Tracing User Messages Using Exchange PowerShell

When an email goes missing—or arrives late—admins need answers fast: did it leave the sender, hit the service, get filtered, reach the recipient? Message trace is your flashlight. In Microsoft 365, Exchange Online PowerShell is the tool you use to trace messages end-to-end across the service.

Note 1: Microsoft Graph PowerShell cannot trace mail flow messages. For message tracing, use Exchange Online PowerShell.

Note 2: Get-MessageTraceV2 and Get-MessageTraceDetailV2 are the current (latest) cmdlets. Get-MessageTrace and Get-MessageTraceDetail are slated for deprecation.

i) Cmdlet Syntax

Get-MessageTraceV2

Get-MessageTraceV2 [-StartDate <DateTime>] [-EndDate <DateTime>] [-SenderAddress <String>] [-RecipientAddress <String>] [-MessageId <String>] [-PageSize <Int>] [-Page <Int>] [Select-Object <Properties>]

Returns high-level delivery events (IDs, sender/recipient, subject, timestamps) for messages within the allowed time window.

Get-MessageTraceDetailV2

Get-MessageTraceDetailV2 -MessageTraceId  -RecipientAddress  [-PageSize <Int>] [-Page <Int>]

Drills into per-hop details (antispam, transport, handoffs) for a specific message trace & recipient.

ii) Usage Examples

Example 1: Tracing all the tenant messages

GET-MESSAGETRACEV2 | SELECT MessageTraceId, SenderAddress, RecipientAddress, Subject

Example 2: Tracing a specific message to get more details

GET-MESSAGETRACEDETAILV2 -MessageTraceId a6cda4e8-6737-4aab-ac8a-08ddf38826a3 -RecipientAddress samadmin@7xh7fj.onmicrosoft.com

iii) Cmdlet Tips

• Connect first:

Connect-ExchangeOnline with an admin role (e.g., View-Only Organization Management, Organization Management).

• Narrow the window:

Add -StartDate/-EndDate to speed queries and reduce noise.

• Find the message by Internet Message ID:

If you have the RFC822 Message-ID header, use -MessageId "" with Get-MessageTraceV2 for precise results.

• Pivot from summary to detail:

Copy MessageTraceId from Get-MessageTraceV2 output and use it with Get-MessageTraceDetailV2 + the recipient address.

• Export for tickets/audits:

Pipe to CSV:

Get-MessageTraceV2 ... | Export-Csv .\trace.csv -NoTypeInformation

• Respect retention:

Message trace data is time-limited; older mail may require advanced traces or support.

iv) Possible Errors and Solutions

Error	Cause	Solution
The term 'Get-MessageTraceV2' is not recognized	Not connected / Module outdated	Install/Update EXO V3 module and run Connect-ExchangeOnline.
Empty results	Wrong time window or filters too strict	Add/adjust -StartDate/-EndDate, remove narrow filters, search by -MessageId.
You don't have sufficient permissions	Missing RBAC role	Use an account with appropriate Exchange admin roles.
Parameter binding errors	Incorrect parameter types/formats	Ensure -MessageTraceId is a GUID and dates are valid DateTime.
Detail cmdlet returns nothing	Recipient address mismatch	Use the exact -RecipientAddress shown in Get-MessageTraceV2 output.

vi) Conclusion

For end-to-end mail flow visibility, Exchange Online PowerShell’s V2 tracing cmdlets are the way to go. Use Get-MessageTraceV2 to find the message and Get-MessageTraceDetailV2 to explain what happened at each hop. Remember, Graph PowerShell doesn’t handle message tracing—Exchange PowerShell does. With a tight time window, the right identifiers, and exports for evidence, you’ll resolve delivery questions quickly and confidently.