How do you remove a phishing email from all mailboxes in Microsoft 365?

One phishing email rarely arrives alone. By the time someone reports it, the same message is usually sitting in dozens of inboxes, and every hour it stays there is another chance for a click. This guide shows Microsoft 365 admins how to find every copy and remove it, with the exact steps for tenants with and without Defender for Office 365 Plan 2, at the time of writing (November 2026).

What should you do right now?

If a phishing email is live in your users' mailboxes, work in this order:

1. Keep one copy as evidence. Save the reported message with full headers before you delete anything. The Email Header Analyzer pulls out the sender, sending IP and Network Message ID.
2. Collect indicators: sender address, subject, sending IP, the link's domain and any attachment name.
3. Find every recipient with Threat Explorer or message trace.
4. Soft delete every copy with Threat Explorer (Plan 2) or Purview search and purge (any tenant).
5. Block the sender, domain or URL in the Tenant Allow/Block List so new copies stop.
6. Check who clicked or replied, and treat anyone who entered a password as a compromised account.

The rest of this guide explains each step.

Which removal method should you use?

The right tool depends on your license. Defender for Office 365 Plan 2 (included in Microsoft 365 E5 and A5) gives you Threat Explorer remediation. Every other tenant uses Microsoft Purview search and purge, a PowerShell procedure built on eDiscovery content search.

Microsoft's own advice is direct: if you have Plan 2, use the Defender remediation procedure rather than search and purge (Microsoft Learn). Not sure which plan you have? If the Defender portal shows Explorer under Email & collaboration, you have Plan 2. If it shows Real-time detections, you have Plan 1, which can't move or delete mail. Our Threat Explorer vs Real-time detections guide explains the difference.

Don't wait for ZAP. Zero-hour auto purge only acts if Microsoft's verdict on the message changes, and its search is limited to the last 48 hours of delivered email. A phish Microsoft still scores as clean stays put.

How do you find every mailbox that received the phishing email?

Start from the reported copy and widen the search until you've found every variant. Attackers often rotate the sender address and subject but reuse the link domain or sending infrastructure.

• Threat Explorer (Plan 2): open All email, set the date range, and filter on one shared indicator such as sender domain, sender IP, URL domain or attachment SHA256. Check Latest delivery location: copies in Inbox/folder need action.
• Message trace (all tenants): search by sender and date range in the Exchange admin center to list recipients. It shows delivery, not whether the message is still in the mailbox.

Write down the exact values you'll search on. For Purview search and purge, the safest query combines the sender, the subject and a received date range. Here's an example query for a fake invoice campaign:

(From:billing@contoso-invoices.example) AND (Subject:"Invoice overdue") AND (Received:11/01/2026..11/02/2026)

Microsoft recommends narrowing the query until it returns "only the messages that you want to remove," previewing the results, and checking the estimated item count before you purge (Microsoft Learn).

How do you remove it with Threat Explorer?

Threat Explorer remediation needs Defender for Office 365 Plan 2 and the Search and Purge role. By default that role is in the Organization Management and Data Investigator role groups in the Defender portal (Microsoft Learn).

1. In the Microsoft Defender portal, go to Email & collaboration > Explorer and open the All email view.
2. Filter to the campaign as described above, then select Refresh.
3. Select the messages. You can hand-pick up to 100, or use Select all for the whole query, up to 200,000 messages.
4. Choose Take action, then Move or delete > Soft deleted items. For messages from an internal sender, you can also select Delete sender's copy. Select Next.
5. On the Choose target entities page, give the remediation a clear name, such as Phish 2026-11-02 fake invoice. Select Next, review, then select Submit.
6. Track it in Actions & submissions > Action center > History. Each message is reported as successful, failed or already in destination.

If you don't have delete rights, use Propose remediation instead. The action waits on the Pending tab of the Action center until someone with the Search and Purge role approves it.

Microsoft lists a few throttling limits to know about. No more than 50 remediations can run at once, and for best results Microsoft suggests batches of 50,000 messages or fewer. Messages in on-premises or external mailboxes can't be remediated, and by default users can't reach copies quarantined for malicious content.

How do you remove it with Purview search and purge in PowerShell?

Purview search and purge works in any Exchange Online tenant. You need two roles in the Microsoft Purview portal: eDiscovery Manager (or the Compliance Search role) to search, and Search And Purge to delete. Microsoft warns that the Exchange Online Organization Management group isn't the same as Purview's and doesn't grant purge rights.

At the time of writing (November 2026), Microsoft also requires Exchange Online PowerShell module version 3.9.0 or later and a session opened with the EnableSearchOnlySession switch (Microsoft Learn).

1. Connect to Security & Compliance PowerShell:

   Connect-IPPSSession -EnableSearchOnlySession
   

2. Create and start the search across all mailboxes:

   $Search = New-ComplianceSearch -Name "Phish 2026-11-02" -ExchangeLocation All -ContentMatchQuery '(From:billing@contoso-invoices.example) AND (Subject:"Invoice overdue") AND (Received:11/01/2026..11/02/2026)'
   Start-ComplianceSearch -Identity $Search.Identity
   

3. Check the results before deleting anything. Wait until the status is Completed, then compare the number of items found with what you expected:

   Get-ComplianceSearch -Identity "Phish 2026-11-02" | Format-List
   

4. Soft delete the matches:

   New-ComplianceSearchAction -SearchName "Phish 2026-11-02" -Purge -PurgeType SoftDelete
   

   The cmdlet pauses for confirmation. Add -Confirm:$false only in scripts you've tested.

5. Check progress. The action is named <search name>_Purge:

   Get-ComplianceSearchAction -Identity "Phish 2026-11-02_Purge" | Format-List
   

Two warnings from Microsoft are worth repeating. First, if you built or checked the search in the Purview portal, rerun it in PowerShell and confirm the results match before you purge, because a portal search shows an item count of 0 to the cmdlet. Second, for cases without eDiscovery premium features, don't search by identifiers such as message ID, sensitivity label or sensitive information type: Microsoft says those conditions aren't supported for search and delete and can cause "unexpected data loss" (Microsoft Learn).

Older tutorials use Search-Mailbox -DeleteContent. That's not the current Exchange Online procedure; compliance search and purge is.

What are the search and purge limits?

These limits are from Microsoft Learn and the New-ComplianceSearchAction reference:

The 10-item limit rarely matters for a phishing campaign, where each user usually has one copy. If a mailbox has more, run the purge again. Microsoft "strongly" recommends against looping the command to work around the limit and points large clean-ups to Defender remediation or ZAP instead. For more than 50,000 mailboxes, Microsoft suggests temporary search permissions filters that split mailboxes into smaller groups.

Should you soft delete or hard delete a phishing email?

Soft delete is the right default. It takes the message out of the user's view immediately but leaves you a way back if you matched the wrong message.

Single item recovery is turned on by default for new Microsoft 365 mailboxes, so even a hard delete isn't instantly permanent. If a mailbox is on hold, deleted items are preserved until the hold expires.

What if users already clicked the link or replied?

Removing the email doesn't undo a click. Before you close the incident:

• Find the clicks. In Plan 2, the URL clicks view in Threat Explorer shows who clicked and whether Safe Links blocked them. Otherwise, ask recipients directly.
• Treat anyone who entered a password as compromised. Follow the Microsoft 365 compromised account remediation steps: disable or reset the account, revoke sessions and check for new MFA methods and inbox rules.
• Check replies. Search Sent Items for replies to the attacker's address, especially anything with payment details or attachments.
• Tell users what happened, with a short description of the email. Our guide on what to do after clicking a phishing link is written for them.

How do you stop the same phishing email coming back?

Deleting delivered copies doesn't stop the next wave. After the clean-up:

1. Submit the message to Microsoft as phishing from the Submissions page, so its filters learn from it.
2. Add block entries in the Tenant Allow/Block List for the sender, domain, URL or file hash.
3. Review why it got through. Check the message's X-Forefront-Antispam-Report header with the Microsoft 365 Spam Header Decoder, then tighten the relevant policy. Our guide on stopping phishing emails in Microsoft 365 covers the settings.
4. Make reporting easy. The built-in Report button sends future reports straight to your team; see Microsoft 365 user reported settings.

An MX-level filtering gateway in front of Microsoft 365 adds an extra layer that catches many campaigns before they reach a mailbox at all. Our Microsoft 365 platform page explains how that works with Exchange Online.

Next steps

• Give two responders the Search and Purge role now, in both the Defender and Purview portals, so nobody is waiting on permissions during an incident.
• Update the Exchange Online PowerShell module to 3.9.0 or later on the machines your admins use.
• Practice a soft delete on a harmless test message sent to two mailboxes, so the commands are familiar.
• If your domain is being imitated in these campaigns, check for registered look-alikes with the free Lookalike Domain Generator.
• To reduce how many phishing emails reach mailboxes in the first place, see how iBlockSpam filters inbound mail at the MX for Microsoft 365 tenants.

Browse our other email operations guides.