Create Content searches based on message ID, Time, and null/blank subjects.
Employee's send out emails with no subjects all the time, however I am unable to add a null/blank subject as a condition in content search.
I am also unable to content search or filter based off of message ID.
There is also no time option, only date, as a search condition.
This makes content searching for an email with no subject a huge pain.
Please add the ability to create content searches based off of blank/null subjects, sent time between X and Y, and based off of message ID in the mail headers as an option.
Tell us more null subjects and MessageID scenario. You are currently able to query the time.
In my case I need to delete an email from user's mailboxes from a verify specify time. It would be perfect and we can add the messageID into Security and Compliance search.
I had luck using New-ComplianceSearch to search InternetMessageID -ContentMatchQuery 'InternetMessageId="<XX12345678901234567890XXXXX@XX1234567890.***.outlook.com>"'
Ringgo Widjaja commented
Anti-spam in EOP have option for empty messages (user can embed a picture and still categorized as empty message). I would like the ability to be able to search for that type of message using content search and eventually delete them.
Brandon Petkov commented
A bad actor used admin credentials to set up forwarding rules for 4 user accounts. Because those forwarded emails are not saved by default in sent emails, I can only find them through message trace. Message trace doesn't generate Document IDs and I cannot run a content search based on any of the information that message trace DOES generate, so our legal team will have to go through ~15000 emails instead of ~5000, then match them against the ~5000 we know were forwarded to an external address.
We had a user accidentally delete messages, then accidentally purge these messages. We were able to identify the specific messages and their MessageID that were purged via the audit logs. However we were not able to retrieve just the purged messages. Instead we had to do content searches via subject and instead of pulling back the 35 deleted messages we had to pull back 300+ messages based on the Subject search. This was inefficient and frustrating to both our admin team and the end user. Please add the ability to perform content searches using the message ID.
I need to be able to search by message ID as well (IntMsgID). This is huge in eDiscovery.
See support ticket 16624267.
IMHO, this is an obvious element to want to search by. It is analogous to en employee number or transaction number and the like. Nice neat tidy search criteria that is unique or near unique, and should be indexed / very fast to get results.
Please make this feature available.
I was also going to add a suggestion for Content searches based on The message-ID as that kinda seems like a no-brainer. I would suggest that you create a Transport Rule to either block or Quarantine mails that have a Blank Subject.