the Time range. The slider covers up to 90 days, or switch to Custom time range to set a time zone and exact start and end times.
4. Optionally open Detailed search options to filter by subject, delivery status, Message ID, direction or original client IP.
5. Choose a Report type (see below) and select Search, or Next for downloadable reports.
6. Select a row in the results to open its details.

The Autosaved queries tab keeps your last 10 searches. That's handy when you're going back and forth with a user.

Which report type should you pick?

Microsoft says "you can only query 10 days' worth of data at a time" for the instant Summary report. A range even slightly over 10 days produces a downloadable report from archived data. Enhanced and Extended reports also need a sender, recipient or Message ID, and Microsoft notes that the last 24 hours of archived data "isn't typically available" in them. So for anything recent, use Summary.

How do you read message trace results?

The Summary report lists each message with Date, Sender, Recipient, Subject and Status. Dates use the time zone set in your Exchange account settings, so check it before you tell a user "it arrived at 9:14".

What do the delivery statuses mean?

Microsoft defines these statuses (Microsoft Learn):

Microsoft notes a possible "five to ten minute delay" between the actual and reported status. Pending, Quarantined and Filtered as spam can only be used as filters in searches of less than 10 days.

What are message events?

Open a row and expand Message events to see what happened step by step. The common events are Receive, Send, Deliver, Fail, Defer, Expand, Transfer, Resolved, DLP rule and Sensitivity label. Microsoft says even "an uneventful, successfully delivered message generates multiple Event entries."

Expand More information for the Message ID, the message size, From IP and To IP. From IP is the server that handed the message to Microsoft 365. If your MX points to a filtering gateway, From IP should be the gateway, not the original sender.

To follow one message across forwarding, group expansion or mail flow rules, select the round check box next to it and choose Find related. Microsoft explains that "even a single message sent between two people can generate multiple records."

What are the most common findings?

The message was delivered, but the user can't find it

Delivered with a Deliver event means it reached the mailbox. From there, Microsoft's own filters may still have sent it to Junk, or a user's inbox rule may have moved or deleted it. Check the Junk folder and the user's rules. Our guide to Microsoft 365 emails going to Junk explains how to read the verdict in the headers. If a rule moved mail the user never set up, treat it as a possible compromise and work through signs an email account is compromised.

The message was quarantined

The trace confirms it, but the quarantine is where you act. Before releasing it, check the sender, links and authentication. Our guide to releasing quarantined email in Microsoft 365 covers the steps and what users can release themselves.

The message was filtered as spam

Get the reason before you add an allow entry. An Extended report includes a custom_data field. Values starting with S:SFA come from the spam filter agent and contain the same fields as the X-Forefront-Antispam-Report header, such as SFV=SPM and SCL=9 (Microsoft Learn). Our Microsoft 365 spam headers explained guide decodes them.

Outbound mail failed

For mail your users sent, a Fail event usually comes with a bounce. Paste the error into the SMTP Error Code Lookup. If every message from one user fails with 550 5.1.8, Microsoft has restricted that account, which our guide to a Microsoft 365 user blocked from sending covers.

Nothing shows up at all

If a search with the right addresses and a wide enough time range returns nothing, Microsoft 365 probably never accepted the message. Check:

1. The address. One wrong character is enough. Paste addresses rather than typing them.
2. The time zone. Widen the range by a day either side.
3. The sender's bounce. If the sender's server was refused, they got a bounce, and it names the reason.
4. Your MX record. An MX Lookup shows where mail for your domain goes. If you use a filtering gateway, check its logs too. The message may be held there.

How do you run a message trace in PowerShell?

Use Get-MessageTraceV2 and Get-MessageTraceDetailV2. Microsoft's reference for Get-MessageTrace now says it "is replaced by the Get-MessageTraceV2 cmdlet and will eventually be deprecated" (Microsoft Learn). The V2 cmdlets need version 3.7.0 or later of the Exchange Online PowerShell module.

Connect-ExchangeOnline
Get-MessageTraceV2 -SenderAddress john@contoso.com `
  -StartDate "10/01/2026" -EndDate "10/08/2026"

To see events for a single message, pipe the result into the detail cmdlet, as Microsoft's own example does:

Get-MessageTraceV2 -MessageTraceId 2bbad36aa4674c7ba82f4b307fff549f `
  -SenderAddress john@contoso.com -StartDate "10/01/2026" -EndDate "10/03/2026" |
  Get-MessageTraceDetailV2

Key limits from the Get-MessageTraceV2 reference:

• It searches "the last 90 days", but "you can only return 10 days worth of data per query."
• With no parameters, it returns the last 48 hours only.
• It returns 1,000 results by default and 5,000 at most (-ResultSize).
• Pagination isn't supported. To get the next batch, rerun the query with -EndDate set to the last result's received time and -StartingRecipientAddress set to its recipient.
• A tenant can make at most 100 queries in a rolling 5-minute window.
• -Status accepts Delivered, Expanded, Failed, FilteredAsSpam, GettingStatus, Pending and Quarantined.

If you have old scripts that use -Page and -PageSize, rewrite them. -ResultSize replaces -PageSize.

Which IDs should you search with?

The most precise search is by ID, and there are two:

• Message ID comes from the Message-ID header. Microsoft says it stays constant for the lifetime of the message. Include the angle brackets when you search.
• Network Message ID identifies one instance of a message inside Microsoft 365. You'll find it in headers such as X-MS-Exchange-Organization-Network-Message-Id, and PowerShell accepts it as -MessageTraceId. Microsoft says the MessageTraceId is required for complete results when a message went to more than 1,000 recipients.

Ask the user to send you the headers of a related message, or paste them into the Email Header Analyzer, which runs in your browser. Our guide on how to read email headers shows where each ID lives.

Next steps

• Bookmark admin.exchange.microsoft.com/#/messagetrace and confirm your Exchange time zone setting.
• Update any scripts still using Get-MessageTrace to Get-MessageTraceV2, and remove -Page loops.
• For quarantined or spam-filtered mail, read the verdict before you add allow entries.
• If you use a filtering gateway in front of Microsoft 365, its message history is the other half of the trace. iBlockSpam keeps 30 days of message history per domain, with quarantine and digests for each user.
• Google Workspace admins have an equivalent tool, covered in Google Workspace Email Log Search.

Browse more guides on running email day to day.