Microsoft 365 message trace helps you troubleshoot mail delivery by showing whether Exchange Online received, delivered, delayed or blocked an email. Open Mail flow > Message trace in the Exchange admin centre, search by sender, recipient and time, then inspect the events behind the result.
A Delivered status doesn’t establish that the recipient saw the message or that it remains in their Inbox. Start with the delivery record, then investigate the mailbox, filtering or external system indicated by the evidence.
Key takeaways
- Search the past 90 days, using a maximum 10-day window for each query.
- Start with an online Summary report; request downloadable reports when routing or client IP details are needed.
- Read message events before changing rules, releasing quarantined messages or adding exceptions.
- Treat message trace, mailbox activity and authentication records as separate evidence sources. They answer different questions.
Establish access and collect the message details
Message trace requires administrative access. Microsoft lists Global Administrator, Exchange Administrator or membership of the Organization Management role group for the Exchange admin center experience.
Avoid granting Global Administrator solely for email troubleshooting. View-Only Recipients supports viewing downloaded reports in the classic workflow, but should not be treated as general access to the new trace experience.
Collect the sender address, recipient address, approximate sending time, time zone and subject before searching. Obtain the full Message ID from the message headers where available, particularly when several messages have similar subjects.
For a rejected message, retain the non-delivery report as well. Its diagnostic information may identify the rejecting system before a wider investigation is needed.
Message trace records mail flow, not sign-in activity or every subsequent mailbox action. A trace result can explain delivery without establishing who later moved or deleted the email.
Run a Microsoft 365 message trace
Start with the narrowest reliable search: the exact sender and recipient, plus a short time window. This reduces unrelated results without relying on a subject that may have changed during a conversation.
Open the trace and set its scope
- Open the Exchange admin center using an authorised administrator account.
- Select Mail flow, then Message trace, and choose Start a trace.
- Enter the sender or recipient, select the time range and choose a Summary report.
- Run the search, select the matching result and open its details.
Check the selected time zone before interpreting timestamps. A report based on the wrong time zone can exclude the message even when the calendar date appears correct.
Use *@domain.com in Senders or Recipients to search all addresses within a domain. Narrow the date range when searching a busy supplier or customer domain.
Add detailed filters without hiding the evidence
Optional filters include Subject, Message ID, Client IP address and Delivery Status. Use a subject filter when the wording is distinctive; options include starts with, ends with and contains.
Use contains when a reply prefix or additional wording may have changed the subject. Use the Message ID when the investigation needs to distinguish one message from repeated submissions.
Leave Delivery Status unrestricted initially. Searching only for Failed messages will miss an email that was quarantined, deferred or successfully delivered elsewhere.
If nothing appears, remove optional filters and widen the time window before concluding that Exchange Online never received it.
Choose the report that answers the question
Summary reports are available almost immediately online and cover up to 10 days per query. Historical data remains searchable within the past 90 days; the 10-day query limit doesn’t mean older records have disappeared.
The report types provide different levels of detail.
| Report | Main use | Availability and limits |
|---|---|---|
| Summary | Review sender, recipient and delivery outcome online. | Almost immediate; up to 20,000 results. |
| Enhanced summary report | Export a CSV file with additional fields, including direction and original client IP address. | Can take several hours; up to 100,000 results. |
| Extended report | Examine detailed routing and message events in a CSV. | Can take several hours; up to 1,000 results. |
Start with Summary for a single missing email. Choose Extended when the online result doesn’t provide enough routing detail, rather than assuming a larger export is more informative.
Enhanced summary and Extended reports require at least a sender, recipient or Message ID. Archived reports typically exclude the most recent 24 hours. Client IP information is available only for the most recent 10 days and through those downloadable report types.
Microsoft’s message trace documentation describes the report fields and search options.
Read delivery statuses as outcomes, not complete explanations
A status identifies the recorded outcome, but the events explain how Exchange Online reached it. Inspect the result for the affected recipient because a message sent to several people can have different delivery outcomes.
Use the status to choose the next investigation.
| Status | Meaning | Next action |
|---|---|---|
| Delivered | Successfully delivered to the recipient or intended destination. | Establish where it was delivered and investigate mailbox handling. |
| Pending | Delivery is being attempted or deferred for another attempt. | Read the latest deferral event and diagnostic information. |
| Quarantined | Held as spam, bulk email or phishing. | Review the quarantine reason and applicable policy. |
| Filtered as spam | Identified as spam and blocked rather than quarantined. | Inspect filtering events before changing controls. |
| Failed | Delivery did not complete successfully. | Review the failure event and non-delivery report. |
For outbound mail, successful delivery can mean that the receiving system accepted the message. It does not establish placement in the external recipient’s Inbox.
A Delivered result narrows the investigation. It does not establish that the message is still present, visible or unread in the mailbox.
Pending also needs context. The latest event matters more than the label alone, particularly when the receiving system is temporarily refusing connections.
Use message events to identify the cause
Open the matching result and review its event sequence. Submission, transfer, delivery, deferral and filtering events can show where processing changed, including whether a transport rule or spam filter acted on the message.
When delivery succeeded but the email is missing
Establish the final destination, then inspect Junk Email, Deleted Items, inbox rules and mailbox forwarding. A clean-looking Outlook rules list does not exclude hidden rules or forwarding configured administratively.
Our guidance on Microsoft 365 forwarding rules explains the separate locations that need review. Record suspicious conditions, destinations and timestamps before removing them.
A configured forwarding rule shows what the configuration could do. The trace helps establish whether a particular message was actually forwarded. Neither establishes that an external recipient opened it.
When filtering or a rule changed delivery
Read the event description before releasing a message or creating an exception. A legitimate sender can fail authentication because of an incorrectly configured application, an unauthorised sending service or forwarding behaviour.
Review SPF, DKIM and DMARC when authentication failures explain the rejection. Authentication results identify technical outcomes; they do not establish whether the sender’s intent was legitimate.
For a missing supplier email, combine the exact recipient, supplier domain and reported sending time. A Quarantined result should lead to its filtering reason. A transport-rule event should lead to the matching rule’s conditions and actions. Document that evidence before changing either.
Use PowerShell for repeatable or larger searches
Exchange Online PowerShell is useful for repeatable searches and exporting results. It does not extend the 90-day history or remove the 10-day limit per query.
Microsoft set 1 September 2025 as the deprecation date for the legacy message trace experience and cmdlets. New procedures should use Get-MessageTraceV2 and Get-MessageTraceDetailV2, rather than building around Get-MessageTrace or Get-MessageTraceDetail.
Search with Get-MessageTraceV2
The new functionality requires Exchange Online PowerShell V3 module version 3.7.0 or later. Connect using Connect-ExchangeOnline, then run a bounded query.
For the previous 24 hours, use Get-MessageTraceV2 -StartDate (Get-Date).AddDays(-1) -EndDate (Get-Date) -ResultSize 5000.
The default return limit is 1,000 records; ResultSize allows up to 5,000. Microsoft’s Get-MessageTraceV2 reference documents the supported parameters.
Retrieve events and handle result limits
Use Get-MessageTraceDetailV2 with the relevant MessageTraceId and recipient address to retrieve event details. The message trace detail reference describes that lookup.
A full 5,000-record response may be incomplete. Continue using the last result’s Received timestamp as the next EndDate and its recipient through StartingRecipientAddress, following Microsoft’s paging approach.
Narrowing the sender, recipient and time range is often simpler than collecting every message first. Preserve the query parameters alongside the export so another administrator can understand its scope.
Frequently asked questions
Can message trace show the email’s contents?
Message trace shows metadata, subject information and processing events, not the complete message body or attachments. It’s a delivery investigation tool rather than a mailbox content search.
Where authorised investigation requires mailbox content, Microsoft provides separate Purview eDiscovery search capabilities. Older documentation may refer to the Security and Compliance Center, so look for the current Purview eDiscovery guidance. These searches require separate permissions and an investigation scope.
How long should a Pending message take?
Pending has no single delivery time. It means delivery is still being attempted or retried, often after a temporary problem with the destination.
Review the latest diagnostic response, elapsed time and whether other recipients are affected. A temporary remote-server rejection needs a different response from a local connector or routing problem.
Resolve the cause before changing the controls
A useful Microsoft 365 message trace investigation ends with the recipient-specific outcome, the event that explains it and a documented next action. Changing a rule without that evidence can leave the original problem unresolved.
If missing emails recur, ask our team to review delivery configuration, forwarding and filtering through our Microsoft 365 email security services. We can help identify configuration gaps without treating every blocked message as a reason to weaken protection.
