Microsoft 365 – Compliance Search and Email Hard Delete (Purge) via PowerShell

Microsoft 365 – Compliance Search and Email Hard Delete (Purge) via PowerShell

This article explains how to perform a Compliance Search and permanently delete (Hard Delete) emails from Microsoft 365 mailboxes using PowerShell.

Prerequisites

• ExchangeOnlineManagement Module version 3.9.0 or later
• eDiscovery / Purview required permissions
• Run Windows PowerShell as Administrator
• Close all existing PowerShell sessions

Step 1 – Connect to Microsoft Purview

Connect-IPPSSession -EnableSearchOnlySession

Sign in with administrator credentials when prompted.

Step 2 – Create Compliance Search

New-ComplianceSearch -Name "SearchName" `
-ExchangeLocation All `
-ContentMatchQuery 'Subject="Email Subject" AND Sender=email@domain.com'

Step 3 – Start Compliance Search

Start-ComplianceSearch -Identity "SearchName"

Step 4 – Check Search Status

Get-ComplianceSearch -Identity "SearchName" | Select Items, Size, Status

Status Description

• NotStarted – Search is created but not started
• InProgress – Search is running
• Completed – Search completed successfully

Step 5 – Perform Hard Delete (Purge)

Warning: Hard Delete permanently removes emails and cannot be recovered.

New-ComplianceSearchAction -SearchName "SearchName" `
-Purge `
-PurgeType HardDelete `
-Force

Step 6 – Check Purge Status

Get-ComplianceSearchAction -Identity "SearchName_Purge"

Purge Status Description

• Starting – Purge action initiated
• InProgress – Purge is running
• Completed – Emails permanently deleted

Important Notes

• Hard Delete bypasses Deleted Items and Recoverable Items
• This action cannot be undone
• Large searches may take time to complete
• Correct RBAC permissions are required
• SearchOnlySession connection is mandatory

Best Practices

• Validate search results before purge
• Use SoftDelete if permanent deletion is not required
• Execute purge during non-business hours
• Inform stakeholders before performing deletion