Find emails sent as Bcc to external addresses in Office 365

Question

_{Wednesday, November 15, 2017 8:36 PM}

Basically what the subject says. I'm trying to find a powershell command or anything that will give me a list of all emails sent to an external address as a Bcc (blind carbon copy) for the past 60 days.

All replies (6)

_{Thursday, November 16, 2017 9:29 AM ✅Answered | 1 vote}

Hi,

We could list the message ID of the emails that Bcc to the specific external address.

Please try the following command:

Get-MessageTrackingLog -Recipients "external address" -Start "date"  | where{$_.RecipientStatus -contains "To" -and $_.RecipientStatus -contains "Bcc"} | ft sender, recipients, messageid, RecipientStatus

Below is my test result:

Regards,

Manu Meng

Please remember to mark the replies as answers if they helped.
If you have feedback for TechNet Subscriber Support, contact [email protected].

_{Wednesday, November 15, 2017 10:07 PM}

Hi,

Try using the get-messagetrackinglog -sender <[email protected]> -recipients <[email protected]> -start "11/13/2017 08:00"00" -end "11/16/2017 08:00:00" | select sender, recipients, RecipientStatus

_{Thursday, November 16, 2017 6:45 AM}

You can run a message trace and view the results in Office 365.

Here is step by step details to help you more - https://technet.microsoft.com/en-us/library/jj200712(v=exchg.150).aspx

_{Thursday, November 16, 2017 1:03 PM}

This is close to what I need, but I just need a list of messages from any user who sent with bcc. So basically I need to pull any and all email sent from any users that had the Receipient Status of Bcc. I tried using ReceipientStatus as a search parameter but it didn't seem to work.

_{Thursday, November 16, 2017 11:04 PM}

Then Manu's one who do the trick for you.

_{Friday, November 2, 2018 6:40 PM}

I know this is an older thread - but no, Manu's will not work because get-messagetrackinglog is not a valid command in O365 / Exchange Online. So there is no solution for this, unfortunately. Get-MessageTrace is available, but there is no recipientstatus property available to use.