Improve message tracing in Exchange online
We have had a lot of issues with spam, whether its cryptovirus emails getting through, or good emails getting improperly blocked. Because of this, we need good message tracing (to find the emails), which we do not feel we have with exchange online. We would like to make the following suggestions:
- Need to be able to trace further than 7 days back without a 4 hour wait per trace. Our previous message tracing system could go back the entire year nearly instantly, but we need at least 30 days without the 4 hour wait per trace. This was pitched as something that could replace our previous tracing system, and this does not do it.
- UTC time is confusing in message tracing. It uses “AM and PM.” AM/PM in UTC time is ambigious since UTC time it used all over the world. So either use UTC, or fix the timezone to use our timezone automatically. It looks like very little effort was put into implementing message tracing if this made it past QA.
- We would like more options in message tracing, especially completely basic fields like searching by subject. I would like to know how this was rolled out as an enterprise product without that a "subject" search field when tracing emails. Part of the reason it is so slow is probably because you have very few search fields to refine.
- Overall speed improvements, even tracing back less than 7 days or less is slow (sometimes "spins" for several minutes", but more than 7 days is 4 hours+). We basically received a poorly formatted spreadsheet after 4 hours.
A premier case was opened for all of this, the features simply do not exist and its not a configuration issue. They did mention compliance center can help search for emails quicker, but does not trace.
Thank you for taking the time to submit this feedback. Since there are multiple pieces and layers of feedback in this single post, it makes it more difficult than many to address. First, let us share a little about what we’ve been doing. Since this post was made, we have prioritized performance and reliability improvements for both Message Trace (inside 7 days) and Historical Search (typically outside of 7 days). We’ve added details to Message Trace that weren’t there before, decreasing the need to run Historical Searches inside of 7 days. For Historical Search, we have improved the results to be more clear for those who are not familiar with the Exchange Message Tracking log format. Additionally, while we get the total value of Message Trace, we’ve also prioritized reducing the constant need to search & destroy. We’ve made tremendous strides in effectiveness, even as the bad guys got more creative and aggressive. We’ve rolled out ZAP (which is the automatic version of ‘search and destroy’), and we’ve improved our compliance search capabilities. Hopefully you’ve noticed these investments.
But, we’re not finished. We’re working right now to address some of the complaints and confusion around the Message Trace admin experience itself. Our strategy is to continue adding more events to the Office 365 Graph API, and provide ways for larger customers to get at larger datasets faster. More than just providing you with raw data, we’re working on Security & Compliance features that reduce the effort involved and focus on specific tasks, like identifying which campaigns we’ve protected you from, and what suspicious activity you might want to beware of.
We also hear the feedback about improving subject based search, improving the retention time of Message Trace beyond 7 days, and continuing to improve performance. While we have nothing additional to communicate specifically in these areas at this time, we continue to welcome feedback and scenarios that helps us prioritize — know that we’re listening and we’ll continue working to improve these scenarios.
Douglas Plumley commented
Search by subject and direction (inbound/outbound) would be really helpful.
Scott Moore commented
The ability to perform message traces in the EAC GUI by Subject as John noted is a fundamental requirement. Also, the ability to search by sender domain in the GUI should be a fundamental requirement.
dcis team commented
Also, why are you only able to trace 500 results? If I want to see how many people received an email, I have to use the even slower compliance center.