# How do you remove a phishing email from all mailboxes in Microsoft 365?

URL: https://iblockspam.com/blog/remove-phishing-email-from-all-mailboxes-microsoft-365
Last updated: 2026-11-02
Published: 2026-11-02
Topic: Running email day to day
Author: iBlockSpam Team

> How admins remove one phishing email from every Microsoft 365 mailbox: Threat Explorer, Purview search and purge, limits, roles, and soft vs hard delete.

## Short answer

With Defender for Office 365 Plan 2, find the message in Threat Explorer and choose Take action > Move or delete > Soft deleted items. Without Plan 2, run a Purview search in Security & Compliance PowerShell (New-ComplianceSearch) and purge it with New-ComplianceSearchAction -Purge -PurgeType SoftDelete. Both need the Search and Purge role.

One phishing email rarely arrives alone. By the time someone reports it, the same message is usually sitting in dozens of inboxes, and every hour it stays there is another chance for a click. This guide shows Microsoft 365 admins how to find every copy and remove it, with the exact steps for tenants with and without Defender for Office 365 Plan 2, at the time of writing (November 2026).

## What should you do right now?

If a phishing email is live in your users' mailboxes, work in this order:

1. **Keep one copy as evidence.** Save the reported message with full headers before you delete anything. The [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) pulls out the sender, sending IP and Network Message ID.
2. **Collect indicators:** sender address, subject, sending IP, the link's domain and any attachment name.
3. **Find every recipient** with Threat Explorer or [message trace](https://iblockspam.com/blog/microsoft-365-message-trace).
4. **Soft delete every copy** with Threat Explorer (Plan 2) or Purview search and purge (any tenant).
5. **Block the sender, domain or URL** in the [Tenant Allow/Block List](https://iblockspam.com/blog/microsoft-365-tenant-allow-block-list) so new copies stop.
6. **Check who clicked or replied**, and treat anyone who entered a password as a compromised account.

The rest of this guide explains each step.

## Which removal method should you use?

The right tool depends on your license. **Defender for Office 365 Plan 2** (included in Microsoft 365 E5 and A5) gives you Threat Explorer remediation. Every other tenant uses **Microsoft Purview search and purge**, a PowerShell procedure built on eDiscovery content search.

| Method | License | How you run it | Per-mailbox limit | Best for |
|---|---|---|---|---|
| Threat Explorer **Take action** | Defender for Office 365 Plan 2 | Defender portal | No per-mailbox cap stated; up to 200,000 messages per query | Most incidents, with an audit trail in the Action center |
| Purview search and purge (PowerShell) | Any tenant with Purview eDiscovery | Security & Compliance PowerShell | 10 items per mailbox per run | Plan 1, Business Standard and E3 tenants |
| Purview purge through Microsoft Graph | Cases with eDiscovery premium features (E5) | Graph `purgeData` API | 100 items per location | Large E5 clean-ups |
| Zero-hour auto purge (ZAP) | All Exchange Online tenants | Automatic | n/a | Messages Microsoft later re-classifies |
| User deletes it | Any | Manual | n/a | One or two mailboxes |

Microsoft's own advice is direct: if you have Plan 2, use the Defender remediation procedure rather than search and purge ([Microsoft Learn](https://learn.microsoft.com/en-us/purview/edisc-search-mailbox-data)). Not sure which plan you have? If the Defender portal shows **Explorer** under **Email & collaboration**, you have Plan 2. If it shows **Real-time detections**, you have Plan 1, which can't move or delete mail. Our [Threat Explorer vs Real-time detections guide](https://iblockspam.com/blog/microsoft-365-threat-explorer-real-time-detections) explains the difference.

Don't wait for ZAP. [Zero-hour auto purge](https://iblockspam.com/blog/microsoft-365-zero-hour-auto-purge-zap) only acts if Microsoft's verdict on the message changes, and its search is limited to the last 48 hours of delivered email. A phish Microsoft still scores as clean stays put.

## How do you find every mailbox that received the phishing email?

Start from the reported copy and widen the search until you've found every variant. Attackers often rotate the sender address and subject but reuse the link domain or sending infrastructure.

- **Threat Explorer (Plan 2):** open **All email**, set the date range, and filter on one shared indicator such as sender domain, sender IP, URL domain or attachment SHA256. Check **Latest delivery location**: copies in **Inbox/folder** need action.
- **Message trace (all tenants):** search by sender and date range in the Exchange admin center to list recipients. It shows delivery, not whether the message is still in the mailbox.

Write down the exact values you'll search on. For Purview search and purge, the safest query combines the sender, the subject and a received date range. Here's an example query for a fake invoice campaign:

```
(From:billing@contoso-invoices.example) AND (Subject:"Invoice overdue") AND (Received:11/01/2026..11/02/2026)
```

Microsoft recommends narrowing the query until it returns "only the messages that you want to remove," previewing the results, and checking the estimated item count before you purge ([Microsoft Learn](https://learn.microsoft.com/en-us/purview/edisc-search-mailbox-data)).

## How do you remove it with Threat Explorer?

Threat Explorer remediation needs Defender for Office 365 Plan 2 and the **Search and Purge** role. By default that role is in the **Organization Management** and **Data Investigator** role groups in the Defender portal ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/remediate-malicious-email-delivered-office-365)).

1. In the Microsoft Defender portal, go to **Email & collaboration** > **Explorer** and open the **All email** view.
2. Filter to the campaign as described above, then select **Refresh**.
3. Select the messages. You can hand-pick up to 100, or use **Select all** for the whole query, up to 200,000 messages.
4. Choose **Take action**, then **Move or delete** > **Soft deleted items**. For messages from an internal sender, you can also select **Delete sender's copy**. Select **Next**.
5. On the **Choose target entities** page, give the remediation a clear name, such as `Phish 2026-11-02 fake invoice`. Select **Next**, review, then select **Submit**.
6. Track it in **Actions & submissions** > **Action center** > **History**. Each message is reported as successful, failed or already in destination.

If you don't have delete rights, use **Propose remediation** instead. The action waits on the **Pending** tab of the Action center until someone with the Search and Purge role approves it.

Microsoft lists a few throttling limits to know about. No more than 50 remediations can run at once, and for best results Microsoft suggests batches of 50,000 messages or fewer. Messages in on-premises or external mailboxes can't be remediated, and by default users can't reach copies quarantined for malicious content.

## How do you remove it with Purview search and purge in PowerShell?

Purview search and purge works in any Exchange Online tenant. You need two roles in the **Microsoft Purview portal**: **eDiscovery Manager** (or the **Compliance Search** role) to search, and **Search And Purge** to delete. Microsoft warns that the Exchange Online **Organization Management** group isn't the same as Purview's and doesn't grant purge rights.

At the time of writing (November 2026), Microsoft also requires Exchange Online PowerShell module version 3.9.0 or later and a session opened with the `EnableSearchOnlySession` switch ([Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/new-compliancesearchaction)).

1. **Connect to Security & Compliance PowerShell:**

   ```powershell
   Connect-IPPSSession -EnableSearchOnlySession
   ```

2. **Create and start the search** across all mailboxes:

   ```powershell
   $Search = New-ComplianceSearch -Name "Phish 2026-11-02" -ExchangeLocation All -ContentMatchQuery '(From:billing@contoso-invoices.example) AND (Subject:"Invoice overdue") AND (Received:11/01/2026..11/02/2026)'
   Start-ComplianceSearch -Identity $Search.Identity
   ```

3. **Check the results** before deleting anything. Wait until the status is `Completed`, then compare the number of items found with what you expected:

   ```powershell
   Get-ComplianceSearch -Identity "Phish 2026-11-02" | Format-List
   ```

4. **Soft delete the matches:**

   ```powershell
   New-ComplianceSearchAction -SearchName "Phish 2026-11-02" -Purge -PurgeType SoftDelete
   ```

   The cmdlet pauses for confirmation. Add `-Confirm:$false` only in scripts you've tested.

5. **Check progress.** The action is named `<search name>_Purge`:

   ```powershell
   Get-ComplianceSearchAction -Identity "Phish 2026-11-02_Purge" | Format-List
   ```

Two warnings from Microsoft are worth repeating. First, if you built or checked the search in the Purview portal, rerun it in PowerShell and confirm the results match before you purge, because a portal search shows an item count of 0 to the cmdlet. Second, for cases without eDiscovery premium features, don't search by identifiers such as message ID, sensitivity label or sensitive information type: Microsoft says those conditions aren't supported for search and delete and can cause "unexpected data loss" ([Microsoft Learn](https://learn.microsoft.com/en-us/purview/edisc-search-mailbox-data)).

Older tutorials use `Search-Mailbox -DeleteContent`. That's not the current Exchange Online procedure; compliance search and purge is.

### What are the search and purge limits?

These limits are from [Microsoft Learn](https://learn.microsoft.com/en-us/purview/edisc-search-mailbox-data) and the [New-ComplianceSearchAction reference](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/new-compliancesearchaction):

| Limit | Value |
|---|---|
| Items removed per mailbox per purge (PowerShell) | 10 |
| Items removed per location per purge (Graph, premium cases) | 100 |
| Mailboxes in one search used for a purge | 50,000 (primary and archive count separately) |
| Unindexed items | Not deleted |
| Teams chats, SharePoint and OneDrive | Not deleted |
| Mailboxes on litigation hold or retention | Items are kept until the hold ends |

The 10-item limit rarely matters for a phishing campaign, where each user usually has one copy. If a mailbox has more, run the purge again. Microsoft "strongly" recommends against looping the command to work around the limit and points large clean-ups to Defender remediation or ZAP instead. For more than 50,000 mailboxes, Microsoft suggests temporary search permissions filters that split mailboxes into smaller groups.

## Should you soft delete or hard delete a phishing email?

Soft delete is the right default. It takes the message out of the user's view immediately but leaves you a way back if you matched the wrong message.

| | Soft delete | Hard delete |
|---|---|---|
| Where the message goes | Recoverable Items\Deletions | Recoverable Items\Purges |
| Can the user recover it? | Yes, until the deleted item retention period ends | No |
| Can an admin recover it? | Yes | Yes, through single item recovery during the retention period |
| When to use it | Almost every phishing clean-up | Malware or sensitive data you're certain about |

Single item recovery is turned on by default for new Microsoft 365 mailboxes, so even a hard delete isn't instantly permanent. If a mailbox is on hold, deleted items are preserved until the hold expires.

## What if users already clicked the link or replied?

Removing the email doesn't undo a click. Before you close the incident:

- **Find the clicks.** In Plan 2, the **URL clicks** view in Threat Explorer shows who clicked and whether Safe Links blocked them. Otherwise, ask recipients directly.
- **Treat anyone who entered a password as compromised.** Follow the [Microsoft 365 compromised account remediation steps](https://iblockspam.com/blog/microsoft-365-compromised-account-remediation): disable or reset the account, revoke sessions and check for new MFA methods and inbox rules.
- **Check replies.** Search Sent Items for replies to the attacker's address, especially anything with payment details or attachments.
- **Tell users what happened**, with a short description of the email. Our guide on [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link) is written for them.

## How do you stop the same phishing email coming back?

Deleting delivered copies doesn't stop the next wave. After the clean-up:

1. **Submit the message to Microsoft** as phishing from the Submissions page, so its filters learn from it.
2. **Add block entries** in the Tenant Allow/Block List for the sender, domain, URL or file hash.
3. **Review why it got through.** Check the message's `X-Forefront-Antispam-Report` header with the [Microsoft 365 Spam Header Decoder](https://iblockspam.com/tools/microsoft-365-header-analyzer), then tighten the relevant policy. Our guide on [stopping phishing emails in Microsoft 365](https://iblockspam.com/blog/stop-phishing-emails-microsoft-365) covers the settings.
4. **Make reporting easy.** The built-in Report button sends future reports straight to your team; see [Microsoft 365 user reported settings](https://iblockspam.com/blog/microsoft-365-report-message-user-reported-settings).

An MX-level filtering gateway in front of Microsoft 365 adds an extra layer that catches many campaigns before they reach a mailbox at all. Our [Microsoft 365 platform page](https://iblockspam.com/platforms/microsoft-365) explains how that works with Exchange Online.

## Next steps

- Give two responders the Search and Purge role now, in both the Defender and Purview portals, so nobody is waiting on permissions during an incident.
- Update the Exchange Online PowerShell module to 3.9.0 or later on the machines your admins use.
- Practice a soft delete on a harmless test message sent to two mailboxes, so the commands are familiar.
- If your domain is being imitated in these campaigns, check for registered look-alikes with the free [Lookalike Domain Generator](https://iblockspam.com/tools/lookalike-domain-generator).
- To reduce how many phishing emails reach mailboxes in the first place, see how iBlockSpam filters inbound mail at the MX for [Microsoft 365 tenants](https://iblockspam.com/platforms/microsoft-365).

Browse our other [email operations guides](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### Can I delete an email from all Microsoft 365 mailboxes without Defender for Office 365 Plan 2?

Yes. Any tenant can use Microsoft Purview search and purge in Security & Compliance PowerShell: create a search with New-ComplianceSearch, run it, then use New-ComplianceSearchAction -Purge. It removes up to 10 matching items per mailbox per run and works on up to 50,000 mailboxes per search. Plan 2 adds point-and-click removal in Threat Explorer.

### Why does New-ComplianceSearchAction say a parameter cannot be found that matches parameter name Purge?

Your account doesn't have the Search And Purge role in the Microsoft Purview portal. Microsoft notes that the Organization Management role group in Exchange Online is separate from the one in Purview and doesn't grant purge rights. Add yourself to Purview's Organization Management group or a role group with Search And Purge, then reconnect.

### Can users get a purged phishing email back?

After a soft delete, yes: the message moves to the Recoverable Items Deletions folder and the user can recover it until the deleted item retention period ends. After a hard delete, the user can't see or recover it, though admins can still recover it through single item recovery during the retention period.

### Does purging a phishing email also remove it from Teams or OneDrive?

No. Microsoft's search and purge procedure only deletes items in Exchange Online mailboxes and public folders. It doesn't delete Teams chat messages or SharePoint and OneDrive content, which have separate procedures. Threat Explorer remediation also acts only on email in cloud mailboxes.

### How long does a Threat Explorer soft delete take to finish?

Microsoft doesn't give a typical time. It says remediations stuck in progress are likely due to system delays and can take up to a few hours, and suggests retrying if counts don't add up. Track progress in the Action center History tab, where each message shows as successful, failed or already in destination.

## Sources

- [Microsoft Learn: Remediate malicious email delivered in Office 365](https://learn.microsoft.com/en-us/defender-office-365/remediate-malicious-email-delivered-office-365)
- [Microsoft Learn: Find and delete email messages in eDiscovery](https://learn.microsoft.com/en-us/purview/edisc-search-mailbox-data)
- [Microsoft Learn: New-ComplianceSearchAction](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/new-compliancesearchaction)
- [Microsoft Learn: Threat hunting in Threat Explorer for Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-threat-hunting)
- [Microsoft Learn: Zero-hour auto purge (ZAP) in Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/zero-hour-auto-purge)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Microsoft 365 Spam Header Decoder](https://iblockspam.com/tools/microsoft-365-header-analyzer): Paste Microsoft 365 headers to decode SFV, CAT, SCL, BCL and compauth reason codes in plain English — runs in your browser.
- [Lookalike Domain Generator](https://iblockspam.com/tools/lookalike-domain-generator): See typo, look-alike character and other-ending versions of your domain, and which of them exist in DNS or have a mail server.

---

Source: iBlockSpam, https://iblockspam.com/blog/remove-phishing-email-from-all-mailboxes-microsoft-365 (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt