jdgregson / o365utils Goto Github PK

https://github.com/jdgregson/Delete-Emails-O365/blob/8d434d6b4f3366bc8ba8337913b0cdbf66e4b847/Delete-Emails.ps1#L211

Perhaps add something like $answer = Read-Host "[Y] Yes [N] No [M] More details (default is"N")" after?

As MFA adoption increases, it will become vital for Delete-Emails-O365 to support MFA-enabled login.

How confirmation searches currently work:

1. for each user who had matches a new search string is crafted which will exclude various deleted items folders
2. all of those searches are performed over and over again in a loop until the search returns 0 results

The problem with this is that if the email is not deleted, the confirmation search will never complete. For example, if the email fails to delete, or if the user receives another matching email while the confirmation search is running, the search will never confirm or error out.

There should be a timeout, or a maximum number of searches. After this timeout there user should be notified that the deletion could not be confirmed and that they should manually verify or try the deletion again.

When an email is deleted from only one mailbox, confirmation search gets stuck in an infinite loop (creating compliance searches forever) and is unable to verify the deletion.

Per https://github.com/MicrosoftDocs/office-docs-powershell/#817d40e9bfa5fcf802b0694b71fbef3944cc0fc4, Microsoft has added HardDelete as a purge type for New-ComplianceSearchAction. We should implement this as an option in Delete-Emails.ps1.

I tried the script today, but seems like the Purge is limited to 10 items.

https://docs.microsoft.com/en-us/powershell/module/exchange/policy-and-compliance-content-search/new-compliancesearchaction?view=exchange-ps

A maximum of 10 items per mailbox can be removed at one time. Because the capability to search for and remove messages is intended to be an incident-response tool, this limit helps ensure that messages are quickly removed from mailboxes. This action isn't intended to clean up user mailboxes.

When something goes wrong and the user exits Delete-Emails incorrectly, several compliance searches can be orphaned and left behind permanently. Delete-Emails names its compliance searches something similar to delete-emails-daa2450 so that they are easy to identify, but there is no easy way to remove them all at once.

We should add a -cleanup parameter to the script which will remove all searches starting with delete-emails-* and then exit.

One consideration though is that large organizations can be running Delete-Emails many times, and using the proposed -cleanup option could remove active deletion or confirmation searches for currently running instance of Delete-Emails. Maybe by default it will only remove searches which have completed more than five minutes ago?