query on content search

While there are some issues with special characters support in eDiscovery (see for example https://video2.skills-academy.com/en-us/purview/ediscovery-keyword-queries-and-search-conditions#special-characters), the PowerShell cmdlet you are using should work fine.

Once the search completes, you can review the results within the Compliance center, before doing the deletion. Alternatively, you can export the results, or just the report, in order to review the messages. You cannot do this part purely with PowerShell if that's what you are asking.

Hi，@Glenn Maxwell

Thanks for posting your question in the Microsoft Q&A forum.

The command you provided looks generally correct, but there are a few things you might want to note:

-ContentMatchQuey appears to be -ContentMatchQuery, there is a typo.

As Vasil Michev mentioned, certain special characters are not included in the search index and are therefore not searchable.

According to your request, I conducted the test:

1. I created a CSV file.

2. Send an email to members with the subject line "Test Test Test Test: This is a spam/phishing email please ignore it, Please delete the email".

3. Connect to your organization's Security and Compliance PowerShell.

4. Import a CSV file and define search names and subjects.

$users = Import-Csv -Path "C:\Users\brucejing\Documents\test2.csv"

$searchName = "DeleteSpecificEmailSearch1"

$subject = "Test Test Test Test: This is a spam/phishing email please ignore it, Please delete the email"

$searchQuery = "subject:"$($subject)""

5. Create a new search item.

New-ComplianceSearch -Name $searchName -ExchangeLocation $users.EmailAddress -ContentMatchQuery $searchQuery

6. Start your search.

Start-ComplianceSearch -Identity $searchName

7. If you want to view the searched emails, you can view them in Microsoft Purview->content.

8. Delete the searched emails.

New-ComplianceSearchAction -SearchName $searchName -Purge -PurgeType SoftDelete

9. After waiting for a while, you will find that the test email has been deleted. The person whose information is deleted will receive an email alerting them.

If my answer is helpful to you, please mark it as the answer so that other users can refer to it. Thank you for your support and understanding.

is the below syntax correct? i am adding Received and from

$users = Import-Csv -Path "C:\Users\brucejing\Documents\test2.csv"

$searchName = "DeleteSpecificEmailSearch1"

$subject = "Test Test Test Test: This is a spam/phishing email please ignore it, Please delete the email"

$searchQuery = "subject:"$($subject)""

New-ComplianceSearch -Name $searchName -ExchangeLocation $users.EmailAddress -ContentMatchQuery $searchQuery AND (Received:05/01/2024 00:00..06/15/2024 23:59) AND (from:"user100@contoso.com")

Hi，@Glenn Maxwell

I'm glad to hear from you.

According to the command you provided, there is no error overall, but there is a problem with the date format.

This is the cmdlet after I optimized it. I ran the command and it worked without any problems.

$searchName = "DeleteSpecificEmailSearch5"

$subject = "Test Test Test Test: This is a spam/phishing email please ignore it, Please delete the email"

$searchQuery = "subject:"$subject" AND (Received:2024-06-29-00:00..2024-07-01-23:59  AND (from:" [user100@contoso.com](mailto:user100@contoso.com)")"

New-ComplianceSearch -Name $searchName -ExchangeLocation $users.EmailAddress -ContentMatchQuery $searchQuery

If my answer is helpful to you, please mark it as the answer so that other users can refer to it. Thank you for your support and understanding.