Message trace in Exchange Online and the Microsoft Defender portal

Message trace follows an email message through Exchange Online so you can see whether it was received, delivered, delayed, failed or filtered, and what happened to it along the way. Use it to answer “where is my email?”, troubleshoot mail flow and check the effect of a policy change.

Where to find message trace now

The old path through the Security & Compliance Center (Admin centers > Security & Compliance > Mail flow > Message trace) no longer applies. Message trace now lives in the Exchange admin center (EAC), and you can reach it two ways:

• Exchange admin center: admin.exchange.microsoft.com > Mail flow > Message trace.
• Microsoft Defender portal: security.microsoft.com > Email & collaboration > Exchange message trace. This is a pass-through that opens the same EAC page.

Before you start

• Roles: Organization Management, Compliance Management or Help Desk (Exchange Online role groups). In Microsoft Entra, Global Administrator, Exchange Administrator or Compliance Administrator also work, depending on the portal. Use the role with the fewest permissions, and keep Global Administrator for emergencies.
• Time range: the default is 2 days and the maximum is 90 days.
• Delivery status lag: the status shown can trail the real status by 5 to 10 minutes.

Which report do you need?

The report you get depends on the time range you pick. A range of 10 days or less returns a Summary report on screen straight away. Anything even slightly over 10 days is prepared from archived data and comes back as a downloadable CSV, which can take several hours.

• The Enhanced summary adds fields such as direction, original client IP and connector ID. The Extended report adds routing and event-level detail.
• Original client IP data is kept for 10 days only, and appears only in Enhanced and Extended reports.
• A downloadable CSV can be up to 800 MB, and files that large can’t be opened in Excel or Notepad. Narrow the date range and add filters.

Run a message trace

1. Open Message trace in the EAC and select Start a trace, or pick a query from Default queries, Custom queries or Autosaved queries (your last 10 runs).
2. Enter the Senders and Recipients. The more precise the filters, the faster the trace and the fewer results to read.
3. Set the time range. For a Summary report keep it to 10 days or less.
4. Under more search options, set the delivery status, message ID and direction if you need them.
5. Select Search. Open a message to see its detail and events, or request a report from Downloadable reports for longer ranges.

Delivery status values

• All (default), Delivered, Expanded, Failed, Recalled and Getting status.
• Pending, Quarantined and Filtered as spam are available only for searches of under 10 days.

Message events

Open a message to see its events: Receive (the service received it), Send (sent to the next hop), Deliver (delivered to the mailbox), Expand (a group was expanded to its members), Transfer (recipients moved to a new message), Defer (delivery delayed and retried), Fail (it couldn’t be delivered), Resolved, DLP rule and Sensitivity label.

Message trace in PowerShell

The legacy Get-MessageTrace and Get-MessageTraceDetail cmdlets began deprecating on September 1, 2025. Use Get-MessageTraceV2 and Get-MessageTraceDetailV2, which need Exchange Online PowerShell module 3.7.0 or later. Update any scripts that still call the old cmdlets.

• Pagination is gone. Pull results round by round using -EndDate and -StartingRecipientAddress.
• Result size: -ResultSize defaults to 1,000 and is capped at 5,000.
• Throttling: 100 requests per 5 minutes per tenant, for each of the two cmdlets.
• Large sends: use -MessageTraceId to get complete results for a message sent to more than 1,000 recipients.

# First 10 records in a time window
Get-MessageTraceV2 -StartDate '2025-06-13T00:00:00Z' -EndDate '2025-06-13T00:10:00Z' -ResultSize 10

# Next round, starting after the last recipient returned
$mt = Get-MessageTraceV2 -StartDate '2025-06-13T00:00:00Z' -EndDate '2025-06-13T00:10:00Z' -ResultSize 10
Get-MessageTraceV2 -StartDate '2025-06-13T00:00:00Z' -EndDate $mt[-1].Received.ToString("O") -ResultSize 10 -StartingRecipientAddress $mt[-1].RecipientAddress

# One message by Network Message ID, with its event detail
Get-MessageTraceV2 -MessageTraceId 2bbad36aa4674c7ba82f4b307fff549f -SenderAddress john@contoso.com -StartDate 06/13/2025 -EndDate 06/15/2025 | Get-MessageTraceDetailV2

For data older than 10 days, or to get every message in a large result, use Start-HistoricalSearch and Get-HistoricalSearch. Check the cmdlet reference for the current syntax.

Troubleshooting

• Message not found: widen the time range, check the sender and recipient addresses, and drop filters you don’t need. Confirm that your range doesn’t miss the send time, and note the time zone setting applies to both your query and the results.
• Status says Getting status or looks wrong: wait 5 to 10 minutes and run it again.
• No Pending, Quarantined or Filtered as spam results: those statuses appear only for searches under 10 days. Shorten the range.
• Search over 10 days returns nothing on screen: it comes back as a downloadable CSV. Check Downloadable reports, and remember Enhanced and Extended reports need a sender, recipient or message ID.
• Need to investigate a threat: with Defender for Office 365 Plan 2, open the results in Threat Explorer using View in Explorer, which needs an E5 or A5 licence with the Threat Intelligence feature.

Sources

• Message trace in the modern Exchange admin center (Microsoft Learn)
• Message trace in the Microsoft Defender portal (Microsoft Learn)
• MC1092458: new message trace and legacy retirement (Microsoft 365 message center, via mc.merill.net)

Last reviewed: October 23, 2026.